DFIR CTF: PCAP Challenge - Question 7

For the question 

What is the XOR key used to encrypt the malware payload?

I am wondering about what I should be looking for in the WireShark, as I can't seem to find any indications of a specific key being used in the pcap file.

From the files extracted, I also did not notice any indications from the XML file as well.

Summary: I am basically super lost in where I should be digging deeper from.