Ph4nt0m 1ntrud3r(ft wireshark)

the file downloaded was in the .pcap format so I opened that in the wireshark and sorted the packets according to the time and all the packets with length 12 gave a partial base64 string so I arranged all the strings and finally got this