Chapardeur de mots de passe

Description

A friend asks for your help to check whether the email he has just opened related to Covid-19 was malicious. He pretends he tried to open the attachment with no success. Soon after, a popup from his antivirus software indicated the word KPOT v2.0, but nothing else happened. After a preliminary analysis, your friend suggests that the malware has been modified, especially since the content that was potentially exfiltrated no longer seems predictible. To continue the analysis, your friend gives you a network capture of his traffic. Help him determine whether some files have indeed been exfiltrated and whether he needs to change his passwords.