Forensics - MarshallInTheMiddle

Guys, hints please… I can find what is was stolen but not the flag ? Shoud I decode the ssl traffic ?