# Powershell writeup> I want to know what is happening in my Windows Powershell.
```bash$ file file.mp3file.mp3: Audio file with ID3 version 2.46.20
# If you run strings on the file you can see there are 3 files$ strings file.mp3Login.evtxSuspicious.regPowerShell.xml
# Extract the files cp file.mp3 file.zipunizip file.zip
# Open `Powershell.xml` and you can see all commands that were ran# After looking around on line 104 you can find the flag encoded in base64$ echo "ZGFya0NURntDMG1tNG5kXzBuX3AwdzNyc2gzbGx9" | base64 -ddarkCTF{C0mm4nd_0n_p0w3rsh3ll}```