# Very Very Hidden> Credit goes to @ZeroDayTea
Given a `.pcapng` we were able to recover a several `http` files. We find two `duck` images.  ## IntuitionLooking at the traffic, we see a lot of references to `powershell` so after extensive research, a tool called `Extract-PSImage` was found and it could extract powershell scripts from images.## MethodBy running the tool on the `evil_duck` image we were able to recover a script that will output the flag.