Hi,
I found the Flag by searching for the whole file system for a file named resume. Afterwards I dumped the file and extracted the flag. I wonder if there is a way to find the resume file by checking the powershell process more in detail. Does anyone know whether this is possible ?