The flag is visible outside the windows

hackerlab

Task: a large ZIP archive hides a Windows 10 VirtualBox disk image containing many password-protected ZIP artifacts, often stored in NTFS Alternate Data Streams. Solution: enumerate the OVA/VMDK filesystem, pivot from recovered browser credentials to the long archive password, decrypt the ADS-backed archive from Windows/security/database, and crop the resulting image to read the flag.