If the archive is password-protected, the password is often hidden in the challenge description or "leaked" in a related file.
If a network capture was inside, use Wireshark to follow TCP/HTTP streams. ScooterFlow.rar
Using the file command confirms it is a RAR archive. If the archive is password-protected, the password is
If a .ps1 script is present, it likely uses multiple layers of iex (Invoke-Expression) or XOR encoding. If the archive is password-protected