**Flag Was just encoded in base64 , Strings is enough to get the flag**

Flag : HTB{0k_n0w_3v3ry0n3_h4s_t0_dr0p_0ff_th3ir_l3tt3rs_4t_th3_p0st_0ff1c3_4g41n}
```
┌──(kali㉿kali)-[~/HTBCTF/forensic/forensics_baby_apt]
└─$ strings -n 100 christmaswishlist.pcap|grep -i cmd|grep echo|cut -d "+" -f6|base64 -d

HTB{0k_n0w_3v3ry0n3_h4s_t0_dr0p_0ff_th3ir_l3tt3rs_4t_th3_p0st_0ff1c3_4g41n}
```