Unzipped file presents us with a pcap file.

Opened in wireshark and then followed TCP streams. Base64 encrypted string in TPC Stream number 30.

HTB{0k_n0w_3v3ry0n3_h4s_t0_dr0p_0ff_th3ir_l3tt3rs_4t_th3_p0st_0ff1c3_4g41n}

Original writeup (https://github.com/LazyTitan33/CTF-Writeups/blob/main/HTB%20-%20Cyber%20Santa%20is%20Coming%20to%20Town%202021/Forensics/BabyAPT.md).