Download and unzip the file and check the hint:
Hint: We're noticing some strange connections from a critical PC that can't be replaced. We've run an AV scan to delete the malicious files and rebooted the box, but the connections get re-established. We've taken a backup of some critical system files, can you help us figure out what's going on?
This is a Windows Registry Hive. We can tell this by running "file query". So, we can use reglookup in Kali to see all the registry keys. Since the name of this challenge is Persistence, we need to examine the locations that would allow persistence for an attacker (usually HKCU/Windows/CurrentVersion/Run etc.).
└─$ reglookup query | grep /Windows/CurrentVersion/Run
Well, that exe filename looks interesting. Run it through CyberChef and Base64 decode it and we have our flag!