Command Control Conceal

SOC alert triggered: anomalous outbound TLS connection from notepad.exe to an external IP which should not have happened in any way. An incident responder captured a network trace and a process memory dump of the suspicious notepad.exe process. The memory dump was taken early in the investigation. The attacker continued operating after the dump was captured. Your mission: decrypt the C2 traffic and determine what the attacker accessed and exfiltrated.