Comment by mikeweiss

Exactly... Were they exflitrating files open in notepad++ , or was notepad++ installing additional malware for system wide access? What was the end goal?