In the old post from when the update was released a Heise article is linked, that contains indicators of compromise, and in turn links to Kevin Beaumont for the details of his analysis:

lemmy.zip/post/54712916
heise.de/…/Notepad-updater-installed-malware-1110…
doublepulsar.com/small-numbers-of-notepad-users-r…