Comment by krackers

OP post has an indicators of compromise list, also seen in https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-...

I'm surprised this wasn't linked from the original notepad++ disclosure