Trickbot IOC's

Creates
c:\users\<username>\appdata\roaming\services\las34.png.exe
c:\users\<username>\appdata\roaming\services\group_tag
c:\users\<username>\appdata\roaming\services\client_id

Method of persistance
Creates scheduled task "service update" which points to c:\users\<username>\appdata\roaming\services\las34.png.exe

Network traffic
Goes to tcp port 449
Goes to tcp port 447