TrickBot Disguises Scheduled Task as Wireshark Update to Maintain Windows Persistence

**Executive Summary:** FortiGuard researchers analyzed a TrickBot variant that hides C2 traffic inside malformed DNS requests to westurn.in, establishes persistence by creating Windows Scheduled Tasks disguised as "Wireshark autoupdate #<random_number>", and employs string encryption, API-hash resolution, and other anti-analysis techniques; the report includes technical TTPs and IOCs for detection and response.