Trickbot EXE files seen from .png URLs on 2019-09-25

TRICKBOT EXE FILES FROM PNG-EXTENSION URLS SEEN ON WEDNESDAY 2019-09-25:

hxxp://185.98.87[.]185/samerton.png
hxxp://185.98.87[.]185/tablone.png
hxxp://185.98.87[.]185/wredneg2.png

$ file *.png
samerton.png: PE32 executable (GUI) Intel 80386, for MS Windows
tablone.png:  PE32 executable (GUI) Intel 80386, for MS Windows
wredneg2.png: PE32 executable (GUI) Intel 80386, for MS Windows

$ shasum -a 256 *.png
4a5bdf328d682efaec55979b3e0723db5bb79775c7c133936c779e3bdc03201d  samerton.png
7d7c9b407e4ecb92c554a8813625f9e27b85231348f0ebbb0ff3531488160878  tablone.png
9d4b47168d59257dfcbf51f2d4df30f6f30894fb3fc94ca9f34fa9beebc952b4  wredneg2.png