On 27 March 2019, we notice a Twitter post by ClearSky Cyber Security on having a sample named “Timelines-ECRL.docx” (MD5: 01b5276fdfda2043980cbce19117aaa0) which likely refers to…