tokens: In some samples analyzed by CTU researchers, the attachment was an obfuscated VBScript .vbs file that downloads and installs AdWind, or the email message just included a link to download and install the malware.