tokens: Though there were multiple waves of messages following a similar tactic, each one carried the same malicious .doc file as an attachment SHA256: 6b9af3290723f081e090cd29113c8755696dca88f06d072dd75bf5560ca9408e.