tokens: For example, one version of the Shade cryptor checks victim computers for signs of accounting activity; if it finds any, it doesn't encrypt the files, but instead installs remote control tools in the infected system.