SUNBURST's behavior is affected by the presence of malware analysis and security software. To disguise the strings used to detect these security tools, UNC2452 calculated and embedded a hash value for each string. The list of hashes and their corresponding strings can be viewed at this FireEye GitHub page