tokens: The malware checks for sinkholing of its control servers before each network communication session and does not initiate its malicious activities—such as downloading and running the malicious payloads—if it thinks the Domain Name Service DNS records have been sinkholed.