Sunburst: How the SolarWinds malware works, and who was targeted (blog.truesec.com)

I looked briefly at the encoder and it looks like the ad names are truncated on the size 32. Not sure why the threat actor would do that do. I guess they need some size limitation and just picked an arbitrary number