EJ Fox / NBC News

Americans may have thought they were using hashtags during the election to discuss politics with each other. They didn't know they were also talking to Russians thousands of miles away in a troll factory.

The top hashtags were the generic #politics, followed by #maga, #Trump, #news, and #NeverHillary.

"Some of the trolls participated in trending hashtags by inserting entirely appropriate content, perhaps as a way of getting their screen names in front of other people and gain a following," said David Allen, an analyst at software company Neo4j who assisted NBC News with analyzing the database.

"Others would try to 'hijack' a hashtag," inserting disruptive content into a trending topic, "or draw a non-political hashtag into a discussion of politics," he said.

Related: Russian trolls duped nearly 40 celebrities

Troll activity spiked again during the final presidential debate, rehashing conspiracy theories and retweeting divisive content. The trolls alternately said the debate was rigged, or a total win for Trump.

But the trolls did speak in a chorus when it came to one hashtag.

About 9 a.m. on Oct. 19, 2016, the morning of the final debate, the Russian troll account "WorldOfHashtags" kicked off a new online conversation.

"The last presidential #debate starts soon. So let's discuss #RejectedDebateTopics," the troll wrote. Moments earlier they had referred to it as a "hashtag game" that was "hosted" by "GiselleEvns," another of the Russian troll accounts.

Immediately a cluster of the trolls started pumping out tweets with the hashtag, several tweets per minute. Some showed preference for Trump, some against, others were just jokes. But the underlying message was "about trying to underscore the view that the system is rigged," said Rosenberger.

Screenshot of a tweet sent by a Russian troll on the night of the final debates, Oct. 19, 2016. Online archives.

Later that day over 600 other Twitter users, who may have included authentic Americans, added hundreds of their own twists to the hashtag.

Twitter didn't respond to NBC News requests to confirm whether the hashtag had "trended" for other users and appeared in a box that would have promoted it to new users.

Related: Russian Twitter trolls stoked voter fraud fear before election

When it came to tweets sent in real-time during the debate, popular Tennessee Republican party impostor account @TEN_GOP took charge, sending the majority of the original tweets.

TEN_GOP: "Iran payment wasn't just ransom, it was money laundering. The deal was set up by Hillary when she was sec of state #debate #debatenight"

TEN_GOP: "Donald Trump's ending was perfect! RT if you are also sure that #Trumpwon! #Debate"

Those tweets got thousands of retweets, likes and user comments.The account also directly tweeted compliments to Trump during the debates.

"@realDonaldTrump Can't wait to see you in the WH," tweeted the Russian troll an hour before the debate began. Right as the debated ended, the Russian troll account tweeted to Donald Trump, "We are proud of you!"

Playing all sides

The trolls were organized into three general ideological networks, said Allen, the Neo4j analyst.

Trolls on the "Right" cluster promoted Trump and attacked left-leaning causes and politicians, mainly Clinton.

Trolls in the "Left" cluster generally attacked Trump and his followers, though they didn't express support for Hillary Clinton.

"Black Lives Matter" were pro-black, but not pro-Democrat. Their message was to distrust all authority, especially the police.

During the election, the hyped-up tweets appeared to be just part of the social media noise.

"We saw a lot of questionable accounts and content, but we knew there were underground networks to spread content that would undermine Hillary," said Emmy Bengtson, former deputy social media director for the Clinton campaign. "We just didn’t know who was paying for it."

The banner on the bridge

On November 10th, 2016, two days after the election, an identified Russian troll claimed responsibility for a provocative banner that hung from a bridge that leads to the Pentagon in Washington. The estimated 20 by 25 foot banner of outgoing President Obama read, "Goodbye Murderer."

The troll, who claimed to be a military veteran, said he and fellow "political activists" had hung the banner. The account blamed the president for "numerous bloody wars" and deaths in Libya, Syria, Yemen and Ukraine.

"He doesn’t deserve to be a winner of the Nobel peace prize. His true prize awaits him in the Hague court docks,” tweeted @LeroyLovesUsa, who also tweeted the photos to @realDonaldTrump.

A spokesman for the U.S. Park Police, Sgt. James Dingeldein, confirmed that a park police officer had removed the banner and that it was destroyed this fall. A Freedom of Information request filed with the park police by NBC News wasn't fulfilled before publication.

The Russian troll account appears to have been the first to post the images online. The digital propaganda had suddenly entered the real world.

Screenshot of Russian troll tweets claiming responsibility for hanging the poster of Obama.

The photos of the bridge banner were retweeted by other Russian trolls and "Leroy Barton's" tweets got hundreds of likes and retweets. The story spread across social media sites, and the Russian state-owned media organization RT.

A report by the U.S. intelligence community determined that Putin and the Russian Government who ordered the trolls' influence campaign had developed a "clear preference" for Trump.

In the immediate wake of Trump's victory that the trolls had worked toward, was this brazen banner an unfond farewell to the previous administration?

It's unknown what person or persons hung the banner in our nation's capital, who took the photos, and how they got to the troll.

But there is some precedent. In January 2016, a pro-Kremlin art group called Glavplakat claimed responsibility for hanging a Shepard Fairey-style poster of Obama opposite the U.S. Embassy in Moscow with the word "Killer." The group has hung other banners criticizing opponents of the state around the Russian capital tightly controlled by the Putin regime. No links between the group and the government have been proven.

As the intelligence community wrote, "By their nature, Russian influence campaigns are multifaceted and designed to be deniable because they use a mix of agents of influence, cutouts, front organizations, and false-flag operations."

An apparent image file of the poster tweeted by the Russian troll. Online archives

Related: Russian trolls pushed graphic, racist tweets to American voters

So far news organizations that have recovered and published about the deleted tweets have only been able to probe a slice of the overall Russian troll accounts suspended by Twitter.

"There's still some part of the iceberg that's under the water," said Allen.

Experts say that the troll activity fits in with a Cold War-era playbook called "active measures," in which the Russians used disinformation and selective reframing to undermine faith in democracy, exploit political divisions, blur fact and fiction, and promote Russian policy agendas abroad.

"They think that for decades they've been on the defensive, and we've been hurtling at them our messages about markets and democracy and liberalism," said Michael McFaul, who was the U.S. ambassador to Russia from 2012 to 2014 in the Obama administration.

"And they're now on the offensive."