Procedure examples

Orz can overwrite Registry settings to reduce its visibility on the victim.

Stuxnet can delete OLE Automation and SQL stored procedures used to store malicious payloads.

IronWind has used a .NET DLL named "exit-DN4-core.dll" to terminate malicious processes running on victim's systems.

Sardonic has the ability to delete created WMI objects to evade detections.

Bankshot deletes all artifacts associated with the malware from the infected machine.

DUSTTRAP restores the `.text` section of compromised DLLs after malicious code is loaded into memory and before the file is closed.

Neoichor can clear the browser history on a compromised host by changing the `ClearBrowsingHistoryOnExit` value to 1 in the `HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy` Registry key.

BlackEnergy has removed the watermark associated with enabling the TESTSIGNING boot configuration option by removing the relevant strings in the user32.dll.mui of the system.

Rising Sun can clear a memory blog in the process by overwriting it with junk bytes.

Flagpro can close specific Windows Security and Internet Explorer dialog boxes to mask external connections.

DarkWatchman can uninstall malicious components from the Registry, stop processes, and clear the browser history.

MultiLayer Wiper uses a batch script to clear file system cache memory via the ProcessIdleTasks export in advapi32.dll as an anti-analysis and anti-forensics technique.

EVILNUM has a function called "DeleteLeftovers" to remove certain artifacts of the attack.

Metamorfo has a command to delete a Registry key it uses, \Software\Microsoft\Internet Explorer\notes.

BPFDoor clears the file location `/proc/<PID>/environ` removing all environment variables for the process.

SDBbot has the ability to clean up and remove data structures from a compromised host.

Sibot will delete an associated registry key if a certain server response is received.

HermeticWiper can disable pop-up information about folders and desktop items and delete Registry keys to hide malicious services.

SUNBURST removed HTTP proxy registry values to clean up traces of execution.

IPsec Helper can delete various registry keys related to its execution and use.

FunnyDream has the ability to clean traces of malware deployment.

Maze has used the “Wow64RevertWow64FsRedirection” function following attempts to delete the shadow volumes, in order to leave the system in the same state as it was prior to redirection.

ShadowPad has deleted arbitrary Registry values.

SILENTTRINITY can remove artifacts from the compromised host, including created Registry keys.

CSPY Downloader has the ability to remove values it writes to the Registry.

Remcos can clean saved cookies and logins from the web browser.

Donut can erase file references to payloads in-memory after being reflectively loaded and executed.