SUNBURST had commands that allow an attacker to write or delete registry keys, and was observed stopping services by setting their "HKLM\SYSTEM\CurrentControlSet\services\\[service_name]\\Start" registry entries to value 4. It also deleted previously-created Image File Execution Options (IFEO) Debugger registry values and registry keys related to HTTP proxy to clean up traces of its activity.