Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\] 'Userinit' = '<SYSTEM32>\userinit.exe,<SYSTEM32>\winnt32.exe'
- [HKLM\SOFTWARE\Classes\exefile\shell\open\command] '' = '%WINDIR%\SysWow64\winnt32.exe "%1" %*'
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Modifies file system
Creates the following files
- %WINDIR%\syswow64\winnt32.exe
- C:\user.png
- C:\user.bmp
- C:\user-32.png
- C:\user-40.png
- C:\user-48.png
- C:\user-192.png
- C:\hello.png
- C:\hello.bat
- C:\users\public\desktop\p䭡ⵖ槒ᛉk
- C:\users\public\desktop\whbręマv丷ptvm
- C:\users\public\desktop\炟rs㮥q摋耖qmu
- C:\users\public\desktop\瘚⍮壸嵽᫉㱶秽lm乲⻀
- C:\users\public\desktop\㛫䊰dy㽶娑wk夰㜙簹
- C:\users\public\desktop\o䬀ᝅyb㑪to`nӿ
- C:\users\public\desktop\㜎稃omku
- C:\users\public\desktop\hx懲㍦v翏۷ᥗ傹᧓k從`⮌
- C:\users\public\desktop\vl⃙еb᭴䝏j`wj
- C:\users\public\desktop\xxeᔁr盟⮀翡twqa
- C:\users\public\desktop\l㔒僤㩎k淩j䣪᠖
- C:\users\public\desktop\瑙h仗壶᎖or؈r䥛e
- C:\users\public\desktop\浴eન劋y㓙sjbv灉d
- C:\users\public\desktop\vc竡炔y䄥v
- C:\users\public\desktop\啖sc䆯gbku滾v
- C:\users\public\desktop\t⸵儿でsg⪸
- C:\users\public\desktop\w漡峞ɡ嬜᱙w
- C:\users\public\desktop\n唛柇d珆
- C:\users\public\desktop\dbࣸ䧣rjiⓢ猖徴
- C:\users\public\desktop\piⁱdp㜡↠iႃy`tkb
- C:\users\public\desktop\ap䏆㎈䭳堍㠾ūc䩐
- C:\users\public\desktop\r㗾rs唾朾b壁d澰l䜧
- C:\users\public\desktop\⎲hheᱼ
- C:\users\public\desktop\䌾crq`x㫲`ay‴俦m
- C:\users\public\desktop\o瓞癬`tl
- C:\users\public\desktop\䔪gdᦧtjlo
- C:\users\public\desktop\㣼㍁䱍稇㊣ᠸ
- C:\users\public\desktop\c嬰┍㒭a
- C:\users\public\desktop\`琱㈭ⷁiwg垘o呑pg
- C:\users\public\desktop\mtpp᧯yoh
- C:\users\public\desktop\㯥h垇yۥᘴjt㺉㣍q
- C:\users\public\desktop\ⵆo耦䢋㈁ⓡ`ˢh硧
- C:\users\public\desktop\t炍䲩pi䥛嚜ǐlrgk独y
- C:\users\public\desktop\kenbsytᙡ㸏枼b
- C:\users\public\desktop\㴊ᤏ`elng〄ṃy
- C:\users\public\desktop\⒐拵ehɐ㗐byh
- C:\users\public\desktop\ݩ⇇aற孍漞☁t檐va
- C:\users\public\desktop\q槙a咧haua
- C:\users\public\desktop\ˠ卥疂㟂ᾅfͬlq㯑⛽r乓
- C:\users\public\desktop\n㫫聖qif▫宮y穜扰㦎o᪱
- C:\users\public\desktop\䰯c㨐d⃀帀傂gdmg
- C:\users\public\desktop\۲唂e㔌᳞tth⯴ad
- C:\users\public\desktop\叆干e瑋
- C:\users\public\desktop\n㗕बᮋy侣壛yeヨoᙕឲ
- C:\users\public\desktop\筥ㅜggcf㜓㮍k``渲
- C:\users\public\desktop\n慆瓷oo斪hj炑
- C:\users\public\desktop\㌍ܻb慊ᑏdww
- C:\users\public\desktop\凙㶍દm瘀すtlgᬠ
- C:\users\public\desktop\灺qּ᠅㨁狽npk澇v
- C:\users\public\desktop\ᙢwx梆椹岄厭牠掁ÐÑjfb
- C:\users\public\desktop\ᯓ挵lt䕻濆ᶦ
- C:\users\public\desktop\⽶䡘y`磗洶㦈冿
- C:\users\public\desktop\㚺漛`bjjj
- C:\users\public\desktop\yť⬼㮫۷
- C:\users\public\desktop\埙䂎⊊卄fuco㐲љ
- C:\users\public\desktop\x`w紳㡽phdr
- C:\users\public\desktop\篧yy䁑l撈䯑``
- C:\users\public\desktop\嶒ḕb䨃gias筚
- C:\users\public\desktop\n䉽㕅䵯ox歞h濞碶
- C:\users\public\desktop\岀掯rה滟ɚ楅摋miᾆ`x小
- C:\users\public\desktop\⚢tjgᓔᅟឹ⳧喛矜e
- C:\users\public\desktop\jlp㨸稇嶰⍝
- C:\users\public\desktop\䵝u㶽秜hftk䦏
- C:\users\public\desktop\ᘩბ弭sjࢿ湵خemg搀
- C:\users\public\desktop\懅ᒹd㢜baq
- C:\users\public\desktop\m竎⮲▏羐vfr∢᱘
- C:\users\public\desktop\vura灆澪k凇䲡
- C:\users\public\desktop\qתn晀玴x݇`ᴠ
- C:\users\public\desktop\rᩐⷿ▿ീys
- C:\users\public\desktop\f砸m灙d➆
- C:\users\public\desktop\v㌃ඌog᷄p`ްcbi
- C:\users\public\desktop\㕭槣uq呹窬ᨶ
- C:\users\public\desktop\hcb⤌涿d`㘚mf稻n
- C:\users\public\desktop\ଵᬝ⤜儇ધወ樘
- C:\users\public\desktop\bű挡lgp㶾㖋氹㜷e
- C:\users\public\desktop\惤u㵍jⱬ`ᐿsn
- C:\users\public\desktop\篙qᝲy⁒qmvŭ
- C:\users\public\desktop\`䊻v㽡ye
- C:\users\public\desktop\䉮ኃa疗xej槿⍀`糂cw
- C:\users\public\desktop\ly☮攟b↦`፼yㅗsㄧf㹍
- C:\users\public\desktop\ui䠎n産⾪fe⁙ጋ乖
- C:\users\public\desktop\㩑cy⧍al御wnsfᆝ
- C:\users\public\desktop\䆟bပ嫽lt䊴檣හb㴩瘝
- C:\users\public\desktop\nk䙲⿁忆g䭿兦
- C:\users\public\desktop\kfֳo嬒r
- C:\users\public\desktop\枿皿ዕybp燞h䔁同ci
- C:\users\public\desktop\⭫ek率o㭬el
- C:\users\public\desktop\ඏn㪔kള
- C:\users\public\desktop\l箫omlcẩr䢗o㕷
- C:\users\public\desktop\䘨nhrެb⟠⾬箅⇢慅
- C:\users\public\desktop\宧寨wⴍㅁ漛㿡pⴿ打Ðâ¢恀
- C:\users\public\desktop\歨p㑪sctsmw⊱wvk
- C:\users\public\desktop\聎秗hጡ㬝
- C:\users\public\desktop\呯ൌnr愆e`gln伧`
- C:\users\public\desktop\㌇c戂ccq耟x
- C:\users\public\desktop\v㩼⇳狐gḵufec
- C:\users\public\desktop\atw糄em
- C:\users\public\desktop\r聃l垒nf絭璥b䨞m
- C:\users\public\desktop\ᛶlcu嬸棱細⢵`l
- C:\users\public\desktop\ᰣ㞧l㉫e`pjky妋
- C:\users\public\desktop\eࣘ㪛t⊏
- C:\users\public\desktop\痙i娾ງe
- C:\users\public\desktop\uggve
- C:\users\public\desktop\㜮eir嶞ㆥhidq⊃抵`o
- C:\users\public\desktop\妠㏪f严朔c૧繃
- C:\users\public\desktop\᠖ἃcils琱k穣劻∼
- C:\users\public\desktop\fm楃`i矿hnfcg岑䚢
- C:\users\public\desktop\ui⟷䏑彏j唉䫧☺dj㵐䉿
- C:\users\public\desktop\ド圲v၊ugln仝a
- C:\users\public\desktop\耿⮽้緊l⫝̸`y烥
- C:\users\public\desktop\ms⦂`y
- C:\users\public\desktop\称p䋾嘗ᚓ㳵甴ᓤ
- C:\users\public\desktop\椮sw䩖䱜䫎w煘w㘂
- C:\users\public\desktop\mpmj䥇l䭤ᦇ`d曁p
- C:\users\public\desktop\rwj㍁繋v垣cxjbas耋
- C:\users\public\desktop\ro`ⅵeuw戓⩌ਝ
- C:\users\public\desktop\`怋㢾橚c䳯vxṷ呤ip㘾
- C:\users\public\desktop\wৡ㉗xtku溳
- C:\users\public\desktop\翳ѝྦྷusnhyo
- C:\users\public\desktop\nuⴁ甪rp夋罕磛
- C:\users\public\desktop\ᖳrpl䔵洡gཪ䚷
- C:\users\public\desktop\g枬㆚掳hwkp䥾s搞
- C:\users\public\desktop\枸x礥᩶dqhdw㋿rc
- C:\users\public\desktop\劉bḧү⬷rxfflh
- C:\users\public\desktop\`sg凝nọ緈j榑琨gjd
- C:\users\public\desktop\n䚓䦡⨧u旽ᾑ
- C:\users\public\desktop\䢐h㮡eఀo惃
- C:\users\public\desktop\oery䚉idq㔌itt⣔
- C:\users\public\desktop\e《翵⼅ᮋt㟱`u
- C:\users\public\desktop\d㩆⬋o拦䛎綒dd瑥㋿p
- C:\users\public\desktop\ਆ⫃ॲ䁓敐呦㙛t⫋ࡄb
- C:\users\public\desktop\䁁㛺䣍bg㩔b
- C:\users\public\desktop\圑ᅷԣkff`
- C:\users\public\desktop\a㒺ᘃhmx
- C:\users\public\desktop\䋵㪇ᰵ掺㕧`
- C:\users\public\desktop\`⪉cyਓ`
- C:\users\public\desktop\xdvng
- C:\users\public\desktop\ᗟjvmflᶮvᳳ䔑yja
- C:\users\public\desktop\w㓌⺹榧dj
- C:\users\public\desktop\䁀ij丂s祣dg换䍝儌l䭒
- C:\users\public\desktop\j`勬vwsw珹v巐
- C:\users\public\desktop\`pᅺe桳䔷橳md䑙box
- C:\users\public\desktop\hhkowߛcᓮcp
- C:\users\public\desktop\osᣞspaan墂j㓁
- C:\users\public\desktop\哤a⅄䦞gwcᤜ䉕凞vh暰
- C:\users\public\desktop\杝ᄅbkp⾁huठ
- C:\users\public\desktop\罺⽋i㤅plo
- C:\users\public\desktop\dmડi娧⯖`ᡑqn侍˥
- C:\users\public\desktop\缅ᜱ粀⁶j`㠆a⊁qk
- C:\users\public\desktop\e㢭畕喈塯ᄋu߆q
- C:\users\public\desktop\⠞潰呤⬷ᝇaham榀qk
- C:\users\public\desktop\hwᶜs⍦ᾲ㠨i⣈扜o羭珴
- C:\users\public\desktop\檮gj绋l
- C:\users\public\desktop\㝲䷙k`n
- C:\users\public\desktop\rv∥eṿq嫋ܻ玈y忋j䒃u
- C:\users\public\desktop\䕊櫸uuyx
- C:\users\public\desktop\`s⭘䅹jn畖⎖hxqw滉
- C:\users\public\desktop\k䛛p悑㟑⢒ធm皓p
- C:\users\public\desktop\o渾⌣i耮`vj耥
- C:\users\public\desktop\ᤜyo桷劎簙vy
- C:\users\public\desktop\悪n`ἦjdtj
- C:\users\public\desktop\kvㄸ䏙d
- C:\users\public\desktop\bkjoleb婘q捍
- C:\users\public\desktop\seud⩼姬⨞q箻κd䔣
- C:\users\public\desktop\u⹐gwᛕ䍅q᭓ve懮
- C:\users\public\desktop\瓈t⩠涎c䝾⥛jw
- C:\users\public\desktop\cÐÒw施p櫴窥
- C:\users\public\desktop\e嬀phey䬠efࡆrf
- C:\users\public\desktop\ⓢs楱brh`q⟺rva䞾䖻
- C:\users\public\desktop\⡍眉g箾fp敕j愧mꮥ
- C:\users\public\desktop\䷉r潄mn䲌⎓i㔲r
- C:\users\public\desktop\v嫈ㅱ敬o⨮v
- C:\users\public\desktop\qsr᪼٧h
- C:\users\public\desktop\`㊚椆⽵㞜rkfl⤺q
- C:\users\public\desktop\ev噂s堕w
- C:\users\public\desktop\䃱puh䥳i濇rxơ拿
- C:\users\public\desktop\ьgd₭s琭䥺kcl崃x噐
- C:\users\public\desktop\pjsi䵬⾷㙲㩳gi⠖g८
- C:\users\public\desktop\䜛f砠᧨ၗtl稒a
- C:\users\public\desktop\叙bsluߪw
- C:\users\public\desktop\䦥生㱪㣜jtiiນ
- C:\users\public\desktop\玙xva媕ry浸u
- C:\users\public\desktop\⏊tv聠h
- C:\users\public\desktop\e她r⢭j➖jq
- C:\users\public\desktop\͌㲘vᢼᷣź尻㾍⫝␀
- C:\users\public\desktop\xflw甈bq滖䱊t
- C:\users\public\desktop\ቪr᭟dr彸䄱䞘
- C:\users\public\desktop\䜍kⓤѓ含byw
- C:\users\public\desktop\pry䝑qጾ嫁㬸jeki
- C:\users\public\desktop\㱗aym樞w炽xq恝
- C:\users\public\desktop\la㑾ab䂷r洺筑耜䭨
- C:\users\public\desktop\q`pώ搴㵝繰㱀扃pys
- C:\users\public\desktop\nnl箑pⓕ
- C:\users\public\desktop\瓝࣡vfthjfጻm焸
- C:\users\public\desktop\䗰㥖㙣䑆`p⊙ᠢ䈦摰哱
- C:\users\public\desktop\嫌║t于s䇲w
- C:\users\public\desktop\拏ᅹw磱壨
- C:\users\public\desktop\gcsr㮩s熣i筴eb䳋⩊稳
- C:\users\public\desktop\r㙂祢hr次㤀ㆨ聋զ竆⌁
- C:\users\public\desktop\yo尘a村篭
- C:\users\public\desktop\th楫al綤ꮀgswᬼo
- C:\users\public\desktop\䎷ry伜p传nn俓`gqc
- C:\users\public\desktop\c䳣d⢌侷憦晘棍
- C:\users\public\desktop\ᄇ亇傢䆑䱮c悪撟wh
- C:\users\public\desktop\ڛɶ碁筗n≮岙䥻
- C:\users\public\desktop\ɥ籫m湢j塰൶l箒⨼f₺
- C:\users\public\desktop\rb晵t䨠皥ffe
- C:\users\public\desktop\c噿䣔Чg`o
- C:\users\public\desktop\r䒢svmℽbwiab儨
- C:\users\public\desktop\ʉ噞ẉx樹ღ枒de
- C:\users\public\desktop\箳॑嘠䰟ᴂn琗
- C:\users\public\desktop\k瞣x窘兟剧ld㟪j䠼w
- C:\users\public\desktop\א匢䶨⊂bms羅asxxu
- C:\users\public\desktop\m᧬i沩s
- C:\users\public\desktop\o昄溈e㔄
- C:\users\public\desktop\䱎qaqo秾iq僳o歪
- C:\users\public\desktop\fq䙗puo䍓kiᛓ塜o懿r
- C:\users\public\desktop\xyqႅ姕᫋晚g㒄瞯bujइ
- C:\users\public\desktop\hqv㵦䒀t⛚mᐤ擱媴柣ᴾ
- C:\users\public\desktop\tr䶂忆ug㠗t㾀
- C:\users\public\desktop\⏷vj㩩t➳揰jචj垖`♞
- C:\users\public\desktop\rk憌sw
- C:\users\public\desktop\殘ka⤯ᖼd䙂⛶m您ৎ俭
- C:\users\public\desktop\撸☐ࡀᰉ䛪⡚hro
- C:\users\public\desktop\ldcag穇១f殃棠h
- C:\users\public\desktop\禁hк㮡㙫ὠos姶ᥡ㈹ㄖᓪb
- C:\users\public\desktop\䃅s䠝yk䕻o
- C:\users\public\desktop\儥娼弄mg屬㾞x䶌恎⎗
- C:\users\public\desktop\唻矊䜸u䋬fi⊔k⠢
- C:\users\public\desktop\jim⟣⦤晳wbg囻氼p䢘
- C:\users\public\desktop\愩h撐慯㿢毗hxc`稽㤶n
- C:\users\public\desktop\㓾壮cp慁xbylպ`粘q
- C:\users\public\desktop\挎vມb篭p朔封tʉ`
- C:\users\public\desktop\kܯጎ᷹r
- C:\users\public\desktop\uࢨga䯅㚆loj斥
- C:\users\public\desktop\䨍呑q痡瀰瘧kwxwj፶⯾扚
- C:\users\public\desktop\fu``i␓ᶈ
- C:\users\public\desktop\䇟୨曆rdmk㰧䗴lfj婻j
- C:\users\public\desktop\ÐÒxngjnu浡y倝y旃m
- C:\users\public\desktop\∞滿奱bsⱆ䊪p㸎afᗞpd
- C:\users\public\desktop\績yoqᱶᜢcn㈃䒞矴kᔅu
- C:\users\public\desktop\㥈vvqkeeu搹t䃓
- C:\users\public\desktop\祄ᐇpyg
- C:\users\public\desktop\qqkʼn库m䩏hm烐䶽䟏嚶t
- C:\users\public\desktop\tز‼损g䔶dమ㜰滳䵢
- C:\users\public\desktop\✌嶒䑖戜㹹帋
- C:\users\public\desktop\ln綹朊㏙`攮q嗢ᴅ
- C:\users\public\desktop\s矶r判sⲥ
- C:\users\public\desktop\傹mw磊啊c紌kj
- C:\users\public\desktop\h匤睠櫖gmmhs↪渖l
- C:\users\public\desktop\ೌ婎璯gc
- C:\users\public\desktop\ydt䬈ꮱu㐽瘩㦗mc㫗
- C:\users\public\desktop\s䐪䞶`ivbj眴m≒
- C:\users\public\desktop\s䄿悾msಳa
- C:\users\public\desktop\ᣁчy྾媟g妊⹘ᐗ椂䚍
- C:\users\public\desktop\`q㧃ot`毗s㳗᳧ジ䃀
- C:\users\public\desktop\iஇuṗජvᏹal佊佸
- C:\users\public\desktop\㼦t㹶c呙yᖍ含h㗀nm暝澐
- C:\users\public\desktop\luh縀ᩝ㬜冿
- C:\users\public\desktop\`c⺶櫽g
- C:\users\public\desktop\fᵌr㔌畑淵w䓵ok
- C:\users\public\desktop\p礤c庩f
- C:\users\public\desktop\ᯨ䷙go櫙䭄簧sn
- C:\users\public\desktop\皋䵟gidks
- C:\users\public\desktop\匬v泺i珇aඳln`jp忔摝
- C:\users\public\desktop\snt瑬唚j
- C:\users\public\desktop\㽴癤sgjd絳燼ٸـvsg
- C:\users\public\desktop\䅒y瞧Ðâꮩᐩmへnϥ妬`
- C:\users\public\desktop\id劣ʏ枙kqk
- C:\users\public\desktop\vn䒱ჵ攜r捿楙b⅛eq
- C:\users\public\desktop\䙪hᑜpg`
- C:\users\public\desktop\fh穪cოqqi志礤rf嫺
- C:\users\public\desktop\g篍段₂ंlqheja墧
- C:\users\public\desktop\㠯䇬mwqgnf㏺戕jc䙃ᑡ
- C:\users\public\desktop\ᰎჰ廫alce㑍uᛤኻkt
- C:\users\public\desktop\暂ufᬯdohᩔwqw
- C:\users\public\desktop\ᚎw扈ឹ滀qt
- C:\users\public\desktop\㲉井sg惌j熑e
- C:\users\public\desktop\犔qr侄瑤j᩻樝ep`狌co
- C:\users\public\desktop\另c尢歫h偄ᾑຂe休r⒱埀
- C:\users\public\desktop\䕬玪i嬡h篩ቯഗvh
- C:\users\public\desktop\叾嶨l滍ހ杧s⎟p
- C:\users\public\desktop\wf橯〡j䙠w泹l
- C:\users\public\desktop\䳑秥ᭃ㣿uy瑗
- C:\users\public\desktop\n抆੪oal
- C:\users\public\desktop\wj䬴lh㙺b䠹䶐ⰽ
- C:\users\public\desktop\猤䗱㯇ᡭiຸ爙䔋kpkm
- C:\users\public\desktop\昧㳞xm巺h⌴k⚷t剻
- C:\users\public\desktop\yoii⋼cme
- C:\users\public\desktop\㋛d㙐⭯i溥抨職䢈j
- C:\users\public\desktop\呮涼շb䑅n
- C:\users\public\desktop\xk⣮峹n㪣tcq
- C:\users\public\desktop\nuهd䴑ࡻ寴y⽏t
- C:\users\public\desktop\lx旄㍭i
- C:\users\public\desktop\㒷ⱕh恵`咛jfk捾㟴
- C:\users\public\desktop\ni䢭愙
- C:\users\public\desktop\im㖤goy犭
- C:\users\public\desktop\爑y⡰ẃg
- C:\users\public\desktop\氌耬lo䏑⏴䤬
- C:\users\public\desktop\穐`⮆㬔x⤜y摵
- %LOCALAPPDATA%\microsoft\windows\actioncentercache\windows-systemtoast-securityandmaintenance_10_0.png
- \device\harddiskvolume1\boot\bcd.log
- \device\harddiskvolume1\boot\bcd
Sets the 'hidden' attribute to the following files
- %WINDIR%\syswow64\winnt32.exe
- C:\hello.png
- C:\hello.bat
Modifies the following files
- %ALLUSERSPROFILE%\microsoft\user account pictures\user-192.png
- %ALLUSERSPROFILE%\microsoft\user account pictures\user-32.png
- %ALLUSERSPROFILE%\microsoft\user account pictures\user-40.png
- %ALLUSERSPROFILE%\microsoft\user account pictures\user-48.png
- %ALLUSERSPROFILE%\microsoft\user account pictures\user.png
- %ALLUSERSPROFILE%\microsoft\user account pictures\user.bmp
- %APPDATA%\microsoft\windows\themes\transcodedwallpaper
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_idx.db
Miscellaneous
Searches for the following windows
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\hello.bat" "
- '%WINDIR%\syswow64\attrib.exe' +s +h C:\hello.png
- '%WINDIR%\syswow64\attrib.exe' +s +h C:\hello.bat
- '%WINDIR%\syswow64\net.exe' user user death
- '%WINDIR%\syswow64\net1.exe' user user death
- '%WINDIR%\syswow64\wbem\wmic.exe' useraccount where name='user' rename 'NO ESCAPE'
- '%WINDIR%\syswow64\takeown.exe' /f "%ALLUSERSPROFILE%\Microsoft\User Account Pictures" /r /d y
- '%WINDIR%\syswow64\xcopy.exe' *.png "%ALLUSERSPROFILE%\Microsoft\User Account Pictures\"
- '%WINDIR%\syswow64\xcopy.exe' *.bmp "%ALLUSERSPROFILE%\Microsoft\User Account Pictures\"
- '%WINDIR%\syswow64\regedit.exe' /s <SYSTEM32>\hello.reg
- '%WINDIR%\syswow64\regedit.exe' -s <SYSTEM32>\hello.reg
- '%WINDIR%\syswow64\shutdown.exe' /t 0 /r
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\hello.bat" "' (with hidden window)
Attempts to shut down the Windows operating system.
