The malware contains 1 function, the purpose is to open the drive of the infected system (\\.\PhysicalDrive0) and write the following data to the MBR: You can see the "Are you Happy. After writing to the MBR, the malware reboots the machine with the following command: c:\windows\system32\shutdown /r /t 1 After the reboot, the MBR displays the following string to the user: The link to the other campaigns was the following PDB path