The second functionality enabled in this sample that had not been observed in previous Thanos variants involved the ability to overwrite the master boot record (MBR). Once the code checks to see if the operating system version is not “Windows 10” or “Windows 8,” the code will attempt to open “\\.\PhysicalDrive0” and write a 512-byte string to offset 0. The byte array that is written to offset 0 of “\\.\PhysicalDrive0” initially has a ransom message of “Your files are encrypted. Contact us at: get-my-data@protonmail.com…”, but the code will replace this string with the following string before writing to disk: