The VB.NET variant (SHA256: e5aece694d..) is very similar to other known Zebrocy variants. It then uses the storage volume obtained from the GetDriveName function and calls GetDrive to get the SerialNumber of the storage device. The VB.NET variant then gathers system information and running processes like other Zebrocy variants by running the following commands