Last but not least, the malware creates an id, in the same way as seen in previous Zebrocy binaries. It retrieves the UserName via the GetUserNameW Windows API and prepends the volume serial number of the C:\ drive