Often involves screen_0.png or other image formats, indicating an attempt to mask the activity with a visual distraction or screen capture.
Online sandbox analysis of similar VBScript-based threats ( .vbs.bin ) reveals the following components:
If you have encountered a file similar to this, treat it with extreme caution: