{"id":"06978194-e608-2fd7-83e3-429282e756d1","cmdid":"20260428-214612","targets":["DESKTOP-E242BTP"],"created_at":"2026-04-28T21:44:31+08:00","commands":["RUN EXEC mshta vbscript:CreateObject(\"WScript.Shell\").Run(\"powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command \"\"Add-Type -AssemblyName System.Windows.Forms; $ws = New-Object -ComObject WScript.Shell; if($ws.AppActivate('京麦')){ Start-Sleep -m 500; [System.Windows.Forms.SendKeys]::SendWait('你好'); $ws.SendKeys('{ENTER}') }\"\"\",0)(window.close)"],"token":"","hmac":"","meta":{"ip":"120.235.228.54","ua":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36"},"raw":"CMDID: 20260428-214612\nTARGET: DESKTOP-E242BTP\n\nRUN EXEC mshta vbscript:CreateObject(\"WScript.Shell\").Run(\"powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command \"\"Add-Type -AssemblyName System.Windows.Forms; $ws = New-Object -ComObject WScript.Shell; if($ws.AppActivate('京麦')){ Start-Sleep -m 500; [System.Windows.Forms.SendKeys]::SendWait('你好'); $ws.SendKeys('{ENTER}') }\"\"\",0)(window.close)\n"}