How was the payload executed? I've been thinking of trying to write malware test cases using HID specs, but the article doesn't go into much detail.