[mothered]

When my VM box Is up and running, It'll give It a shot.

You don't need vm for this one, is a shortcut (filename.lnk) that will execute bitsadmin. If you scan the object, because it is a shortcut, it will scan cmd.exe. Bitsadmin will connect to a site of your choice and download/execute the file.

There is a combination of search-ms and link drop that i want to test, may turn out to be a code execution requiring user interaction.

Understood.

Thanks for clarifying It.