TrendLabs: SettingContent-ms can be Abused to Drop Complex DeepLink and Icon-based Payload

Figure 3. Malicious Commandline via DeepLink tag

REF: https://blog.trendmicro.com/trendlabs-security-intelligence/settingcontent-ms-can-be-abused-to-drop-complex-deeplink-and-icon-based-payload/