Shell.Application.ShellExecute COM pivot

Some PDF readers prompt the user before honouring a /Launch action. Attackers sidestep that prompt by having a JScript stub (typically loaded via mshta as a `javascript:` URL) instantiate the Shell.Application COM object and call ShellExecute to spawn the next-stage process — the reader's /Launch warning may not fire because the spawn happens inside the mshta host, not inside the PDF reader.