The whole exploit is based on the user clicking on a .lnk shortcut, which then executes commands found in the subtitle text file.

Which seems strangely over complicated. How does it really help to involve the subtitles file at all?