https://dmpdump.github.io/posts/Possible-Ocean-LotusInstaller-Abusing-MST-Transforms/
Possible APT32/Ocean Lotus Installer abusing MST Transforms - dmpdump