Windows Installer, Exploiting Custom Actions| blog.doyensec.com
Published on| offsec.almond.consulting