Investigate MSI files - reuteras/dfirws GitHub Wiki Intezer has a good blog post about How to Analyze Malicious MSI Installer Files.