Workbench
MSI Tree by PH3ARv0.0.1
Static Analyzer
MSI Tree flags deterministic static indicators for human review without installing or executing MSI content.
Static-onlyHuman reviewNo verdict claims
Detected signals
CustomAction entries, deferred/no-impersonate flags, suspicious command strings, embedded stream metadata, registry writes, shortcuts, URLs, domains, and IP-like indicators.
Not a sandbox
MSI Tree does not execute custom actions, run scripts, or prove a package is safe. Findings are triage evidence, not attribution.