Right, I think the code itself is fine. Just some peculiarities about the installer are triggering suspicion.
- Why is msiexec.exe started in 'C:\Users\admin\Downloads\msiexec.exe'?
- Why are files written to 'C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll' and 'C:\Windows\System32\Tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector'?
- Why is the registry key 'HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\A70D59A1-8EAD-4F40-AAAB-FBFC460800A4\FriendlyName' set to 'WORK:admin'?
In any case, I was able to extract the .msi using
https://www.legroom.net/software/uniextract#download (7zip would not work) and THAT all tests fine, nothing suspicious. Runs fine, too. It does cause a Windows Firewall message to popup, asking for access to your network/domain. Can un-check and click Cancel.