No, the former. The file is renamed it .jar by the attacker and executed by the java runtime. The msi part is ignored - it only serves to cloak the jar from the

No, the former. The file is renamed it .jar by the attacker and executed by the java runtime. The msi part is ignored - it only serves to cloak the jar from the scanner - it recognizes the file as msi and ignores signed msi files.