MSI custom action CA_Run_EA2AEBC3 loads embedded lib.dll via msiexec.exe

Emiliano Mema@Nosalva

•updated Aug 20, 2026•1•0•2

Detects execution of msiexec.exe involving specific command-line arguments (CA_Run_EA2AEBC3, Bin_lib_EA2AEBC3) often associated with malicious installers or library side-loading, correlated with the loading of 'lib.dll' by the msiexec process.