LegionLoader: msiexec.exe Spawns cmd.exe to Execute xupdate.bat

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•1

Detects the Windows Installer service (msiexec.exe) spawning the command shell (cmd.exe) to execute specific scripts or commands (xupdate.bat or Traiolx). This pattern is often associated with software installers or malicious activity attempting to run commands via child processes spawned by system-level installers.