LegionLoader xupdate.bat Execution from Traiolx Custom Utils via msiexec

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects execution of cmd.exe or other binaries spawned by msiexec.exe involving the LegionLoader staging directory 'AppData\Roaming\Traiolx Custom Utils' and the 'xupdate.bat' script, which is characteristic of LegionLoader's post-installation activity.