LegionLoader msiexec.exe Spawning cmd.exe Executing xupdate.bat from AppData\Roaming

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•5

Detects instances where the Windows Installer (msiexec.exe) spawns a command prompt (cmd.exe) to execute specific batch files or custom scripts, which is a technique often used for malicious proxy execution.