TRUSTRAP loader spawns cmd.exe after browser-downloaded payload execution

Ibrahim Saud@tektrix

•updated Jul 2, 2026•1•0•4

Detects instances where a web browser process (e.g., chrome.exe, msedge.exe) initiates a cmd.exe process with a command-line argument containing '/c'. This behavior often indicates a drive-by download or a malicious script execution triggered via a browser exploit or phishing activity.