ClickFix: explorer.exe spawns cmd/powershell with arguments via Run dialog

Emiliano Mema@Nosalva

•updated Jul 17, 2026•17•0•31

Detects instances of explorer.exe spawning command shells (cmd.exe or powershell.exe) with arguments. This behavior is indicative of a user launching commands directly via the Windows Run dialog or executing scripts from the shell, which can be a vector for malicious activity.