All Detections

Xwizard.EXE Execution From Non-Default Location

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 202504

Detects the execution of Xwizard tool from a non-default directory. When executed from a non-default directory, this utility can be abused in order to side load a custom version of "xwizards.dll".

Sigma