---
Name: Xwizard.exe
Description: DLL hijack, Execute
Author: ''
Created: '2018-05-25'
Categories: []
Commands:
  - Command: xwizard.exe
    Description: Xwizard.exe will load a .DLL file located in the same directory (DLL Hijack) named xwizards.dll.
  - Command: xwizard RunWizard {00000001-0000-0000-0000-0000FEEDACDC}
    Description: Xwizard.exe running a custom class that has been added to the registry.
Full Path:
  - c:\windows\system32\xwizard.exe
  - c:\windows\sysWOW32\xwizard.exe
Code Sample: []
Detection: []
Resources:
  - http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/
  - https://www.youtube.com/watch?v=LwDHX7DVHWU
  - https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5
Notes: Thanks to Adam - @Hexacorn, Nick Tyrer - @nicktyrer