Xray-core DLL Sideload via wkspbroker.exe (radcui.dll) from AppData

Ibrahim Saud@tektrix

•updated Sep 21, 2026•1•0•3

Detects the loading of wkspbroker.exe or radcui.dll modules from the Microsoft RemoteApp Gateway directory located within the user's AppData path. This behavior may indicate an attempt to utilize or manipulate Remote Desktop components from a non-standard or user-writable location.