wkspbroker.exe DLL Sideloading of radcui.dll (Xray-core)

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•9

Detects the execution of the Windows Workspaces Broker process (wkspbroker.exe) when it loads a library (DLL) from a path within the RemoteApp Gateway directory under LOCALAPPDATA. This behavior is associated with DLL side-loading techniques used to execute malicious payloads such as the Xray-core implant.