Why can using xwizard.exe for DLL loading help bypass application whitelisting?

xwizard.exe is a Microsoft-signed binary, so it is often allowed by application whitelist controls. By exploiting the DLL search order to load a malicious `xwizards.dll` from a different folder, an attacker can execute arbitrary code while the signed process maintains trust. This method complements other white list bypass techniques like using tracker.exe to load a DLL.