XBootMgrSleep.exe

Windows Performance Toolkit binary used for tracing and analyzing system performance during sleep and resume transitions.

Paths

  • C:\Program Files\Windows Kits\10\Windows Performance Toolkit\xbootmgrsleep.exe
  • C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\xbootmgrsleep.exe

Commands

Execute

Execute executable via XBootMgrSleep, with a 1 second (=1000 milliseconds) delay. Alternatively, it is also possible to replace the delay with any string for immediate execution.

Use case: Performs execution of specified executable, can be used as a defense evasion

Privileges: User

xbootmgrsleep.exe 1000 {PATH:.exe}

Resources