Windows Performance Toolkit binary used to start performance traces. Located at: C:\Program Files\Windows Kits\10\Windows Performance Toolkit\xbootmgr.exe; C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\xbootmgr.exe.
xbootmgrxbootmgrSandbox: execFile · Timeout: 30s
security.execution.command Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Executes an executable after the trace is complete using the callBack parameter. (Executes code as part of post-trace automation flow.)
xbootmgr.exe -trace "{boot|hibernate|standby|shutdown|rebootCycle}" -callBack {PATH:.exe}Executes an executable before each trace run using the preTraceCmd parameter. (Executes code as part of pre-trace automation or staging.)
xbootmgr.exe -trace "{boot|hibernate|standby|shutdown|rebootCycle}" -preTraceCmd {PATH:.exe}xbootmgr is a Windows LOLBin. Windows Performance Toolkit binary used to start performance traces. Located at: C:\Program Files\Windows Kits\10\Windows Performance Toolkit\xbootmgr.exe; C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\xbootmgr.exe.