Windows Performance Toolkit binary used for tracing and analyzing system performance during sleep and resume transitions. Located at: C:\Program Files\Windows Kits\10\Windows Performance Toolkit\xbootmgrsleep.exe; C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\xbootmgrsleep.exe.
xbootmgrsleepxbootmgrsleepSandbox: execFile · Timeout: 30s
security.execution.command Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Execute executable via XBootMgrSleep, with a 1 second (=1000 milliseconds) delay. Alternatively, it is also possible to replace the delay with any string for immediate execution. (Performs execution of specified executable, can be used as a defense evasion)
xbootmgrsleep.exe 1000 {PATH:.exe}xbootmgrsleep is a Windows LOLBin. Windows Performance Toolkit binary used for tracing and analyzing system performance during sleep and resume transitions. Located at: C:\Program Files\Windows Kits\10\Windows Performance Toolkit\xbootmgrsleep.exe; C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\xbootmgrsleep.exe.