XBootMgrSleep.exe

type: OtherMSBinaries

Windows Performance Toolkit binary used for tracing and analyzing system performance during sleep and resume transitions.

Full path

C:\Program Files\Windows Kits\10\Windows Performance Toolkit\xbootmgrsleep.exe
C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\xbootmgrsleep.exe

Commands

ExecuteUser T1202
Performs execution of specified executable, can be used as a defense evasion
```
xbootmgrsleep.exe 1000 {PATH:.exe}
```
Execute executable via XBootMgrSleep, with a 1 second (=1000 milliseconds) delay. Alternatively, it is also possible to replace the delay with any string for immediate execution.
os: Windows
Execute: EXE

Resources

https://learn.microsoft.com/en-us/previous-versions/windows/desktop/xperf/reference

acknowledgement: Avihay Eldad @AvihayEldad, Yuval Saban @yuvalsaban3