LOL · OtherMSBinary

XBootMgr.exe

2 techniques WindowsLOLBAS GPL-3.0

Execute

Execution Windows

Executes an executable after the trace is complete using the callBack parameter.

Use Executes code as part of post-trace automation flow.

xbootmgr.exe -trace "{boot|hibernate|standby|shutdown|rebootCycle}" -callBack {PATH:.exe}

Context: admin
Native: Execute
MITRE: T1202
Refs: learn.microsoft.com/en-us/previous-versions/windows/desktop/xperf/reference
lolbas-project.github.io/lolbas/OtherMSBinaries/XBootMgr/

Execution Windows

Executes an executable before each trace run using the preTraceCmd parameter.

Use Executes code as part of pre-trace automation or staging.

xbootmgr.exe -trace "{boot|hibernate|standby|shutdown|rebootCycle}" -preTraceCmd {PATH:.exe}

Context: admin
Native: Execute
MITRE: T1202
Refs: learn.microsoft.com/en-us/previous-versions/windows/desktop/xperf/reference
lolbas-project.github.io/lolbas/OtherMSBinaries/XBootMgr/