XBootMgr.exe

Executes an executable after the trace is complete using the callBack parameter.

Use Executes code as part of post-trace automation flow.

xbootmgr.exe -trace "{boot|hibernate|standby|shutdown|rebootCycle}" -callBack {PATH:.exe}

Evidence

Upstream reference

Environment

Local host

Context

admin

Native

Execute

MITRE

T1202

Refs

learn.microsoft.com/en-us/previous-versions/windows/desktop/xperf/reference

lolbas-project.github.io/lolbas/OtherMSBinaries/XBootMgr/

Executes an executable before each trace run using the preTraceCmd parameter.

Use Executes code as part of pre-trace automation or staging.

xbootmgr.exe -trace "{boot|hibernate|standby|shutdown|rebootCycle}" -preTraceCmd {PATH:.exe}

Evidence

Upstream reference

Environment

Local host

Context

admin

Native

Execute

MITRE

T1202

Refs

learn.microsoft.com/en-us/previous-versions/windows/desktop/xperf/reference

lolbas-project.github.io/lolbas/OtherMSBinaries/XBootMgr/