XBootMgrSleep.exe

Execute executable via XBootMgrSleep, with a 1 second (=1000 milliseconds) delay. Alternatively, it is also possible to replace the delay with any string for immediate execution.

Use Performs execution of specified executable, can be used as a defense evasion

xbootmgrsleep.exe 1000 {PATH:.exe}

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Execute

MITRE

T1202

Refs

learn.microsoft.com/en-us/previous-versions/windows/desktop/xperf/reference

lolbas-project.github.io/lolbas/OtherMSBinaries/XBootMgrSleep/