.. /WFMFormat.exe
Star

Execute (EXE, .NET Framework 3.5)

Command-line tool used for pretty-print a dump file generated by Message Farm Analyzer tool.

Paths:

C:\there\is\no\default\installation\path\WFMFormat.exe

Resources:

https://www.microsoft.com/en-us/download/details.aspx?id=103244

Acknowledgements:

Tim Baker (https://www.dotsec.com)

Detections:

IOC: Child process from WFMFormat.exe
IOC: tracerpt.exe processes located anywhere other than c:\windows\system32

Execute

Executes the file tracerpt.exe in the same folder as WFMFormat.exe. If the file dumpfile.txt (any content) exists in the current working directory, no arguments are required. Note that WFMFormat.exe requires .NET Framework 3.5.
```
WFMFormat.exe
```
Use case
Proxy execution of binary

Privileges required
User

Operating systems
Windows 10, Windows 11

ATT&CK® technique
T1127
Tags
Execute: EXE
Requires: .NET Framework 3.5