.. /WFMFormat.exe
Star

Execute (EXE, .NET Framework 3.5)

Command-line tool used for pretty-print a dump file generated by Message Farm Analyzer tool.

Paths:

C:\there\is\no\default\installation\path\WFMFormat.exe

Resources:

https://www.microsoft.com/en-us/download/details.aspx?id=103244

Acknowledgements:

Tim Baker (https://www.dotsec.com)

Detections:

IOC: Child process from WFMFormat.exe
IOC: tracerpt.exe processes located anywhere other than c:\windows\system32

Execute

Executes the file `tracerpt.exe` in the same folder as `WFMFormat.exe`. If the file `dumpfile.txt` (any content) exists in the current working directory, no arguments are required. Note that `WFMFormat.exe` requires .NET Framework 3.5.
```
WFMFormat.exe
```
Use case
Proxy execution of binary

Privileges required
User

Operating systems
Windows 10, Windows 11

ATT&CK® technique
T1127: Trusted Developer Utilities Proxy Execution
Tags
Execute: EXE
Requires: .NET Framework 3.5