WFMFormat.exe

type: OtherMSBinaries

Command-line tool used for pretty-print a dump file generated by Message Farm Analyzer tool.

Full path

C:\there\is\no\default\installation\path\WFMFormat.exe

Commands

ExecuteUser T1127
Proxy execution of binary
```
WFMFormat.exe
```
Executes the file tracerpt.exe in the same folder as WFMFormat.exe. If the file dumpfile.txt (any content) exists in the current working directory, no arguments are required. Note that WFMFormat.exe requires .NET Framework 3.5.
os: Windows 10, Windows 11
Execute: EXERequires: .NET Framework 3.5

Detection

IOCChild process from WFMFormat.exe
IOCtracerpt.exe processes located anywhere other than c:\windows\system32

Resources

https://www.microsoft.com/en-us/download/details.aspx?id=103244

acknowledgement: Tim Baker (https://www.dotsec.com)