LOLBAS. GitHub
LIVING OFF THE LAND / OTHER MICROSOFT BINARIES

WFMFormat.exe

View source

Command-line tool used for pretty-print a dump file generated by Message Farm Analyzer tool.

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
00DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1127

Executes the file `tracerpt.exe` in the same folder as `WFMFormat.exe`. If the file `dumpfile.txt` (any content) exists in the current working directory, no arguments are required. Note that `WFMFormat.exe` requires .NET Framework 3.5.

COMMAND
WFMFormat.exe
USE CASE
Proxy execution of binary
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · EXERequires · .NET Framework 3.5
02 / ON DISK

Known paths

C:\there\is\no\default\installation\path\WFMFormat.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

0 resources

Indicators & detection notes

  • IOC

    Child process from WFMFormat.exe

  • IOC

    tracerpt.exe processes located anywhere other than c:\windows\system32

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Tim Baker (https://www.dotsec.com)