--- Name: WFMFormat.exe Description: Command-line tool used for pretty-print a dump file generated by Message Farm Analyzer tool. Author: Tim Baker Created: 2024-12-05 Commands: - Command: WFMFormat.exe Description: Executes the file 'tracerpt.exe' in the current working directory. If the file dumpfile.txt (any content) exists in the current directory no arguments are required. Usecase: Proxy execution of binary Category: Execute Privileges: User MitreID: T1127 OperatingSystem: Windows 10 Full_Path: - Path: C:\there\is\no\default\installation\path\WFMFormat.exe Detection: - IOC: Child process from WFMFormat.exe Resources: - Link: https://www.microsoft.com/en-us/download/details.aspx?id=103244 Acknowledgement: - Person: Tim Baker (https://www.dotsec.com)