Command-line tool used for pretty-print a dump file generated by Message Farm Analyzer tool. Located at: C:\there\is\no\default\installation\path\WFMFormat.exe.
wfmformatwfmformatSandbox: execFile · Timeout: 30s
security.execution.command Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Executes the file `tracerpt.exe` in the same folder as `WFMFormat.exe`. If the file `dumpfile.txt` (any content) exists in the current working directory, no arguments are required. Note that `WFMFormat.exe` requires .NET Framework 3.5. (Proxy execution of binary)
WFMFormat.exe| Type | Rule / Indicator |
|---|---|
| ioc | Child process from WFMFormat.exe |
| ioc | tracerpt.exe processes located anywhere other than c:\windows\system32 |
wfmformat is a Windows LOLBin. Command-line tool used for pretty-print a dump file generated by Message Farm Analyzer tool. Located at: C:\there\is\no\default\installation\path\WFMFormat.exe.