dfsvc.exe

  • File Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe
  • Description: ClickOnce
  • Comments: Flavor=Retail

Hashes

Type Hash
MD5 B4088F44B80D363902E11F897A7BAC09
SHA1 34698AFDD3E84E7A7555A743EAA9F6971B970D5C
SHA256 375A75016C4FEDDB43C7EBFE9E78670C7C9FF0753CD8EA59E4CF601EE8624659
SHA384 8A95125AB19144C613C5FB10908948BD903FC375979E904CA8613CFE6B267F748779A460DA7E65E9046FF0E35F225730
SHA512 EC34C12B701C37E5FAA911BCD1797F2BED2C5E5D1CA3D5480F5D357688565216C45701C081C870D4EDECC56E40A5C934AA4F14AB0A8CDF6C945452B7D30C24CC
SSDEEP 384:sNlZPZmW5X16WTFZs2QpBj0HRN7YQHRN7/4lrK9e:svNHX1XU2qWY8M
IMP F34D5F2D4577ED6D9CEEC516C1F5A744
PESHA1 CC60CE5B49B5B1F846DF5EA20DC85F81041B0994
PE256 2AC6AA9BC6FDD7EC2E578A0AB18D665201F6F5527E890D0301F69D67931673AE

Runtime Data

Open Handles:

Path Type
(R-D) C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll File
(R-D) C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll File
(R-D) C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll File
(R-D) C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll File
(R-D) C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll File
(RW-) C:\Users\user File
...\Cor_SxSPublic_IPCBlock Section
\BaseNamedObjects__ComCatalogCache__ Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2 Section
\BaseNamedObjects\Cor_Private_IPCBlock_v4_2932 Section
\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section

Loaded Modules:

Path
C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe
C:\Windows\System32\ADVAPI32.dll
C:\Windows\System32\KERNEL32.dll
C:\Windows\System32\KERNELBASE.dll
C:\Windows\SYSTEM32\MSCOREE.DLL
C:\Windows\System32\msvcrt.dll
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\RPCRT4.dll
C:\Windows\System32\sechost.dll

Signature

  • Status: Signature verified.
  • Serial: 330000023241FB59996DCC4DFF000000000232
  • Thumbprint: FF82BC38E1DA5E596DF374C53E3617F7EDA36B06
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: dfsvc.exe
  • Product Name: Microsoft .NET Framework
  • Company Name: Microsoft Corporation
  • File Version: 4.8.4084.0 built by: NET48REL1
  • Product Version: 4.8.4084.0
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/76
  • VirusTotal Link: https://www.virustotal.com/gui/file/375a75016c4feddb43c7ebfe9e78670c7c9ff0753cd8ea59e4cf601ee8624659/detection

File Similarity (ssdeep match)

File Score
C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\1033\flogvwrc.dll 46
C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\1033\gacutlrc.dll 33
C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\1033\IlDasmrc.dll 36
C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\1033\pevrfyrc.dll 50
C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\1033\snrc.dll 36
C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\1033\TrackerUI.dll 41
C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\x64\1033\flogvwrc.dll 47
C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\x64\1033\gacutlrc.dll 29
C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\x64\1033\IlDasmrc.dll 40
C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\x64\1033\pevrfyrc.dll 47
C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\x64\1033\snrc.dll 36
C:\Program Files (x86)\Microsoft SDKs\Windows\v10.0A\bin\NETFX 4.8 Tools\x64\1033\TrackerUI.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Accessibility.dll 57
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\CustomMarshalers.dll 29
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\Microsoft.Win32.Primitives.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.AppContext.dll 43
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Collections.Concurrent.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Collections.dll 41
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Collections.NonGeneric.dll 49
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Collections.Specialized.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.ComponentModel.Annotations.dll 41
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.ComponentModel.dll 49
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.ComponentModel.EventBasedAsync.dll 50
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.ComponentModel.Primitives.dll 49
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.ComponentModel.TypeConverter.dll 41
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Console.dll 52
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Data.Common.dll 49
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Diagnostics.Contracts.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Diagnostics.Debug.dll 43
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Diagnostics.FileVersionInfo.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Diagnostics.Process.dll 49
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Diagnostics.StackTrace.dll 49
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Diagnostics.TextWriterTraceListener.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Diagnostics.Tools.dll 54
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Diagnostics.TraceSource.dll 49
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Drawing.Primitives.dll 52
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Dynamic.Runtime.dll 43
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Globalization.Calendars.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Globalization.dll 41
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Globalization.Extensions.dll 60
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.IO.Compression.ZipFile.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.IO.dll 49
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.IO.FileSystem.dll 49
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.IO.FileSystem.DriveInfo.dll 55
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.IO.FileSystem.Primitives.dll 50
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.IO.FileSystem.Watcher.dll 49
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.IO.IsolatedStorage.dll 66
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.IO.MemoryMappedFiles.dll 49
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.IO.Pipes.dll 52
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.IO.UnmanagedMemoryStream.dll 49
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Linq.dll 69
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Linq.Expressions.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Linq.Parallel.dll 55
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Linq.Queryable.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Net.Http.Rtc.dll 50
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Net.NameResolution.dll 54
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Net.NetworkInformation.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Net.Ping.dll 52
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Net.Primitives.dll 49
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Net.Requests.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Net.Security.dll 50
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Net.Sockets.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Net.WebHeaderCollection.dll 49
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Net.WebSockets.Client.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Net.WebSockets.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.ObjectModel.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Reflection.dll 55
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Reflection.Emit.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Reflection.Emit.ILGeneration.dll 43
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Reflection.Emit.Lightweight.dll 49
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Reflection.Extensions.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Reflection.Primitives.dll 52
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Resources.Reader.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Resources.ResourceManager.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Resources.Writer.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Runtime.CompilerServices.VisualC.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Runtime.dll 50
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Runtime.Extensions.dll 49
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Runtime.Handles.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Runtime.InteropServices.dll 49
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Runtime.InteropServices.RuntimeInformation.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Runtime.InteropServices.WindowsRuntime.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Runtime.Numerics.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Runtime.Serialization.Formatters.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Runtime.Serialization.Json.dll 49
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Runtime.Serialization.Primitives.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Runtime.Serialization.Xml.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Security.Claims.dll 43
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Security.Cryptography.Algorithms.dll 49
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Security.Cryptography.Csp.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Security.Cryptography.Encoding.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Security.Cryptography.Primitives.dll 43
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Security.Cryptography.X509Certificates.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Security.Principal.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Security.SecureString.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.ServiceModel.Duplex.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.ServiceModel.Http.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.ServiceModel.NetTcp.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.ServiceModel.Primitives.dll 50
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.ServiceModel.Security.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Text.Encoding.dll 50
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Text.Encoding.Extensions.dll 49
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Text.RegularExpressions.dll 49
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Threading.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Threading.Overlapped.dll 60
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Threading.Tasks.dll 54
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Threading.Tasks.Parallel.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Threading.Thread.dll 49
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Threading.ThreadPool.dll 58
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Threading.Timer.dll 50
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.ValueTuple.dll 43
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Xml.ReaderWriter.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Xml.XDocument.dll 50
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Xml.XmlDocument.dll 52
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Xml.XmlSerializer.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Xml.XPath.dll 43
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Facades\System.Xml.XPath.XDocument.dll 52
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\ISymWrapper.dll 32
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\Microsoft.Activities.Build.dll 41
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\sysglobl.dll 38
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Activities.DurableInstancing.dll 32
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.AddIn.Contract.dll 41
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.ComponentModel.Composition.Registration.dll 38
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Data.DataSetExtensions.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Data.Services.Design.dll 41
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Diagnostics.Tracing.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.IO.Compression.dll 41
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.IO.Compression.FileSystem.dll 54
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Management.Instrumentation.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Net.Http.WebRequest.dll 49
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Numerics.dll 30
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Reflection.Context.dll 49
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Transactions.dll 29
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Web.Abstractions.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Web.RegularExpressions.dll 47
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Web.Routing.dll 46
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Windows.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Windows.Input.Manipulations.dll 50
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Windows.Presentation.dll 52
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\System.Xml.Serialization.dll 61
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\UIAutomationClientsideProviders.dll 43
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\UIAutomationProvider.dll 44
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework.NETFramework\v4.8\XamlBuildTask.dll 32
C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe 61
C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe 32
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe 40
C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe 61
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe 100
C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe 32
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe 40
C:\Windows\system32\aspnet_counters.dll 41
C:\Windows\system32\msvcr100_clr0400.dll 50
C:\Windows\SysWOW64\aspnet_counters.dll 43
C:\Windows\SysWOW64\msvcr100_clr0400.dll 47

Possible Misuse

The following table contains possible examples of dfsvc.exe being misused. While dfsvc.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
LOLBAS Dfsvc.yml Name: Dfsvc.exe  
LOLBAS Dfsvc.yml Description: Executes click-once-application from Url (trampoline for Dfsvc.exe, DotNet ClickOnce host)  
LOLBAS Dfsvc.yml - Path: C:\Windows\Microsoft.NET\Framework\v2.0.50727\Dfsvc.exe  
LOLBAS Dfsvc.yml - Path: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Dfsvc.exe  
LOLBAS Dfsvc.yml - Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\Dfsvc.exe  
LOLBAS Dfsvc.yml - Path: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Dfsvc.exe  
LOLBAS Dfsvc.yml - Link: https://stackoverflow.com/questions/13312273/clickonce-runtime-dfsvc-exe  
LOLBAS Dfshim.yml Description: Executes click-once-application from Url (trampoline for Dfsvc.exe, DotNet ClickOnce host)  
LOLBAS Dfshim.yml - Path: C:\Windows\Microsoft.NET\Framework\v2.0.50727\Dfsvc.exe  
LOLBAS Dfshim.yml - Path: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Dfsvc.exe  
LOLBAS Dfshim.yml - Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\Dfsvc.exe  
LOLBAS Dfshim.yml - Path: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Dfsvc.exe  
LOLBAS Dfshim.yml - Link: https://stackoverflow.com/questions/13312273/clickonce-runtime-dfsvc-exe  

MIT License. Copyright (c) 2020-2021 Strontic.