dfsvc.exe
Summary
Windows ClickOnce Application Deployment Service - manages ClickOnce application installation and updates.
dfsvc.exe is the 1258th most commonly executed Windows program in EchoTrail's dataset, observed 1,138 times across enterprise environments. It typically runs from C:\Windows\Microsoft.NET\Framework64\v4.0.30319 and it is most often launched by rundll32.exe.
Behavior
Top Paths
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319100%
Top Hashes (SHA256)
- 375a75016c4feddb43c7ebfe9e78670c7c9ff0753cd8ea59e4cf601ee862465921.4%
- 7a578a56250bac85440449559af51540ecb1841154f672d66af350a4d58fa98018.83%
- 322865cb5258b0fbec1d16a03f3f4744149827c6cd2b1028d5f0a580d9d068e117.6%
- eda05116704a89aa44b1ad96390fb8d42b130eb315f36cf5edf97146ea67490614.41%
- 7cebdd2af887fac5c39c569095a5f213843c1b798299ad1f7d90ecc28fcef7307.78%
- 7c505a221bee39f83a5c0725be7b304465c969efd89b716db633ccb45a67cc077.25%
- 6e6cb0729cb902420739148ae23bf1c7959bc8ea2bf6b6277c5c0de45aa77df66.19%
- 4a7bc84fb1a676623ace38d479d05ec5f2a0afb9d264da21926e18b3148288dc2.83%
- d70fe5715cf967f9024b59b386d0a7e79ddb886a624ecb8ba3bc50faab0a30251.68%
- 584986978cede231bd748955f8a3777060fccb4b942939476891db25a37b3f3c0.53%
Process Ancestry
Top Grandparents
- explorer.exe56.66%
- svchost.exe12.42%
- iexplore.exe8.67%
- taskeng.exe7.5%
- chrome.exe3.49%
- firefox.exe0.91%
- browser_broker.exe0.26%
- OUTLOOK.EXE0.13%
- setup.exe0.13%
Top Parents
- rundll32.exe94.73%
- setup.exe0.88%
- iexplore.exe0.26%
Top Children
- notepad.exe1.03%
- DellSystemDetect.exe0.13%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about dfsvc.exe
Rocky answers questions about dfsvc.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.