New Abuse of the ClickOnce Technology, Part 1: The Inner Workings of ClickOnce Application Deployment

This report analyzes the internals of ClickOnce deployments, explaining how rundll32.exe calls dfshim.dll which locates and loads dfdll.dll (via GetRequestedRuntimeInfo), how dfdll!ActivateDeploymentW invokes InvokeServer/BindToServer to initialize the COM server (using CoCreateInstance with a specific CLSID) and may launch dfsvc.exe, and why dfshim.dll acts as an intermediate between System32 and .NET runtime libraries; the focus is on normal deployment mechanics rather than malicious activity.