Set up permissions for executable in shared folder so that domain users can run it, but not able to delete or copy it?

I have an executable, app.exe that lives in a shared folder on a server \serverfolderapp.exe.

Everyone (that is domain users) should have access to this .exe in the sense that everyone should be able to run the app. However I’d like to prevent domain users from deleting the .exe, copying the .exe and pasting elsewhere, replacing the .exe, etc.

There is another file in the mix, \serverfoldersubfolderappDependencies.txt that app.exe writes to. So the permissions should still allow the user to write to this file when running the app.

Is this doable?