e4c23b54e77b505ef0979703d6bcbca8a85da715fe6c97c7ffdf97f1c9178d0b

Analysis

max time kernel
65s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 438KB
Sample261003-vbbjyst1ev
SHA256 e4c23b54e77b505ef0979703d6bcbca8a85da715fe6c97c7ffdf97f1c9178d0b
MD5 169d59eea71aca2fda3e0ac2817a72fe
SHA1 0310b3dcd31bde0108afac9d0b341baa5799394e
SHA512 126f7911f7b78426664bb7052d6314e5f57496d2e503d5ccda42ca549e6776a4857b03038b2eb1a303a840cefe73589d0fad64b2475669b6b30ff0c1e03be687
SSDEEP 6144:4hJzQ4lWTEy43F93CFoaaVEldei7eizrgV+gLZyqkuU30iewqyFJ8++lrgVn/2xs:4HQE9BMvJc+8yt5lLP8hOy
TLSH
T188947C25A6A900F9E277D57CC9634902EB767C464320E6CF03A899A61F337D49E3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 64 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3728	netsh.exe
5432	netsh.exe
1848	netsh.exe
4264	netsh.exe
3888	netsh.exe
5940	netsh.exe
416	netsh.exe
1524	netsh.exe
5764	netsh.exe
2716	netsh.exe
3656	netsh.exe
4224	netsh.exe
1696	netsh.exe
5988	netsh.exe
4176	netsh.exe
4620	netsh.exe
1772	netsh.exe
2352	netsh.exe
4800	netsh.exe
544	netsh.exe
1080	netsh.exe
3728	netsh.exe
3356	netsh.exe
3388	netsh.exe
1968	netsh.exe
4116	netsh.exe
2480	netsh.exe
5940	netsh.exe
3344	netsh.exe
6088	netsh.exe
3364	netsh.exe
3832	netsh.exe
900	netsh.exe
2900	netsh.exe
4664	netsh.exe
2712	netsh.exe
824	netsh.exe
5344	netsh.exe
4164	netsh.exe
4076	netsh.exe
2584	netsh.exe
4924	netsh.exe
416	netsh.exe
540	netsh.exe
1336	netsh.exe
1968	netsh.exe
2872	netsh.exe
5568	netsh.exe
2016	netsh.exe
984	netsh.exe
4104	netsh.exe
2172	netsh.exe
1208	netsh.exe
2920	netsh.exe
1224	netsh.exe
2324	netsh.exe
3352	netsh.exe
4728	netsh.exe
3120	netsh.exe
5632	netsh.exe
3120	netsh.exe
1580	netsh.exe
4008	netsh.exe
2536	netsh.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
7	pastebin.com
8	pastebin.com

Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6040	cmd.exe
4848	cmd.exe
5604	cmd.exe
4252	cmd.exe
1200	cmd.exe
3340	cmd.exe
4352	cmd.exe
4272	cmd.exe
2592	cmd.exe
916	cmd.exe
260	cmd.exe
1180	cmd.exe
3244	cmd.exe
2352	cmd.exe
3744	cmd.exe
3540	cmd.exe
2460	cmd.exe
4868	cmd.exe
544	cmd.exe
1928	cmd.exe
3608	cmd.exe
624	cmd.exe
3908	cmd.exe
3092	cmd.exe
2868	cmd.exe
2484	cmd.exe
2804	cmd.exe
2644	cmd.exe
3372	cmd.exe
1608	cmd.exe
4476	cmd.exe
4480	cmd.exe
3724	cmd.exe
4520	cmd.exe
6124	cmd.exe
4768	cmd.exe
3804	cmd.exe
5184	cmd.exe
4324	cmd.exe
3800	cmd.exe
3352	cmd.exe
5284	cmd.exe
6136	cmd.exe
708	cmd.exe
5456	cmd.exe
6048	cmd.exe
2860	cmd.exe
4176	cmd.exe
4056	cmd.exe
4048	cmd.exe
2988	cmd.exe
1492	cmd.exe
4052	cmd.exe
2544	cmd.exe
5452	cmd.exe
2816	cmd.exe
904	cmd.exe
4552	cmd.exe
3240	cmd.exe
5864	cmd.exe
1168	cmd.exe
3396	cmd.exe
3236	cmd.exe
6104	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1468	cmd.exe
4736	netsh.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
988	ipconfig.exe
5880	ipconfig.exe
2464	ipconfig.exe
3532	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 4056	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	89
PID 4056 wrote to memory of 988	4056	cmd.exe	90
PID 1888 wrote to memory of 1124	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	91
PID 1124 wrote to memory of 4008	1124	cmd.exe	92
PID 1888 wrote to memory of 3492	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	93
PID 3492 wrote to memory of 3364	3492	cmd.exe	94
PID 1888 wrote to memory of 4600	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	95
PID 4600 wrote to memory of 4204	4600	cmd.exe	96
PID 1888 wrote to memory of 4352	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	97
PID 4352 wrote to memory of 4888	4352	cmd.exe	98
PID 1888 wrote to memory of 4240	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	99
PID 4240 wrote to memory of 2316	4240	cmd.exe	100
PID 1888 wrote to memory of 1600	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	101
PID 1600 wrote to memory of 2984	1600	cmd.exe	102
PID 1888 wrote to memory of 3236	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	103
PID 3236 wrote to memory of 616	3236	cmd.exe	104
PID 1888 wrote to memory of 260	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	105
PID 260 wrote to memory of 5880	260	cmd.exe	106
PID 1888 wrote to memory of 6104	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	107
PID 6104 wrote to memory of 3344	6104	cmd.exe	108
PID 1888 wrote to memory of 2460	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	109
PID 2460 wrote to memory of 416	2460	cmd.exe	110
PID 1888 wrote to memory of 4032	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	111
PID 4032 wrote to memory of 5764	4032	cmd.exe	112
PID 1888 wrote to memory of 2120	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	113
PID 2120 wrote to memory of 4924	2120	cmd.exe	114
PID 1888 wrote to memory of 5020	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	115
PID 5020 wrote to memory of 5028	5020	cmd.exe	116
PID 1888 wrote to memory of 2448	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	117
PID 2448 wrote to memory of 5240	2448	cmd.exe	118
PID 1888 wrote to memory of 5116	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	119
PID 5116 wrote to memory of 1280	5116	cmd.exe	120
PID 1888 wrote to memory of 4444	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	121
PID 4444 wrote to memory of 2464	4444	cmd.exe	122
PID 1888 wrote to memory of 2868	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	123
PID 1888 wrote to memory of 2848	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	124
PID 2868 wrote to memory of 4264	2868	cmd.exe	125
PID 2848 wrote to memory of 6132	2848	cmd.exe	126
PID 1888 wrote to memory of 2136	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	127
PID 2136 wrote to memory of 5464	2136	cmd.exe	128
PID 1888 wrote to memory of 6076	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	129
PID 6076 wrote to memory of 2172	6076	cmd.exe	130
PID 1888 wrote to memory of 6040	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	131
PID 6040 wrote to memory of 2988	6040	cmd.exe	132
PID 1888 wrote to memory of 2436	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	133
PID 2436 wrote to memory of 2720	2436	cmd.exe	134
PID 1888 wrote to memory of 4656	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	135
PID 4656 wrote to memory of 4160	4656	cmd.exe	136
PID 1888 wrote to memory of 1468	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	137
PID 1468 wrote to memory of 4736	1468	cmd.exe	138
PID 1888 wrote to memory of 4868	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	139
PID 4868 wrote to memory of 1684	4868	cmd.exe	140
PID 1888 wrote to memory of 5768	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	142
PID 1888 wrote to memory of 6136	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	141
PID 5768 wrote to memory of 2800	5768	cmd.exe	143
PID 6136 wrote to memory of 3456	6136	cmd.exe	144
PID 1888 wrote to memory of 3216	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	145
PID 3216 wrote to memory of 3272	3216	cmd.exe	146
PID 1888 wrote to memory of 200	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	147
PID 1888 wrote to memory of 1604	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	148
PID 200 wrote to memory of 3532	200	cmd.exe	149
PID 1604 wrote to memory of 3000	1604	cmd.exe	234
PID 1888 wrote to memory of 4256	1888	2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe	151
PID 4256 wrote to memory of 1292	4256	cmd.exe	152

C:\Users\Admin\AppData\Local\Temp\2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ipconfig /flushdns >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Windows\system32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    PID:4888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    PID:2316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    PID:616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ipconfig /flushdns >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:260
- - C:\Windows\system32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:5880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6104
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:5764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    PID:1280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ipconfig /flushdns >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\system32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:2464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:4264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh int tcp set global autotuninglevel=experimental >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Windows\system32\netsh.exe
    netsh int tcp set global autotuninglevel=experimental
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:6132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh int tcp set global chimney=disabled >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\system32\netsh.exe
    netsh int tcp set global chimney=disabled
    3⤵
    PID:5464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6076
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:2172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6040
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    PID:2988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh int tcp set global ecncapability=disabled >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\system32\netsh.exe
    netsh int tcp set global ecncapability=disabled
    3⤵
    PID:2720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    PID:4160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh int tcp set global timestamps=disabled >nul 2>&1
  2⤵
  - System Time Discovery
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\system32\netsh.exe
    netsh int tcp set global timestamps=disabled
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Time Discovery
    PID:4736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh int tcp set global initialRto=2000 >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\system32\netsh.exe
    netsh int tcp set global initialRto=2000
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6136
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    PID:3456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh int tcp set global rsc=disabled >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5768
- - C:\Windows\system32\netsh.exe
    netsh int tcp set global rsc=disabled
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh int ip set global taskoffload=disabled >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Windows\system32\netsh.exe
    netsh int ip set global taskoffload=disabled
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ipconfig /flushdns >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:200
- - C:\Windows\system32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:3532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    PID:3000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    PID:1292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  PID:5780
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    PID:544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:1616
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:2612
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:1780
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    PID:5756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1608
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    PID:5988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:5188
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    PID:4676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3608
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4848
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    PID:3352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4480
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:5860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:924
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:3888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:708
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    PID:4804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5452
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    PID:5320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5604
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    PID:2148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4048
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  PID:760
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:4328
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:4196
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    PID:4712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:4636
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  PID:4632
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:124
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    PID:3372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2816
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  PID:2248
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    PID:2416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:4836
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:4044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:5764
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4252
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    PID:2496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  PID:4500
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:3004
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    PID:6080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  PID:2408
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    PID:2464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  PID:2152
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:2716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:4264
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:6132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:2172
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    PID:2140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:5684
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:2900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  PID:884
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    PID:5640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:5692
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:6096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:624
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  PID:5784
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:1684
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:1580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1180
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    PID:2588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:2216
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:4664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1200
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    PID:1612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:2656
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    PID:3000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  PID:1072
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    PID:2804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:904
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:2764
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:6100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:4492
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:4116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:5660
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  PID:4772
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    PID:1980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:1408
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    PID:1740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  PID:1096
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    PID:4944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  PID:2308
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:1340
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:4780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:2272
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    PID:1372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:3400
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2484
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    PID:3988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:6128
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    PID:3736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3340
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5456
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:4800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:2316
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:2016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:2984
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    PID:5880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:616
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:3344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  PID:3220
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    - Modifies Windows Firewall
    PID:2712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:4980
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    PID:2040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  PID:5332
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3724
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4476
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:2528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:5716
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    PID:2056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:3148
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  PID:2240
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:4088
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    PID:5900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  PID:5712
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    PID:2024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4272
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    PID:3388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2988
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:3636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:6096
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:5896
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:2352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  PID:4528
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:788
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  PID:1144
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    PID:3456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  PID:3024
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    PID:3804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4552
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:4952
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:4176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2804
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    PID:2700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  PID:4284
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    PID:2020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:4592
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    PID:5220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  PID:3192
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  PID:2540
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3908
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:796
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    PID:3740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1492
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    PID:4000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  PID:5320
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    PID:1372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4052
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  PID:5608
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    PID:4020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  PID:5236
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:5828
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:2648
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:6088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3372
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  PID:2880
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:2652
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  PID:4488
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  PID:712
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:5344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:4792
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:5108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:3808
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:3120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:468
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:2480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  PID:2564
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:4120
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    PID:2376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  PID:1304
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  PID:5484
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:3388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:1528
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:5640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:3276
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    PID:984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:4904
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    PID:3520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  PID:3924
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    PID:3224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:1444
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    - Modifies Windows Firewall
    PID:4164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  PID:4568
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    PID:4664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3240
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    PID:3088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:5532
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:1380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:1656
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2592
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    PID:4016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5864
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    PID:5268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:4992
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    PID:2428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4324
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    PID:2828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  PID:1944
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    PID:3856
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:480
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:4944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:4912
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:1080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:3968
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    PID:3336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  PID:4004
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    PID:5008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3244
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    - Modifies Windows Firewall
    PID:3364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  PID:2080
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    - Modifies Windows Firewall
    PID:5940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  PID:5072
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    PID:4972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:1856
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:4172
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    PID:3508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:4628
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    PID:3728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6048
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    PID:5252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:256
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    PID:4844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  PID:3344
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    PID:4692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  PID:5616
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    PID:5488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1168
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:5936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:4820
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    PID:5840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:5348
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    PID:2496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  PID:4924
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    PID:5044
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:3568
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    PID:5108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  PID:2124
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    PID:6080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  PID:244
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:5632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:6068
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:4060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3092
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:1968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:5224
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:2872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  PID:3516
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    - Modifies Windows Firewall
    PID:4076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:2744
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    PID:4736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  PID:716
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    PID:4160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  PID:4540
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    PID:2340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2352
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:2588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:824
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:1772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:4108
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    PID:5440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  PID:4664
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    - Modifies Windows Firewall
    PID:2584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:1260
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    PID:4504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4520
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    PID:4864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  PID:4932
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    PID:4372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:1416
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:2620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:4748
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    PID:4920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:5992
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    PID:5636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  PID:5208
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    PID:4236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:4496
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    - Modifies Windows Firewall
    PID:4104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  PID:4296
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    PID:3960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  PID:4840
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    PID:2940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:5584
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:2292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:1372
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:5568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:6116
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:2920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  PID:4740
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    - Modifies Windows Firewall
    PID:5940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:4132
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    PID:4440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  PID:4620
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    PID:3356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  PID:4068
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    PID:3488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:3764
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:5212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6124
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    PID:2416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:916
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    PID:5748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  PID:2952
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    PID:416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:2040
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    PID:5432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  PID:3304
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    PID:2788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  PID:2496
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    PID:5996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:3872
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:1996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:5240
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    PID:2528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:2876
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    PID:2480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  PID:5928
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    - Modifies Windows Firewall
    PID:3832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5284
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    - Modifies Windows Firewall
    PID:3656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4768
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    PID:2144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  PID:3388
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:1932
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:4092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:4276
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    PID:3412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:3520
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    PID:3556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  PID:6036
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    PID:2244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:1772
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    PID:5652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  PID:1108
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    PID:4312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3804
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    PID:3088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:8
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:544
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    PID:5176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:2020
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    PID:2908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  PID:4028
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    PID:5636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:4192
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    PID:2320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  PID:4648
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    PID:696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  PID:4780
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    PID:3248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:4300
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:5580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:4880
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    PID:1696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:3564
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    PID:2492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2544
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    PID:1368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:5012
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    - Modifies Windows Firewall
    PID:3728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  PID:4260
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    PID:472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5184
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    PID:2392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:3496
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:3440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:3324
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    PID:4064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:1768
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    PID:5840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  PID:5728
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    PID:612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:5344
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    - Modifies Windows Firewall
    PID:1336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  PID:3308
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    PID:5632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  PID:4060
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:4224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:1596
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:1968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:4760
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    PID:1628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:6016
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    PID:2900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  PID:2608
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    PID:4092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:4548
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    - Modifies Windows Firewall
    PID:1224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2860
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    PID:5672
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  PID:2244
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    PID:5876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:5652
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:3420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:4140
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    PID:2212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:1380
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    PID:1804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  PID:108
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    - Modifies Windows Firewall
    PID:900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:1324
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    PID:5428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  PID:2580
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    PID:3972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  PID:3704
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    PID:4472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:5220
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:4104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3396
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    PID:4944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:3260
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    PID:4436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  PID:2292
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    PID:4384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:5568
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    PID:4020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  PID:2920
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    - Modifies Windows Firewall
    PID:1696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  PID:1172
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    PID:2492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:3016
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:3488
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:3728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:4248
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    PID:5564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  PID:4348
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    PID:4692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:5196
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    - Modifies Windows Firewall
    PID:416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  PID:6120
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    - Modifies Windows Firewall
    PID:5432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  PID:5044
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:1848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:2056
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:1996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:6080
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:3120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:2480
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    PID:5632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3744
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    PID:4124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:5892
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    PID:4872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  PID:1628
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    PID:1516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  PID:548
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:1580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:4736
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:3224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3800
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:4728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:2236
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    PID:5440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  PID:2584
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    PID:1680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:3532
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    PID:2488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4176
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    PID:3272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  PID:1084
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    PID:564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:4372
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    - Modifies Windows Firewall
    PID:2324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:4960
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    PID:5352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:1900
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    PID:3972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  PID:1088
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    PID:2828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1928
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    PID:992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3352
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    PID:4104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2644
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    PID:3960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3540
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:4676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:3984
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    PID:3132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block" >nul 2>&1
  2⤵
  PID:1792
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_UDP_Block"
    3⤵
    PID:5008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock" >nul 2>&1
  2⤵
  PID:4888
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_RIOTCLIENT_BanBlock"
    3⤵
    PID:4440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock" >nul 2>&1
  2⤵
  PID:5788
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_BanBlock"
    3⤵
    - Modifies Windows Firewall
    PID:1524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock" >nul 2>&1
  2⤵
  PID:3604
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_BanBlock"
    3⤵
    PID:1368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block" >nul 2>&1
  2⤵
  PID:6088
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_TCP_Block"
    3⤵
    PID:3728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block" >nul 2>&1
  2⤵
  PID:3672
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGC_UDP_Block"
    3⤵
    PID:5212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block" >nul 2>&1
  2⤵
  PID:1556
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall delete rule name="NEON_VGTRAY_TCP_Block"
    3⤵
    PID:2832