i need tools CShell

this is a temp bypass just open it, wait untill it inject , after that pause cf process ( figure it out yourself ) , use x64dbg to dump the files you need

tag a mod to approve it faster

virusscan link 10/62 false positive
it simply bypass hide memory and it doesn't include any crc bypass for xigncode3 as it's simply to dump files only

the exe isn't even packed and it only runs kernel api service which gives the false positive and 1 crc , if you are afraid and unsure just run it under vm and follow my instrcutions on how to unpack in my 1st reply to make sure it's working