# 1 kill zombies: stuck u115 chain / old pollers / old keeper / old pstun / stale curl
$victims = Get-CimInstance Win32_Process | Where-Object {
  $n=$_.Name; $cl=[string]$_.CommandLine
  if(($n -eq 'net.exe') -or ($n -eq 'net1.exe')){ return $true }
  if(($n -eq 'powershell.exe') -or ($n -eq 'cmd.exe') -or ($n -eq 'curl.exe')){
    if(($cl -match 'u115') -or ($cl -match 'upoll\.ps1') -or ($cl -match 'svc_poll2\.ps1') -or ($cl -match 'keeper\.ps1') -or ($cl -match 'PStun4')){ return $true }
  }
  return $false
}