killall — Windows 11 Intelligent Process Termination Tool
A modern, safe, Windows-native equivalent of UNIX killall with three-tier safety protection, process tree awareness, and specialized subcommands for GPU, network, hung apps, LLM, and game processes.
- Windows 10 1809+ / Windows 11
- .NET 8 SDK (for building from source)
git clone <repo-url>
cd killall
dotnet publish -c Release -r win-x64 --self-contained true
The output binary is at bin\Release\net8.0-windows\win-x64\publish\killall.exe (34 MB self-contained, no runtime dependency).
Copy killall.exe to a directory on your PATH, or add the publish directory:
# Option 1: Copy to a bin directory
copy bin\Release\net8.0-windows\win-x64\publish\killall.exe C:\Tools\killall.exe
# Option 2: Add to user PATH
[Environment]::SetEnvironmentVariable("Path", $env:Path + ";C:\Tools", "User")
# Kill all instances of Notepad
killall notepad
# Kill Chrome and its entire process tree
killall chrome --tree
# Kill all hung/frozen applications
killall hung
# Kill processes using more than 2 GB RAM
killall ramhog 2048
# Kill top 3 CPU hogs above 90%
killall cpuhog 90 --top 3
# Preview what would be killed (dry run)
killall game --dry-run
killall <pattern> [options]
killall <subcommand> [options]
Pattern
Mode
Example
| notepad |
Exact |
Matches notepad (case-insensitive) |
| note |
Partial |
Falls back to substring if no exact match |
| note* |
Glob |
Wildcard matching |
| /fire.*fox/ |
Regex |
Full regex enclosed in slashes |
Flag
Short
Description
| --tree |
-t |
Kill entire process tree (children first) |
| --force |
-f |
Skip confirmation prompt |
| --dry-run |
-n |
Show what would be killed |
| --help |
-h |
Show help |
These flags can be used standalone or combined with a name pattern and all global options (--tree, --force, --dry-run). All filters respect the three-tier safety model.
Flag
Description
| --cmdline <pattern> |
Kill processes whose command line matches a substring or /regex/ |
| --module <dllname> |
Kill processes that have loaded the specified DLL |
| --port <N> or <N-M> |
Kill processes owning the given TCP/UDP port or range |
| --window <title> |
Kill processes owning a window matching title substring or /regex/ |
| --parent <pid or name> |
Kill all direct children of the specified parent |
# Kill any process launched with "--model" in its arguments
killall --cmdline "--model"
# Kill Python http.server instances (regex match)
killall --cmdline "/http\.server/"
# Kill all processes that loaded Direct3D 12
killall --module d3d12.dll
# Kill processes using CUDA via PyTorch
killall --module torch_cuda.dll
# Kill whatever is listening on port 8080
killall --port 8080
# Kill all processes bound to ports 5000–6000
killall --port 5000-6000
# Kill windows with "Crash Reporter" in the title
killall --window "Crash Reporter"
# Kill Chrome Incognito windows (regex)
killall --window "/Chrome.*Incognito/"
# Kill all child processes of explorer.exe
killall --parent explorer
# Kill children of PID 1234 and their entire subtrees
killall --parent 1234 --tree
# Combine: kill processes named "node" that are children of PID 5678
killall node --parent 5678
Command
Description
| killall restart <name> |
Kill and restart a process |
| killall gpu [--threshold N] |
Kill GPU-consuming processes (default >1%) |
| killall networkapps |
Kill processes with active network connections |
| killall hung |
Kill all "Not Responding" applications |
| killall ramhog <MB> |
Kill processes exceeding N MB RAM |
| killall cpuhog <pct> |
Kill processes exceeding N% CPU |
| killall llm |
Kill all local LLM/AI inference processes |
| killall game |
Kill all game processes and launchers |
Option
Applies to
Description
| --threshold N |
gpu |
Minimum GPU utilization % (default 1) |
| --top N |
ramhog, cpuhog |
Kill only top N offenders |
| --sample N |
cpuhog |
CPU sampling interval in seconds (default 1) |
killall implements a strict three-tier protection system to prevent system crashes.
Tier 1 — IMMORTAL (Hard Block)
Never terminated under any circumstances. Attempting to kill these processes will be silently skipped with a log message.
Includes: System, csrss, lsass, winlogon, svchost, dwm, smss, wininit, services, fontdrvhost, MsMpEng, Registry, conhost, SecurityHealthService, and others.
Killing these would cause an immediate BSOD or system crash.
Tier 2 — AUTO-RESTART (Watchdog)
Terminated, then immediately restarted. These are essential Windows 11 UI processes.
Includes: explorer, ShellExperienceHost, StartMenuExperienceHost, SearchHost, RuntimeBroker, Taskmgr, ApplicationFrameHost, Widgets.
explorer.exe has special retry logic — up to 3 restart attempts with 2-second intervals and fallback instructions if all attempts fail.
Tier 3 — ALLOWED (Normal Kill)
All other processes. Killed normally with user confirmation (unless --force is used).
Advanced Filter Detection Methods
Command-Line Filter (--cmdline)
- Reads the full command line of every process via WMI Win32_Process.CommandLine.
- Supports plain substring matching (case-insensitive) or full regex when enclosed in /slashes/.
- Enumerates loaded modules via Process.Modules for each accessible process.
- Case-insensitive match on the module file name.
- Gracefully skips IMMORTAL-tier processes and handles 32-bit/64-bit access errors.
- Reuses GetExtendedTcpTable / GetExtendedUdpTable (iphlpapi.dll P/Invoke).
- Supports single port (8080) or range (5000-6000).
- Scans both TCP and UDP, IPv4 and IPv6.
Window Title Filter (--window)
- Enumerates all top-level windows via EnumWindows (user32.dll).
- Reads window titles via GetWindowText.
- Supports substring or /regex/ matching.
- Maps window handles to owning PIDs via GetWindowThreadProcessId.
- Accepts a numeric PID or a process name.
- If a name is given, resolves it to PID(s) first.
- Uses WMI Win32_Process.ParentProcessId to find all direct children.
- Combines naturally with --tree to kill entire subtrees.
- Primary: WMI GPU Engine performance counters (Win32_PerfFormattedData_GPUPerformanceCounters_GPUEngine). Parses PID from counter instance names and sums utilization across all GPU engines.
- Fallback: Loaded module detection — identifies processes that loaded GPU-related DLLs (d3d11.dll, d3d12.dll, vulkan-1.dll, nvcuda.dll, etc.).
- Supports NVIDIA, AMD, and Intel GPUs.
Network Connection Detection
- P/Invoke to iphlpapi.dll using GetExtendedTcpTable and GetExtendedUdpTable.
- Enumerates all TCP connections (ESTABLISHED state) and UDP endpoints with owning PIDs.
- Supports IPv4 and IPv6.
Hung Application Detection
- IsHungAppWindow (user32.dll) for visible windows.
- SendMessageTimeout with SMTO_ABORTIFHUNG flag as secondary detection.
- Process.Responding property as a tertiary check.
- Scans all visible windows via EnumWindows.
- Matches against 30+ known LLM process names (Ollama, llama.cpp, LM Studio, KoboldCpp, vLLM, ComfyUI, etc.).
- Scans command lines for patterns like .gguf, transformers, torch.cuda, --model, --load-in-4bit.
- Detects Python processes running LLM workloads.
- Known game launchers: Steam, Epic, Battle.net, GOG Galaxy, Ubisoft Connect, EA Desktop, Riot.
- Executable path heuristics: processes running from steamapps, Epic Games, GOG Games, etc.
- Module detection: processes loading UnityPlayer.dll, steam_api64.dll, XInput, dinput8.dll, etc.
- Requires 2+ game-related modules for module-based detection to reduce false positives.
- Two-sample measurement using Process.TotalProcessorTime.
- Configurable sampling interval (default 1 second).
- Normalizes across all logical CPU cores.
Process Tree Kill (--tree)
When --tree is specified:
- A complete parent-child process map is built via WMI Win32_Process.
- All descendants of each matched process are recursively collected using BFS.
- Processes are killed bottom-up (children before parents).
- Tier 1 processes in the tree are skipped. Tier 2 processes are killed and restarted.
Code
Meaning
| 0 |
All operations succeeded |
| 1 |
Partial failure (some denied) |
| 2 |
All operations failed/refused |
| 3 |
No matching processes found |
killall works without elevation for user-owned processes. For full functionality (killing services, system-level processes), run from an elevated terminal. A warning is shown when running without Administrator privileges.
Single-file C# 12 / .NET 8 console application. No external dependencies beyond System.Management (WMI).
Component
Role
| SafetyService |
Three-tier classification and restart logic |
| ProcessTreeService |
WMI-based process tree builder |
| PatternMatcher |
Multi-mode process name matching |
| KillCommand |
Core kill engine with safety evaluation |
| NativeMethods |
P/Invoke declarations (user32, iphlpapi) |
| 8 subcommand classes |
Specialized detection and kill logic |
| 5 advanced filters |
CmdLineFilter, ModuleFilter, PortFilter, WindowFilter, ParentFilter |
MIT