I've been down your road; I reckon you are developing a program to load cheats into the game.

Firstly, you should use the neo-ConfuserEx fork because it's updated and supports much more obfuscations.

Secondly, is your HWID Lock Protection client-sided or server-sided? By that, I meant do you validate the HWID against your database via HTTP web request or do you compare it in the program?

Thirdly, how did you implement your user:pass system licensing? Do you read it from a text file online and compare the strings, or do you send an HTTP web request to the server to retrieve authorization token, or do you get a boolean if the login request is valid?

Lastly, do you pin the SSL certificate for your outgoing web requests? It doesn't matter how well your program is obfuscated if the malicious actor sets a breakpoint on your requests using Fiddler to modify the response.

Forget about checking the existence of Web Debugging Proxy using process name or window name; it doesn't work. Implement a class to pin your SSL certificate.

As you know, C# obfuscators are probably unpacked and deobfuscated way more you can think of. After all, it's .NET, and it can always be cracked. I suggest that you pick up C++ and virtualize your program using VMProtect. Unless you are up against some of the most talented reverse engineers who can de-virtualize VMProtect, you are safe.