Hat's Multitool v6.3.6

Hat's Multitool v6.3.6

✨ New Features & Improvements

• Remote Software Catalog Manifest (SoftwareCatalog.json): Migrated the Programs installer list to a remote repository manifest that is fetched and parsed while prepping WinGet when opening the Programs module, with automatic retries on network errors and dynamic category tab generation.
• Expanded Software Catalog: Added Perimeter 81 Harmony SASE, Java (Oracle JRE), and Foxit PDF Reader to the software installation catalog.
• Proactive Internet Connectivity Checks & Diagnostics: Added proactive internet access verification when opening the Programs and Tools modules, plus descriptive network error reporting (distinguishing disconnected adapters, DNS lookup failures, connection timeouts, refused/reset connections, SSL/TLS errors, and HTTP status codes).
• Dynamic Local Accounts UI: The account action button now dynamically switches between Create Account and Modify Account based on whether the entered username already exists on the system, and the Administrator checkbox dynamically switches between Add to Local Administrators Group and Remove from Local Administrators Group (unchecked by default).

🐛 Bug Fixes & Security / AV Tuning

• Google Drive Installed Detection: Fixed a false-positive detection bug where Google Drive was always shown as installed due to matching the Drive suffix against OneDrive/Driver entries.
• AV False-Positive Remediation: Removed unsolicited startup version ping, unused dynamic P/Invoke loader imports (LoadLibrary/GetProcAddress), ZipFileExtensions.ExtractToFile timestomp calls, raw physical drive DeviceIoControl handles, and legacy dead code to eliminate ML/heuristic and CAPA MITRE false positives.

Hat's Multitool v6.3.5

What's Changed in v6.3.5

🛠️ Console Tool Runner & Tool Catalog Adjustments

• Console Tool Execution Completion Prompt: Diagnostic command tools (SFC, DISM, ChkDsk, .NET 3.5) launched from Hat's Multitool now complete and pause with an intuitive "Press any key to continue . . ." prompt before closing, rather than dropping the user into an open administrative command prompt.
• Elevated System32 Working Directory: Standalone console processes explicitly set their working directory to C:\Windows\System32, ensuring clean execution context and guarding against local path spoofing.
• Tool Catalog Clean-up: Removed DISM++ and ProfileShift from the remote tools manifest and archived remote binaries.

Full Changelog: v6.3.4...v6.3.5

Hat's Multitool v6.3.4

What's Changed in v6.3.4

🛡️ Antivirus False Positive Elimination & Architecture Modernization

• Eliminated Dynamic Injection & ConPTY Pseudo-Console: Completely removed ProcessRunnerEngine and dynamic API resolution (UpdateProcThreadAttribute, CreateProcessW). System diagnostics (SFC, DISM, ChkDsk, .NET 3.5) now execute in native, standalone elevated command prompt windows, eliminating heuristic triggers for Trojan.MSIL.Injector (IKARUS) and generic behavioral blockers.
• Dropper-Free Self-Cleanup: Removed intermediate %TEMP% batch script generation (del /f /q ... del "%~f0"). Directory cleanup of %LOCALAPPDATA%\HMT\ExtPrograms is now executed directly in managed code, and self-deletion for temporary runs utilizes an inline delay command, eliminating detections for Trojan:Win32Wacatac.H!ml (Defender) and Trojan.MSIL.Agent.qwjbfw (Kaspersky).
• Dynamic External Tools Manifest: Externalized third-party tool metadata and URLs to a dynamic GitHub repository manifest (ExternalTools.json) with automated web server fallback. All NirSoft password recovery utilities and hardcoded remote URLs have been stripped from the binary, eliminating detections for TR/W32.MalwareX (Avira) and Win32:MalwareX-gen (Avast/AVG).
• Decoupled NinjaOne Agent Removal: Removed sensitive inline PowerShell service-killing scripts from the compiled executable. NinjaOne agent uninstallation is now securely pulled and executed on-demand from the official server endpoint over TLS 1.2.
• Modern Roslyn Build Pipeline (.NET SDK): Migrated from Mono mcs to the official .NET SDK compiler with Microsoft.NETFramework.ReferenceAssemblies. Roslyn natively generates compliant Windows Subsystem 6.0 headers, proper localized Explorer Details metadata (000004b0 / 040904b0), and clean open-source metadata with no proprietary copyright notice.

Full Changelog: v6.3.3...v6.3.4

Hat's Multitool v6.3.3

What's Changed in v6.3.3

🛡️ False Positive Elimination & Signature Neutralization

• Eliminated Ikarus Trojan.MSIL.Injector Detection: Renamed internal unmanaged delegate types (UpdateProcThreadAttributeFn, InitializeProcThreadAttributeListFn, CreateProcessFn) to benign handlers (PseudoAttrSetHandler, PseudoAttrListInitHandler, PseudoProcessSpawnHandler), and dynamically constructed API lookup strings at runtime. This completely eliminates literal UpdateProcThreadAttribute and process injection signatures from the PE metadata UserString (#US) and TypeDef tables.
• Eliminated VBA32 Trojan.MSIL.RansomX.gen Detection: Removed offline registry hive mounting (reg.exe load HKU\HMT_DefaultUser ... NTUSER.DAT) and user SID iteration. Configured NumLock on boot and for new profile generation using the official modern Windows 10/11 standard indicator value 2147483650 (0x80000002) in HKEY_USERS\.DEFAULT and HKCU.
• Mitigated Generic Google ML Suspicion: Stripping the thread attribute injection signatures and removing offline hive tampering directly neutralizes the high-weight heuristic triggers (MITRE T1055 Process Injection & T1112/T1562 Defense Evasion) flagged by Google's automated ML model.

Full Changelog: v6.3.2...v6.3.3

Hat's Multitool v6.3.2

What's Changed in v6.3.2

🛠️ Bug Fixes & Operational Improvements

• Domain Joining Restored: Fixed an issue where domain joining failed immediately with a brief blank PowerShell window. Removed -NonInteractive from the PowerShell invocation, allowing Get-Credential to properly prompt for domain administrator credentials in an interactive console window, and added explicit status dialogs on join success or failure.
• Local Accounts Sequential Tab Navigation: Fixed keyboard tab traversal in the Local Accounts setup form. Set TabStop = false on the password reveal button (btnPeek) and configured sequential TabIndex (0: Username, 1: Password, 2: Confirm Password, 3: Auto Logon, 4: Admin, 5: Never Expire, 6: Create, 7: Close), preventing the focus from jumping out of the password fields.
• Download Resilience for WinGet & Office 365: Added automated 3-attempt retry logic with exponential backoff (2.0s - 2.5s delays) for direct HTTP installer downloads and Office 365 CDN multi/single-stream zip downloads. Transient network hiccups or CDN rate limits are now retried cleanly before falling back to native winget.exe or throwing an error, with automatic cleanup of partial .part* files.
• Time Zone Geolocation Auto-Detection & EST Default: Time zone module now defaults the initial selection to Eastern Standard Time (Eastern Standard Time) and attempts an asynchronous, non-blocking IP geolocation lookup (ip-api.com) with a 2.5s timeout. If detected, it auto-selects the local time zone if the user has not already manually interacted with the dropdown.
• NumLock on Boot for New User Profiles: Fixed an issue where NumLock did not apply to new user profiles (e.g. first login of a domain user). SetupOptionsEngine.SetNumLockOn() now mounts the default user template hive C:\Users\Default\NTUSER.DAT into HKEY_USERS\HMT_DefaultUser, sets InitialKeyboardIndicators = 2, cleanly unloads the hive, and applies the setting across all active and default user profiles.

Full Changelog: v6.3.1...v6.3.2

Hat's Multitool v6.3.1

What's Changed in v6.3.1

🛡️ Antivirus Detection Reduction & Security Improvements

• Explicit Self-Deletion Flag: Self-deletion is no longer executed automatically or matched by executable filename. Runs initiated from the web one-liner (irm mt.htsth.app | iex) explicitly pass --cleanup-on-exit, preventing AV sandboxes and regular runs from triggering self-deletion dropper heuristics (e.g. Symantec Trojan.Dropper!g8, Sysmon PE Creation). Replaced Process.Kill() with standard Environment.Exit(0).
• Storage Benchmark Byte Pattern: Replaced high-entropy pseudo-random byte writes with structured deterministic test patterns in DiskBenchmarkEngine, eliminating heuristic ransomware flags (VBA32 Trojan.MSIL.RansomX.gen).
• Dynamic ConPTY & UxTheme Imports: Replaced static P/Invoke declarations of InitializeProcThreadAttributeList, UpdateProcThreadAttribute, and undocumented UxTheme ordinals (#135/#133) with runtime dynamic delegate resolution (GetProcAddress), stripping thread attribute injection signatures from the PE metadata table (MITRE T1055) while preserving full unbuffered console streaming for SFC, DISM, and ChkDsk.
• Statically-Typed Zip Extraction: Replaced dynamic reflection (Assembly.Load, MethodInfo.Invoke) in ArchiveExtractor with standard .NET System.IO.Compression.ZipArchive, eliminating MITRE T1620 (Reflective Code Loading).
• Modernized Network Protocols & Delayed Beacon: Restricted ServicePointManager.SecurityProtocol to TLS 1.2 and TLS 1.3 only, eliminating IDS TLS handshake alerts. Added a 3-second startup delay to the background update check to prevent automated sandboxes from flagging immediate C2 beacons.
• PowerShell ExecutionPolicy Cleanup: Removed redundant -ExecutionPolicy Bypass flags from inline -Command invocations in ProcessRunnerEngine and BloatCleanupEngine, eliminating MITRE T1059.001 / Sigma execution policy bypass alerts.
• In-Process WMI for Hardware & License Queries: Replaced wmic.exe child process spawns in ReadOemProductKey and computer renaming with native System.Management.ManagementObjectSearcher, eliminating process-spawning telemetry (MITRE T1047) and providing native compatibility with Windows 11 24H2+.

⚙️ PE Headers, Compiler & Explorer Details Polish

• Windows Explorer Details Tab Fix: Fixed Mono mcs compiler issue where Win32 RT_VERSION string table was assigned Invariant Culture (007f04b0). PE patcher now rewrites translation to en-US (040904b0), allowing Windows Explorer to properly display version, product name, copyright, and company information in file properties.
• PE Header Modernization: Automatically populates PE headers with current UTC timestamp, Windows Subsystem/OS version 6.0, and recalculates the PE checksum before Authenticode EV signing.
• Compiler Optimization & Production Attributes: Enabled mcs -optimize+ and added standard .NET Framework 4.8 TargetFramework, ComVisible, Guid, and AssemblyConfiguration attributes.

Full Changelog: v6.3.0...v6.3.1

Hat's Multitool v6.3.0

What's Changed in v6.3.0

🛡️ External Tools & Security Modernization

• Removed NirSoft Password Utilities: Removed legacy NirSoft password recovery utilities (WebBrowserPassView, WirelessKeyView, Dialupass, CredentialFileView, and VaultPasswordView) from the external tools engine.
• Removed Password & Keys Tab: Removed the "Password & Keys" tab from the External Tools window (ExternalToolsForm).
• Antivirus False Positive Reduction: Completely eliminates static signature matches and heuristic flags associated with credential recovery utilities. Note: Reading the hardware-embedded Windows product key remains cleanly available via the "Read OEM OS Key" utility under Viewers & Utilities.

Full Changelog: v6.2.9...v6.3.0

Hat's Multitool v6.2.9

What's Changed in v6.2.9

🛡️ Security & Antivirus Interoperability

• Removed Programmatic Defender Exclusions: Removed the automated background PowerShell call configuring Windows Defender folder exclusions (Add-MpPreference -ExclusionPath ...) inside ExternalToolsEngine.GetExtProgramDir(). Downloaded tools are responsible for maintaining their own reputation, eliminating aggressive behavioral actions and heuristic flags (such as Trojan.MSIL.RansomX.gen).
• Clean Tool Directory Resolution: ExternalToolsEngine.GetExtProgramDir() now cleanly resolves and creates the standard %LocalAppData%\HMT\ExtPrograms directory without attempting to alter system security policies.

Full Changelog: v6.2.8...v6.2.9

Hat's Multitool v6.2.8

What's Changed in v6.2.8

⚡ System Setup & Tweaks

• Hibernation & Power Menu Option Checkbox Label: Configured UseMnemonic = false on tweak checkboxes in SetupOptionsForm (HMTForms.cs). Previously, Windows Forms treated the ampersand in "Enable Windows Hibernation & Power Menu Option" as a keyboard shortcut accelerator prefix, causing it to render as an invisible blank space. The full label and & are now rendered cleanly.

🚀 Startup & Autoruns Manager

• Native Windows Task Manager Startup Folder Integration: Replaced disk-level file renaming (.lnk.disabled) with Windows' native StartupApproved\StartupFolder registry mechanism (0x02 enabled, 0x03 disabled binary structures in HKCU and HKLM). Disabling startup items no longer renames shortcut files on disk.
• Fixed "Choose an app to open this .disabled file" Boot Prompt: Because Windows Explorer iterates all files in shell startup folders on login and attempts to execute them, appending .disabled triggered file association prompts on system startup. The native StartupApproved method completely resolves this issue.
• Automatic Self-Healing Migration: When scanning startup items, StartupScanner.ScanAll() detects any existing legacy .disabled files from prior versions, renames them back to their clean .lnk filenames on disk, and marks them Disabled in StartupApproved\StartupFolder.
• Excluded desktop.ini: Desktop configuration files in the user and common startup directories are now filtered out and no longer listed.

Full Changelog: v6.2.7...v6.2.8

Hat's Multitool v6.2.7

What's Changed in v6.2.7

🛠️ Diagnostics & Check Disk Progress Tracking

• Real-Time Progress & Baseline Stages: Added stage baseline progress tracking (Stage 1: 5%, Stage 2: 33%, Stage 3: 66%) and dynamic item/percentage regex parsing (\b(\d+)%, (\d+)\s+of\s+(\d+)) in HMTForms.cs.
• Live Dynamic ETA Calculation: Enabled real-time ETA calculation during ChkDsk runs rather than displaying a static estimate.

🚀 Startup & Autoruns Manager Multi-Selection & Context Menu

• Multi-Item Batch Operations: Enabled MultiSelect = true on lvStartup in HMTForms.cs. Users can select multiple startup items to enable/disable or delete simultaneously.
• Double-Click Toggle: Double-clicking any startup item immediately toggles its enabled/disabled status.
• Themed Context Menu: Added a custom dark-styled context menu (DarkMenuColorTable) with dynamic selection count labels (Enable / Disable (X selected), Delete (X selected)).
• Selection Retention on Right-Click: Intercepted WM_RBUTTONDOWN and WM_RBUTTONUP in DarkListView (HMTTools.cs) so right-clicking existing multi-selections retains the selection rather than deselecting.
• Dynamic Counter Buttons: Bottom action buttons dynamically reflect the selected count (Enable / Disable (X), Delete (X)).

🖥️ Direct GUI Tool Launching

• Reliability Monitor & Disk Cleanup: Configured native Windows utilities ("Reliability Monitor" perfmon.exe /rel and "Windows Disk Cleanup" cleanmgr.exe) to ActionType = "Gui" in HMTEngines.cs and launch directly via Process.Start without opening redundant console progress windows.

⚡ System Tweaks & Power Options

• Windows Start Menu Hibernate Flyout: Enhanced EnableHibernation() in HMTEngines.cs to enable the Windows hibernation subsystem (powercfg.exe /hibernate on) and configure all necessary Explorer flyout and policy registry settings (FlyoutMenuSettings\ShowHibernateOption = 1, Policies\Microsoft\Windows\Explorer\ShowHibernateOption = 1, and Control\Power\HibernateEnabled = 1).

Full Changelog: v6.2.6...v6.2.7