Hat's Multitool v6.3.1

What's Changed in v6.3.1

🛡️ Antivirus Detection Reduction & Security Improvements

• Explicit Self-Deletion Flag: Self-deletion is no longer executed automatically or matched by executable filename. Runs initiated from the web one-liner (irm mt.htsth.app | iex) explicitly pass --cleanup-on-exit, preventing AV sandboxes and regular runs from triggering self-deletion dropper heuristics (e.g. Symantec Trojan.Dropper!g8, Sysmon PE Creation). Replaced Process.Kill() with standard Environment.Exit(0).
• Storage Benchmark Byte Pattern: Replaced high-entropy pseudo-random byte writes with structured deterministic test patterns in DiskBenchmarkEngine, eliminating heuristic ransomware flags (VBA32 Trojan.MSIL.RansomX.gen).
• Dynamic ConPTY & UxTheme Imports: Replaced static P/Invoke declarations of InitializeProcThreadAttributeList, UpdateProcThreadAttribute, and undocumented UxTheme ordinals (#135/#133) with runtime dynamic delegate resolution (GetProcAddress), stripping thread attribute injection signatures from the PE metadata table (MITRE T1055) while preserving full unbuffered console streaming for SFC, DISM, and ChkDsk.
• Statically-Typed Zip Extraction: Replaced dynamic reflection (Assembly.Load, MethodInfo.Invoke) in ArchiveExtractor with standard .NET System.IO.Compression.ZipArchive, eliminating MITRE T1620 (Reflective Code Loading).
• Modernized Network Protocols & Delayed Beacon: Restricted ServicePointManager.SecurityProtocol to TLS 1.2 and TLS 1.3 only, eliminating IDS TLS handshake alerts. Added a 3-second startup delay to the background update check to prevent automated sandboxes from flagging immediate C2 beacons.
• PowerShell ExecutionPolicy Cleanup: Removed redundant -ExecutionPolicy Bypass flags from inline -Command invocations in ProcessRunnerEngine and BloatCleanupEngine, eliminating MITRE T1059.001 / Sigma execution policy bypass alerts.
• In-Process WMI for Hardware & License Queries: Replaced wmic.exe child process spawns in ReadOemProductKey and computer renaming with native System.Management.ManagementObjectSearcher, eliminating process-spawning telemetry (MITRE T1047) and providing native compatibility with Windows 11 24H2+.

⚙️ PE Headers, Compiler & Explorer Details Polish

• Windows Explorer Details Tab Fix: Fixed Mono mcs compiler issue where Win32 RT_VERSION string table was assigned Invariant Culture (007f04b0). PE patcher now rewrites translation to en-US (040904b0), allowing Windows Explorer to properly display version, product name, copyright, and company information in file properties.
• PE Header Modernization: Automatically populates PE headers with current UTC timestamp, Windows Subsystem/OS version 6.0, and recalculates the PE checksum before Authenticode EV signing.
• Compiler Optimization & Production Attributes: Enabled mcs -optimize+ and added standard .NET Framework 4.8 TargetFramework, ComVisible, Guid, and AssemblyConfiguration attributes.

Full Changelog: v6.3.0...v6.3.1