🔺 Added a C2/beacon scanner that enumerates suspicious RWX / unbacked-image memory regions in running processes

🔺 Added a "sleeping beacon" heuristic that tracks memory entropy changes over time to catch encrypted beacons

🔺 Added a signature-based Cobalt Strike config decoder (with a clear false-positive warning)

🔺 Added live per-process network traffic monitoring (ETW-based)

🔺 Added core lateral-movement indicators — active RDP/SMB/WinRM connections, sessions, and Security log analysis

🔺 Added detection of listening ports and VPN/tunnel tooling

🔺 Added saved Wi-Fi network history and a MAC-address list of all devices on the network (ARP)

🔺 Added a shared folders/drives list that auto-flags risky "Everyone: Full Control" permissions

🔺 Added USN Journal-based tracking that distinguishes file copy vs. move vs. delete

🔺 Added a large-file disk scanner (WinDirStat-style)

🔺 Added USB device history cleanup, with a confirmation dialog and a local audit log

🔺 Extended the recent file changes filter to 30 days and added filtering by file creation time

🔺 Expanded Autoruns coverage — Winlogon, IFEO/Debugger hijacking, AppInit/AppCert DLLs, WMI event subscriptions, and unsigned services

🔺 Added a boot configuration (BCD/bootmgr) check

🔺 Added a full list of elevated (SYSTEM/Administrator) processes

🔺 Added a list of OS restore points with dates

🔺 Added crash (BSOD) and unexpected shutdown/restart history

🔺 Added environment variables, PATH folder listing, and a PATH-hijacking (writable system folder) check

🔺 Added LOLBAS and LOLDriver (BYOVD) threat-intel scanners, with an in-app database update button

🔺 Added an end-of-life (EOL) checker for the installed Windows version

🔺 Added step-by-step, regedit-free GUI remediation guides for all ~56 security checks

🔺 Fully redesigned the interface — flat Windows 11-style design, grouped sidebar, native look and feel

🔺 Stability fixes: elevated commands no longer flash a console window; fixed an encoding bug in result parsing.