NewApp Digest
search bot

DLL

The Wind Waker HD ported to Android - Zelda remaster from Wii U runs without an emulator
BetaBeacon
October 9, 2026

The Wind Waker HD ported to Android – Zelda remaster from Wii U runs without an emulator

Classic Nintendo game The Legend of Zelda: The Wind Waker HD has been unofficially ported to Android smartphones, allowing players to extract files from their own game image and compile the code directly on their device. The mobile version features support for Vulkan, on-screen buttons, external controllers, gyroscope-assisted aiming, resolution settings, save state slots, and alternative graphics drivers for devices with Adreno. Users need Android 11 or newer, an ARM64 processor, Vulkan 1.1 support, and 2 GB of free space to run the game, along with an image and keys for the American or European version of the game.
Nadella has lost the plot calling Copilot an OS again, it's a web app on Windows 11
Winsage
October 4, 2026

Nadella has lost the plot calling Copilot an OS again, it’s a web app on Windows 11

Satya Nadella has referred to Copilot as a “new OS for work” during a leadership update, following Microsoft's introduction of the latest iteration of Copilot. The new Copilot app, which replaces the previously named Microsoft 365 Copilot, is currently available for users, although some features like Home, Code, and Autopilot are still forthcoming. The app operates as a standard Windows application, specifically a rebranded Microsoft Edge launcher built on a Chromium framework. Nadella reiterated his vision for Copilot in a post dated October 1, emphasizing its role in consolidating various work functions into a single platform. The Copilot app integrates features such as Home, Office applications, and a proactive command center named Today. Currently, the app primarily functions as a chat interface, with significant features yet to be rolled out. The architecture of Copilot relies on a lightweight launcher and a complete Edge build, resulting in high RAM consumption. Microsoft has shifted Copilot’s architecture from a native WinUI version to a web-based wrapper, supported by a secondary component for additional functionalities. Internal documents reveal a vision for a prototype called CopilotOS, indicating a long-standing ambition to create a cohesive workspace.
Windows 11 24H2/25H2/26H2: Problems with preview update KB5124010
Winsage
October 4, 2026

Windows 11 24H2/25H2/26H2: Problems with preview update KB5124010

On September 22, 2026, Microsoft released the optional Preview Update KB5124010 for Windows 11 versions 24H2, 25H2, and 26H2, aimed at enhancing performance and addressing various issues, with broader distribution planned for October 2026. User feedback indicated concerns about complications from the update. A user reported that applications were crashing due to issues with the library file msmpeg2ac3dec.dll when multiple MP3 files were played simultaneously, affecting older games like SimCity 4 and Fallout New Vegas. The user's company’s telephone system, using innovaphone, also experienced crashes with the myApps client. The msmpeg2ac3dec.dll file was found only on systems upgraded from Windows 11 22H2, while fresh installations of 24H2 or 25H2 did not include it. A workaround involving the installation of "LAV Filters" was tested and found to resolve the crashing issue. Microsoft acknowledged the issues related to the Preview Update KB5124010, stating that applications requiring AC-3 audio decoding might close unexpectedly and that they are working on a resolution for this problem in a future update.
A Windows 10 Update Was Force Triggering Copilot To Run Every Time A File Was Clicked, Leading To Frequent Crashes That Logged The Culprit As Microsoft Edge
Winsage
September 28, 2026

A Windows 10 Update Was Force Triggering Copilot To Run Every Time A File Was Clicked, Leading To Frequent Crashes That Logged The Culprit As Microsoft Edge

Microsoft's Windows 10 update "KB5126256," intended as a licensing preparation package for Extended Security Updates, has caused issues for users, including one Reddit user whose File Explorer crashes when clicking on files due to the automatic activation of the Copilot feature. The crashes were misleadingly attributed to Microsoft Edge, but further investigation revealed they were linked to "mscopilot_proxy.exe" and the module "ShellEh6055x64.dll," associated with the 4t Tray Minimizer application. Users have reported that uninstalling problematic updates can provide temporary relief, while some have chosen to disable updates entirely, despite Windows not offering a complete option to do so.
This fake LastPass Authenticator app will just shut off your antivirus and leave you open to attack
Tech Optimizer
September 22, 2026

This fake LastPass Authenticator app will just shut off your antivirus and leave you open to attack

LastPass has identified a sophisticated scheme targeting users of its Authenticator app, involving SEO poisoning and deceptive GitHub pages that distribute malicious ZIP files disguised as legitimate software. Users searching for "LastPass Authenticator download" may encounter these counterfeit pages, which redirect them to a malicious server delivering a ZIP file containing vsdbg.exe and vsdbg.dll. The executable is a legitimate Microsoft debugging tool exploited to execute the malicious DLL through DLL sideloading, allowing the malware to run undetected. Named Rapuncel by security researchers from Delphos, this malware is undetectable by antivirus engines and targets a hardcoded list of 145 antivirus and endpoint security products, disabling them upon detection. Rapuncel harvests sensitive information, including saved passwords from over 25 web browsers, cryptocurrency wallet files from more than 30 applications, and session tokens from platforms like Discord and Steam. It also captures screenshots and compiles a profile of the infected system, uploading the stolen data to an attacker-controlled server. The malware includes a kernel driver that intercepts web traffic, allowing for advertisement injection and search result manipulation. This campaign has been active for several months, with LastPass vaults remaining unaffected. Users are advised to download applications only from trusted sources. Rapuncel establishes persistence on infected machines by installing itself as a Windows service that starts with the system and terminates activated security products. Removing the kernel driver requires booting into Safe Mode or using external recovery tools, as standard Windows utilities cannot eliminate software operating at that level.
Windows Search's default indexing mode could be writing gigabytes to your SSD every day for a feature almost nobody uses
Winsage
September 17, 2026

Windows Search’s default indexing mode could be writing gigabytes to your SSD every day for a feature almost nobody uses

The search index on Windows 11 can contribute to storage bloat, with reported sizes varying significantly among users. The search index database, named Windows.db, is crucial for delivering quick search results and can grow dramatically, with some users experiencing sizes exceeding 200GB. A PowerShell script can be used to check the size of the Windows.db file. If the file size is unusually large, users can rebuild the search index through the Indexing Options in the Control Panel. Windows 11 has two indexing modes: Classic and Enhanced, which affect the size and number of indexed items. Classic mode indexes specific folders, while Enhanced mode indexes the entire PC. Excluding certain directories can help manage index size. Performance issues may arise on PCs with over 400,000 indexed items.
China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE
Winsage
September 15, 2026

China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE

A spear-phishing campaign linked to the Chinese threat actor UTA0560 targeted various NGOs on September 1, 2026, exploiting recently patched vulnerabilities in Google Chrome and Microsoft Windows. The campaign utilized a malicious JavaScript backdoor called GRIMWEDGE, which was deployed through a multi-stage exploit chain that involved three vulnerabilities: CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880. The attack began with spear-phishing emails that led recipients to a vulnerable U.S.-based university website, allowing attackers to redirect users to their infrastructure. The exploit chain enabled arbitrary code execution and facilitated the deployment of GRIMWEDGE, which is capable of host reconnaissance, file and process management, command execution, and payload delivery. The initial payload was an executable named "msgbox.exe," which extracted a legitimate Windows binary and a malicious DLL called "wsc.dll." This DLL initiated a sideloading chain and contacted a command-and-control server for further instructions. GRIMWEDGE allows for several commands, including system reconnaissance, directory listing, file deletion, and command execution in a hidden window. It lacks built-in persistence or lateral movement mechanisms but provides a foothold for further exploitation. Concurrently, another Chinese threat actor, JungleBamboo (APT31), used the same exploit chain to deploy a loader named SUPERSTOMP, which installs a credential-stealing Chrome extension called LONGTALE. The simultaneous use of the exploit chain by multiple actors suggests potential sharing or sale of the exploit, raising concerns about patch-gap vulnerabilities that pose risks for exploitation campaigns.
Search