executable Archives

AppWizard

September 27, 2026

AnyPS5 Reaches PS5 Game Menu on PC, No Emulator [2026]

A developer named boykopovar has created an open-source tool called AnyPS5 on GitHub, which aims to convert PlayStation 5 games to run natively on Windows and Linux systems. AnyPS5 can load a PS5 game's logo and reach its main menu on PC hardware but crashes before the menu becomes interactive. The tool uses a method called relinking, which reformats PS5 executables into native Windows or Linux files and provides replacement libraries to mimic PS5 system libraries. There is currently no public build available, and the developer has stated that a public release will only occur after a successful game launch. Sony has not made any public statements or taken legal action regarding AnyPS5. The project operates under the GPL-2.0 license, but the legal implications of using it with actual PS5 games remain unclear. Historical trends suggest that console emulation projects typically take years to mature, but AnyPS5's shared architecture with PCs may offer a potential shortcut.

Winsage

September 24, 2026

86Box Setup Guide 2026: Emulate a Windows 98 PC in 13 Steps

86Box is an emulator that meticulously reconstructs vintage PCs, allowing users to boot operating systems like MS-DOS, Windows 95, Windows 98, and Windows XP. The latest version, 6.0, was released on May 31, 2026, featuring a native Windows ARM64 build and discontinuing support for macOS 10.13 High Sierra. It has approximately 2,400 monthly searches in the U.S., indicating a demand for setup guides among enthusiasts. Unlike DOSBox, which creates a generic DOS environment, 86Box emulates specific hardware components for authentic execution of various operating systems. Originally a fork of PCem, 86Box has expanded its supported motherboards and developed a community of contributors. Version 6.0 has established it as the preferred choice for retro-PC builders in 2026. Before installation, users need a minimum of a 64-bit Intel Core 2, AMD Athlon 64, or ARMv8 CPU, 4 GB of RAM, and a compatible host operating system. The installation process involves downloading the appropriate build, sourcing a legal ROM set, and configuring the virtual machine using the 86Box Manager. Users can select specific graphics cards and sound hardware to replicate the original systems accurately. The setup requires installation media for the guest operating system, which must be sourced legally. Common pitfalls during setup include ensuring the BIOS ROM is available, matching CPU speed to software era, and installing the correct drivers. A properly configured virtual machine should display a BIOS POST screen and boot the selected operating system. Troubleshooting common issues often involves checking for missing ROMs, uninstalled drivers, or performance settings. 86Box is open-source and legal to use, but users must ensure they have legitimate licenses for any software used within the emulator.

Winsage

September 23, 2026

Cisco Talos Discloses Autonomous Windows Malware: Four AI Models Direct Each Attack

Cisco Talos has disclosed a new Windows implant called CLOSEDQUORUM, which operates without human operators by using four commercial large language models (LLMs) to autonomously decide on actions after deployment. The implant is a 16.4-megabyte executable that conducts reconnaissance on the target system and sends structured prompts to the LLMs, which respond with one of four actions: steal, inject, persist, or move. When the "steal" action is chosen, it simultaneously attacks three credential stores, extracting Windows credentials, browser passwords, and cryptocurrency wallet data. The "inject" action uses either Early Bird APC injection or process hollowing based on model recommendations. For persistence, it employs three overlapping mechanisms, including a Registry Run key, a scheduled task, and a WMI event subscription. To evade detection, CLOSEDQUORUM suppresses ETW telemetry and introduces delays before executing actions. It circumvents traditional command-and-control structures by calling legitimate API endpoints, making blocking these domains impractical. Talos introduced the CAIRN toolkit for detecting AI-integrated malware, which operates on metadata and employs rule-based detection. Unlike previous AI-assisted malware, CLOSEDQUORUM automates decision-making processes entirely, highlighting a significant evolution in malware capabilities. Security teams are advised to focus on behavioral detection strategies and utilize the YARA rule and CAIRN toolkit for identifying this threat.

Winsage

September 23, 2026

Cisco Talos Discloses Autonomous Windows Malware: Four AI Models Direct Each Attack

Cisco Talos has disclosed a Windows implant called CLOSEDQUORUM, which automates cyberattack execution using four advanced commercial large language models: DeepSeek, Qwen, Mistral, and Google Gemini. The implant is a 16.4-megabyte executable that conducts reconnaissance on the system and formats the gathered data into prompts for the AI models. Each model votes on one of four actions: steal, inject, persist, or move, with the action receiving the most votes being executed. When stealing, CLOSEDQUORUM targets three credential stores, dumping LSASS memory and retrieving saved passwords from browsers and cryptocurrency wallets. The stolen data is encrypted and sent to the operator via Discord. For injection, it uses Early Bird APC injection or process hollowing based on model responses. The persist action creates three mechanisms for longevity, including a Registry Run key, a scheduled task, and a WMI event subscription. CLOSEDQUORUM evades detection by suppressing ETW telemetry and delaying activity to avoid sandbox analyses. It connects to legitimate API endpoints, making blocking ineffective without disrupting enterprise applications. Talos recommends behavioral combination detection strategies and the use of a YARA rule for detection. The CAIRN toolkit has been introduced to detect AI-integrated malware without executing binaries. Unlike previous AI-assisted malware, CLOSEDQUORUM removes human decision-making from the attack process.

Tech Optimizer

September 22, 2026

This fake LastPass Authenticator app will just shut off your antivirus and leave you open to attack

LastPass has identified a sophisticated scheme targeting users of its Authenticator app, involving SEO poisoning and deceptive GitHub pages that distribute malicious ZIP files disguised as legitimate software. Users searching for "LastPass Authenticator download" may encounter these counterfeit pages, which redirect them to a malicious server delivering a ZIP file containing vsdbg.exe and vsdbg.dll. The executable is a legitimate Microsoft debugging tool exploited to execute the malicious DLL through DLL sideloading, allowing the malware to run undetected. Named Rapuncel by security researchers from Delphos, this malware is undetectable by antivirus engines and targets a hardcoded list of 145 antivirus and endpoint security products, disabling them upon detection. Rapuncel harvests sensitive information, including saved passwords from over 25 web browsers, cryptocurrency wallet files from more than 30 applications, and session tokens from platforms like Discord and Steam. It also captures screenshots and compiles a profile of the infected system, uploading the stolen data to an attacker-controlled server. The malware includes a kernel driver that intercepts web traffic, allowing for advertisement injection and search result manipulation. This campaign has been active for several months, with LastPass vaults remaining unaffected. Users are advised to download applications only from trusted sources. Rapuncel establishes persistence on infected machines by installing itself as a Windows service that starts with the system and terminates activated security products. Removing the kernel driver requires booting into Safe Mode or using external recovery tools, as standard Windows utilities cannot eliminate software operating at that level.

Winsage

September 21, 2026

How to use Xbox mode on your Windows PC

In 2026, Microsoft introduced Xbox mode for Windows 11 users to enhance the gaming experience, responding to the popularity of Valve's SteamOS. Xbox mode transforms the Windows interface by removing the taskbar and providing a layout suited for controller users, organizing game libraries within a revamped Xbox app. To enable Xbox mode, users must navigate to Settings > Gaming > Xbox mode and toggle the feature on. A gamepad must be connected, and users can access Xbox mode using keyboard shortcuts or through the Xbox app. While Xbox mode streamlines access to games from various platforms, it does not inherently improve gaming performance; users should enable Game Mode separately for that purpose. Xbox mode consolidates access to multiple game launchers, allowing users to launch games directly without opening their respective launchers. Additionally, Xbox Game Pass subscribers can access their library within Xbox mode, and the Cloud Gaming tab allows setting Nvidia GeForce Now as the default streaming service.

BetaBeacon

September 18, 2026

Pokémon Infinite Fusion on Android: JoiPlay Setup [2026]

- Pokémon Infinite Fusion is a standalone game built in RPG Maker XP, using the RGSS scripting layer. - The game is not a ROM, cartridge dump, or console to emulate, but rather a folder of Ruby scripts, tileset graphics, and audio files. - The mainline build of the game reached version 6.7.2 on October 2, 2025, and was updated to version 6.8.2 by August 2026. - The game combines two Pokémon into a single custom sprite and blended stat line, generating the combined artwork procedurally. - The Android-specific performance complaints come from the CPU doing image layering work in real time when compositing fusion sprites on lower-end devices.

Tech Optimizer

September 15, 2026

AI Is Changing Antivirus From File Matching to Behaviour-Based Malware Detection

Artificial intelligence is transforming malware detection by moving away from traditional file signature reliance to analyzing program actions. Antivirus software previously used signatures to identify known threats, but the rapid emergence of over 450,000 new malware samples daily complicates this method. Attackers now employ techniques like repacking and encryption to evade detection, prompting the need for machine-learning and behavioral techniques for better protection. Modern detection systems assess multiple characteristics of executable files, including their behavior, to identify potential threats, even if they lack recognized signatures. Microsoft's Project Ire exemplifies advanced detection capabilities, functioning as an automated malware analyst that evaluates unknown binaries based on their behavior. Additionally, modern endpoint-security products leverage cloud systems to analyze data from multiple devices, enhancing threat detection through shared intelligence. However, AI detection can still produce false positives and is susceptible to manipulation by attackers. Therefore, effective security systems require a combination of traditional measures, behavioral monitoring, machine learning, and human analysis to navigate complex threats.

Winsage

September 15, 2026

China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE

A spear-phishing campaign linked to the Chinese threat actor UTA0560 targeted various NGOs on September 1, 2026, exploiting recently patched vulnerabilities in Google Chrome and Microsoft Windows. The campaign utilized a malicious JavaScript backdoor called GRIMWEDGE, which was deployed through a multi-stage exploit chain that involved three vulnerabilities: CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880. The attack began with spear-phishing emails that led recipients to a vulnerable U.S.-based university website, allowing attackers to redirect users to their infrastructure. The exploit chain enabled arbitrary code execution and facilitated the deployment of GRIMWEDGE, which is capable of host reconnaissance, file and process management, command execution, and payload delivery. The initial payload was an executable named "msgbox.exe," which extracted a legitimate Windows binary and a malicious DLL called "wsc.dll." This DLL initiated a sideloading chain and contacted a command-and-control server for further instructions. GRIMWEDGE allows for several commands, including system reconnaissance, directory listing, file deletion, and command execution in a hidden window. It lacks built-in persistence or lateral movement mechanisms but provides a foothold for further exploitation. Concurrently, another Chinese threat actor, JungleBamboo (APT31), used the same exploit chain to deploy a loader named SUPERSTOMP, which installs a credential-stealing Chrome extension called LONGTALE. The simultaneous use of the exploit chain by multiple actors suggests potential sharing or sale of the exploit, raising concerns about patch-gap vulnerabilities that pose risks for exploitation campaigns.

AppWizard

September 10, 2026

Fix: Embark Game Boot Fatal Error (Detected Software) ARC Raiders

ARC Raiders players may face issues launching the game due to the Embark Game Boot halting unexpectedly because of a fatal error. Two main error messages can occur: "Detected Software," indicating that the anti-cheat system has identified a disallowed process, and "Failed to install EasyAntiCheat," which suggests that the EAC service or driver could not be initialized. The first error can be triggered by an AutoHotkey-based utility, while the second may arise from a locked EAC file, another anti-cheat process, or an incomplete installation of the service. If players reach the menu but experience crashes, they should consult the ARC Raiders crashing and freezing guide for troubleshooting steps related to the Embark Game Boot or Easy Anti-Cheat. Specific error messages and their solutions include: - "Detected Software or Cheat Software Detected": Close the named process. - "Failed to install EasyAntiCheat or EAC is not installed": Run EAC uninstall and install scripts. - "Error 30005 or CreateFile failed with 32": Restart Windows to unlock the EAC file. - "Maximum simultaneous game instances reached": Close other games and anti-cheat processes. - "An ARAV code names AutoHotkey, an auto-clicker, Cheat Engine, a VM, or another tool": Stop the named program. - "An ARAV code ending in 005, 006, or 007": Verify the game installation in Steam. To resolve issues: 1. Check and close the program named by Embark Game Boot. 2. Repair Easy Anti-Cheat from the ARC Raiders Installer Folder. 3. Verify the ARC Raiders installation in Steam. 4. Reinstall ARC Raiders if previous steps fail, and provide detailed error information to Embark Support if issues persist. Players should ensure that any flagged processes are closed before attempting to launch the game or reinstall it.