executable Archives

Winsage

August 17, 2026

Windows 11 is fully removing a legacy tool that malware and ransomware have abused for years, meet WMIC

Microsoft is removing the Windows Management Instrumentation Command-line (WMIC) from Windows 11 to enhance security by eliminating a tool that has been exploited by malware and ransomware. WMIC will not be included in Windows 11 versions 24H2, 25H2, and 26H2, with complete removal scheduled for the August 2026 Patch Tuesday update. The decision to remove WMIC is based on the availability of more secure alternatives like PowerShell. WMIC has been a vector for attacks, allowing threat actors to disable antivirus solutions and access sensitive data. Microsoft has phased out WMIC since 2021, encouraging users to transition to modern tools while continuing to support the underlying Windows Management Instrumentation (WMI) infrastructure.

Winsage

August 16, 2026

Devs blame Windows for VLC media player bug that causes 33-second delay when playing MP3 files

VLC, the open-source media player, is experiencing delays of up to 33 seconds when playing MP3 files on Windows 11, attributed to a recent update to Microsoft Defender that conflicts with VLC’s plugin cache. Developer Jonathan Blow criticized VLC for this issue, prompting the VLC team to clarify that the problem stems from Microsoft Defender quarantining the plugins.cache file. Users can resolve the issue by reinstalling VLC or regenerating the plugin cache, although this will reset personalized settings. Adding an exception for VLC in Microsoft Defender may prevent future issues. Microsoft has not yet commented on the situation.

AppWizard

August 15, 2026

This Solitaire game is so tiny it can load from a QR code, which is just what I need in the age of massive games and expensive storage

TinySol is a minimalist solitaire game created by Classic Bits, accessible via a QR code and discovered by YouTuber LGR Blerbs at the VCF Southwest convention. It is intentionally monochrome for clarity on old displays, with a QR code version offering limited features. Currently, it includes a 3-card draw mode, with a one-card draw mode planned for future release. TinySol is available for free download on the Classic Bits website and can be run in DosBox. Many three-card draws may not be winnable, but Classic Bits has provided 640 winnable save files for download.

Winsage

August 14, 2026

Windows has a secret database that makes your old games

Microsoft's Windows operating system has developed intricate compatibility mechanisms over decades to ensure that older games can run on modern machines. It maintains compatibility databases that recognize software with known issues and applies specific fixes, known as shims, which adjust the OS's responses to meet the game's expectations without modifying the game's executable. Users can also manually apply fixes through Compatibility settings, allowing them to emulate earlier operating system behaviors and address specific issues. The compatibility shims can modify interactions with APIs, file handling, system privileges, and display scaling. Microsoft provides AppHelp warnings for applications with known compatibility issues and maintains a comprehensive compatibility database located at C:WindowsAppPatch. Users can access this database and explore compatibility settings using the Windows ADK and the Compatibility Administrator tool.

Winsage

August 14, 2026

Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth

The threat actor known as HoneyMyte, also referred to as Mustang Panda, has been deploying an upgraded version of the CoolClient backdoor, which includes a signed Windows kernel-mode rootkit. This rootkit enhances the malware's ability to conceal malicious processes, files, registry objects, and command-and-control (C2) network information. Victims have been identified in Myanmar, Mongolia, Pakistan, and Russia, with confirmed targets including government entities. The CoolClient backdoor is deployed as a secondary access layer following an initial PlugX infection. The kernel component activates when CoolClient gains full access to the Service Control Manager (SCM) and the SeTcbPrivilege privilege. If these conditions are not met, the malware bypasses driver deployment and advances to the final-stage implant. Kaspersky has provided indicators of compromise (IoCs), including file hashes, paths, and C2 domains. In a campaign targeting Myanmar, HoneyMyte used PlugX as the initial implant to deploy CoolClient, which involved creating Microsoft Defender exclusions and renaming a legitimate executable for DLL sideloading. Persistence is achieved through a scheduled task that executes the binary with SYSTEM privileges at startup. Execution begins when a legitimate application loads a malicious DLL, which then manages persistence, registry modifications, UAC bypass, process injection, driver deployment, and C2 communications. When privileges are granted, the malware extracts a kernel driver, writes it to disk, and establishes a driver service. The driver is digitally signed with a certificate from Nanjing Ranyi Technology Co., Ltd. The driver receives configuration data from the CoolClient user-mode component and utilizes specific IOCTL requests to register trusted processes and protect filesystem and registry paths. The rootkit can limit access rights to protected processes, hide processes by unlinking them from the active process list, and deny access to protected files and directories. It also filters C2 IPv4 addresses from network information. The driver incorporates 33 IOCTL handlers, but only three were observed in use during standard execution. Kaspersky shared several file hashes related to the malware, including those for the kernel driver and malicious DLLs. This follows earlier disclosures regarding a newer CoolClient variant and a different HoneyMyte kernel-mode rootkit documented in December 2025.

Winsage

August 14, 2026

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

CoolClient is a sophisticated backdoor family linked to the HoneyMyte APT group, actively used in cyber-espionage campaigns targeting organizations in Asia and Russia since its initial disclosure in 2022. It has capabilities such as keylogging, clipboard theft, credential harvesting, and system reconnaissance. Investigations in 2023 revealed enhancements, including clipboard theft and HTTP traffic interception. By late 2025 and into 2026, a variant was noted that could deploy a signed kernel-mode driver as a Windows service, improving its stealth and operational capabilities. In a recent campaign targeting Myanmar, the HoneyMyte group used PlugX to deploy CoolClient components. They configured Microsoft Defender to exclude a fake Windows Defender installation directory and a renamed executable, defender.exe, to avoid detection. Persistence was achieved through a scheduled task that executed defender.exe with SYSTEM privileges at startup, which sideloaded the malicious libngs.dll to initiate the CoolClient execution chain. The latest CoolClient variant has a multi-stage execution chain, including: - defender.exe / Sang.exe: Exploited legitimate application for DLL sideloading. - libsrapc.dll: Benign dependency for the Sangfor application. - libngs.dll: First-stage loader that decrypts and loads the next stage. - loadcert.ini: Second-stage DLL implementing core functionalities. - cert.ini: Final-stage implant for command and control communication. - time.ini: Configuration file for CoolClient. The execution begins with the legitimate Sangfor application loading libngs.dll, which uses obfuscation to conceal its operations. The second stage, loadcert.ini, is injected into synchost.exe and performs tasks including persistence and process injection. The kernel-mode driver deployment routine involves decrypting time.ini, verifying privileges, and creating a service to execute the driver, enhancing stealth. The deployed kernel-mode driver, msagent.sys, is digitally signed and helps hide processes, files, and registry objects, making detection more difficult. The latest variant continues to target organizations consistent with previous HoneyMyte activities, with confirmed victims in Myanmar, Mongolia, Pakistan, and Russia, including government entities. The deployment of CoolClient as a secondary backdoor after a PlugX infection indicates a strategic approach to maintain access to compromised systems. The malware is confirmed as a new variant of CoolClient associated with the HoneyMyte threat group, with the kernel-mode driver marking a significant advancement in its capabilities.

AppWizard

August 11, 2026

Xodus Cracks Xbox Authentication and Game Package Decryption to Bring PC Game Pass to Linux

Developers of the Heroic Games Launcher have announced Xodus, an open-source project aimed at enabling access to PC Game Pass on Linux and macOS. Launched on August 10, 2026, Xodus has successfully addressed Xbox identity authentication and the decryption of MSIXVC packages, allowing local play of Game Pass titles for Linux and macOS users. Currently, the only way to access Game Pass on non-Windows devices is through Xbox Cloud Gaming, which requires a Game Pass Ultimate subscription and introduces latency. Xodus employs a layered architecture, including an Xbox Authentication Library (xal-rs) for managing Microsoft account sign-ins and license verification, and a reimplementation of the xgameruntime.dll for license checks and Xbox service access. The project can retrieve MSIXVC game packages using a valid Game Pass subscription and decrypt executables for local storage. However, it does not yet support UWP-based titles and lacks a user-friendly interface for general users. The project is under pressure due to Microsoft's upcoming transition to the MSIXVC2 package format, which Xodus does not currently support. Xodus is in early development with only a command-line interface available, and the team is working on emulating the GDK Gaming Services layer necessary for game initialization. The project is legal as it reimplements Xbox runtime behavior without enabling piracy, but it faces risks if Microsoft alters its authentication infrastructure.

AppWizard

August 11, 2026

How to Fix Minecraft Lag and Stuttering on PC and Mac in 2026

Experiencing a freeze in Minecraft Java Edition can be frustrating due to the game's demands on computer performance, which can lead to lag spikes, stuttering, and low FPS. Performance issues can often be resolved without new hardware by optimizing settings on Windows and macOS. To address lag, identify the type of lag and adjust settings one at a time, starting with visuals and add-ons, then moving to memory, Java, drivers, and multiplayer servers. Quick fixes include closing background apps, restarting Minecraft, testing in a single-player world, disabling shaders, using default resources, and lowering render distance. Different types of lag include low FPS, stuttering from world loading, network or multiplayer server lag, and performance drops after enabling visual add-ons. To diagnose lag, symptoms should be matched with potential causes and fixes, such as adjusting video settings or checking server performance. Common issues include low FPS, stuttering while exploring, FPS drops when shaders are enabled, resource pack hitching, and problems with memory allocation or incompatible Java versions. Each issue has specific symptoms, causes, and recommended fixes, such as adjusting render distance, disabling shaders, or ensuring the correct Java version is used. Platform-specific fixes for macOS and Windows involve updating drivers, managing graphics settings, and ensuring proper memory allocation. Configuration mistakes can hinder performance improvements, and hardware limitations may also play a role in lag. For ongoing issues, gathering relevant logs and system details is essential for seeking help, and preventative tips include maintaining a clean test profile, gradually adding mods, and matching versions carefully.

Winsage

August 8, 2026

There’s an x64 Port of Microsoft Word 1.1a for Windows

Developer John Marshall has successfully ported Microsoft Word for Windows 1.1a to run on Windows 11 as a native 64-bit executable. This project involved reconstructing the original application from the early 1990s by translating 16-bit Assembly language into C/C++ code and adapting it to modern Win32 APIs. Marshall's work was made possible by Microsoft's release of the source code for Word for Windows 1.1a in 2014. Users interested in setting up the port will need Visual Studio with the C++ workload, the latest Windows SDK, CMAKE version 3.25 or newer, and to execute specific PowerShell scripts provided by Marshall.

Winsage

August 8, 2026

Developer ported Word for Windows 1.1a from 1990 to run natively on Windows 11

Microsoft Word has evolved from a basic text editor in the 1980s to an AI-enhanced platform capable of generating text autonomously. Developer Justin Marshall has revived Microsoft Word for Windows 1.1a, originally released in 1990, using the open-source code made available by Microsoft in 2014. This version has been crafted into a native 64-bit Windows executable, allowing users to run it on Windows 11 without emulators. The interface is stripped of modern features, offering a simple sheet of paper and basic formatting tools reminiscent of early Windows design. Marshall has a history of reviving classic software and has other projects showcased on his GitHub page. Word for Windows 1.1a is available for download for those interested in experiencing early word processing.