NewApp Digest
search bot

system tools

Windows 11 Spotted Keeping Thumbnails of Deleted Photos
Winsage
October 3, 2026

Windows 11 Spotted Keeping Thumbnails of Deleted Photos

Windows 11 uses a thumbnail caching mechanism to store previews of images in specific databases located in %LocalAppData%MicrosoftWindowsExplorer, such as thumbcache32.db and thumbcache1024.db. When a user deletes an image, the corresponding thumbnail may remain in the cache, as deletion does not automatically remove it from the thumbnail database. The cache retains only reduced versions of images, not the original files, which is significant in digital forensics where thumbnails can provide insights even when original files are missing. Users can manage their thumbnail cache using the cleanmgr tool to clear saved thumbnails or disable thumbnail caching through the Local Group Policy Editor or File Explorer settings.
Fake Microsoft Edge, Kaspersky and Razer Installers Used to Compromise Windows Systems
Winsage
September 2, 2026

Fake Microsoft Edge, Kaspersky and Razer Installers Used to Compromise Windows Systems

An ongoing malware campaign is targeting Windows devices through counterfeit download pages for well-known software brands like Microsoft Edge, Kaspersky, and Razer. The campaign affects various sectors, including healthcare, manufacturing, gaming, technology, logistics, government, and education. It utilizes high-fidelity fraudulent websites that closely mimic legitimate vendors, with observed lure domains such as app-microsoft-edge[.]com[.]cn and kaspersky-lab[.]hl[.]cn. Attackers employ evasion tactics like server-side payload regeneration and create multiple copies of the same archive in quick succession. Victims are lured into downloading ZIP files that contain a bundled wrapper installer, which activates a stage-one executable in randomized directories. The malware often masquerades as legitimate software, with some payloads impersonating known applications. Persistence is achieved through scheduled tasks with unusual names, and the malware employs various evasion techniques, including deleting shadow copies and altering file permissions. Microsoft Defender has identified activity across multiple stages of the attack, including delivery, execution, and command-and-control communications. To mitigate risks, organizations are advised to block downloads from unofficial sources, enforce Tamper Protection, and implement Attack Surface Reduction rules. Indicators of compromise (IOCs) include specific lure domains and URLs associated with the campaign.
Powerful Windows 11 app Wintoys just got significantly better with long list of improvements
Winsage
July 27, 2026

Powerful Windows 11 app Wintoys just got significantly better with long list of improvements

Microsoft has enhanced the Windows experience with utilities like the Media Creation Tool and PowerToys, while third-party applications like Wintoys, an unofficial counterpart to PowerToys, have also been updated. The latest version of Wintoys features performance improvements from upgrades to .NET 10 and Windows App SDK 2.3.1, resulting in a 30% reduction in RAM usage on the Services page, a 20% decrease on the Apps page, and a 10% improvement on the Startup entries page. Key updates include the ability to enable or disable the recommended section in the Start menu, manage recent items tracking, and a new Device metadata option to prevent unauthorized app installations. The Services page has been rewritten for better memory usage and real-time updates. Additional improvements include enhanced keyboard navigation, new acrylic backdrop features for Windows 10 and 11, and various bug fixes for system settings, network stats, and overall stability. The updated version of Wintoys is available for download via the Microsoft Store.
After years of forgetting Windows shortcuts, I finally found a method that makes them stick
Winsage
June 19, 2026

After years of forgetting Windows shortcuts, I finally found a method that makes them stick

On Windows 11, keyboard shortcuts enhance productivity, but many users are only aware of a few common ones like "Windows key + E" for File Explorer and "Ctrl + C" and "Ctrl + V" for copying and pasting. To help users discover more shortcuts, the Microsoft team behind PowerToys has released a revamped Shortcut Guide in version 0.100. This guide can be accessed through the GitHub page or the Microsoft Store and activated via PowerToys settings. Users can customize the guide's color theme, position, and exclude specific applications. The guide can be opened using the "Windows key + Shift + /" shortcut and provides organized shortcuts for Windows 11 and PowerToys. It also includes context-aware functionality, showing relevant shortcuts based on the active application. The development team has provided guidelines for developers to integrate their apps into the Shortcut Guide.
I discovered a dead‑simple way to remember Windows 11 shortcuts, and it changed how I use the OS
Winsage
June 18, 2026

I discovered a dead‑simple way to remember Windows 11 shortcuts, and it changed how I use the OS

The Microsoft team behind PowerToys has released an updated Shortcut Guide in version 0.100 for Windows 11, which now appears as a context-sensitive flyout instead of a static reference page. This guide provides relevant keyboard shortcuts based on the application currently in use, improving user efficiency and learning. Users can access the Shortcut Guide by installing PowerToys and can customize its settings, including color theme and activation shortcut. The guide displays shortcuts for various applications and includes a list of Windows 11 and PowerToys shortcuts when no applications are focused. Developers can integrate their apps into the Shortcut Guide as well.
MSHTA abuse helps malware hide in Windows processes
Winsage
May 20, 2026

MSHTA abuse helps malware hide in Windows processes

Bitdefender's research highlights the use of Microsoft's MSHTA utility in malware attacks, noting its default activation in Windows systems. Cybercriminals exploit MSHTA to execute malicious scripts under the guise of legitimate processes, linking it to various malware families like LummaStealer and PurpleFox. The study reports a rise in MSHTA-related detections, indicating a shift towards "living-off-the-land" tactics that utilize legitimate tools to evade security alerts. Social engineering is identified as a common entry point for attacks, employing deceptive methods such as fake software downloads and phishing links. MSHTA can retrieve and execute additional payloads through multi-stage chains, complicating detection efforts. The attacks target sensitive information, including credentials and financial data, and the continued presence of MSHTA poses risks as it allows threat actors to conceal malicious actions. To mitigate these threats, organizations are advised to restrict or disable legacy scripting tools and exercise caution with untrusted downloads. The report emphasizes the challenge of detecting unusual behaviors associated with legitimate utilities in the context of cyber threats.
Search