Every download on this site, and the programs and DLLs inside the app packages, is checked when a release is published and again every week with two online multi-engine scanners, VirusTotal and MetaDefender, with the Kaspersky Threat Intelligence Portal, and with two sandboxes that run the file and rate what it does: Hybrid Analysis and Triage. This page lists the latest result for each file, a link to the full report and the file’s SHA-256, so you can check it yourself.
VirusTotal 0/72, for example, means none of the 72 engines that gave a verdict flagged the file. Engines that do not support the file type are not counted.
MetaDefender 0/21 reads the same way for MetaDefender’s engines.
Kaspersky: clean is Kaspersky’s verdict for the file: clean, adware or other, malware, or no verdict when Kaspersky has no data on it yet.
Hybrid Analysis and Triage are sandboxes. Hybrid Analysis gives a verdict (no specific threat, suspicious or malicious) and a threat score out of 100; Triage gives a score from 1 (nothing malicious seen) to 10 (known malware). Sandboxes rate behaviour, so tools that read and write game files can score above the minimum without being harmful.
More from VirusTotal under a file lists extra details when VirusTotal has them: the most common threat label, sandbox verdicts, matching community YARA and Sigma rules, the code signature, and the behaviours and MITRE ATT&CK techniques its sandboxes saw.
An engine result marked heuristic (machine-learning) — no signature match comes from a model that rates how a file looks, or from a reputation label for a file it has rarely seen, not from a match with known malware.
In progress: the file was submitted and the results are not in yet. Not set up or not scanned yet: there is no automatic result for that scanner; the “Scan it yourself” links still work.
The report link shows every engine’s verdict and the date of the scan.
CrystalWorkshop, PulseDepot and Crux are free tools that are not code-signed. Some engines rate unsigned programs from small publishers as suspicious by heuristics, that is by how a program looks rather than by a known threat. The standalone Crux build is a version.dll that sits beside the game executable, so Windows loads it together with the game. Malware uses the same loading technique, so some engines flag any version.dll that does not come from Microsoft.
A result from one to three engines with generic names (words like Heur, Generic, ML, Suspicious or Unsafe) is usually such a false positive. Many engines agreeing on one named threat is not, and neither is a file whose SHA-256 differs from the one listed here: in either case, do not run the file, and report it.
At the moment, Microsoft Defender reports Trojan:Win32/Wacatac.C!ml for the Windows programs and for Crux.dll; no other engine reports it. The !ml ending marks a machine-learning guess, which Defender often makes for new, unsigned files, not a match with known malware. It has been reported to Microsoft as a false positive.
Compare the SHA-256. After downloading, compute the file’s SHA-256 and compare it with the value on the Downloads page and below. Every character must match.
Windows (PowerShell):Get-FileHash .\file.zip
Linux:sha256sum file.zip
Look the SHA-256 up. The Scan it yourself links under each file search VirusTotal, MetaDefender, Kaspersky, Jotti, Hybrid Analysis, Triage and Filescan.io for that SHA-256. A lookup uploads nothing. If a service does not know the file yet, you can upload the file to it yourself.
Check the extracted files. The programs and DLLs inside the PulseDepot and CrystalWorkshop packages (including the DXVK d3d9.dll that comes with CrystalWorkshop) are listed on their own, so you can also compare what you extracted.
If a scanner names a threat, or a SHA-256 does not match, open a problem report for the app or mod the file belongs to (choose a form on GitHub). Include the file name, the version, the SHA-256 you got and the link to the scan report. Every release card and mod page also has a Report a problem button that fills in the version for you.
MITRE ATT&CK techniques T1071 Yara detections observed in process dumps, payloads or dropped files, T1064 Executes commands using a shell command-line interpreter, T1543.002 Executes the "systemctl" command used for controlling the systemd system and service manager, T1564.001 Creates hidden files, links and/or directories, T1518.001 Uses the "uname" system call to query kernel version information (possible evasion)
MITRE ATT&CK tactics Execution (1), Persistence (2), Privilege Escalation (2), Stealth (3), Discovery (2), Command and Control (1)
Behaviour rules procmem_yara, May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory), Uses the "uname" system call to query kernel version information (possible evasion), Executes commands using a shell command-line interpreter, Executes the "systemctl" command used for controlling the systemd system and service manager, Classification label
MITRE ATT&CK techniques T1071 Binary file triggered YARA rule, T1064 Executes commands using a shell command-line interpreter, T1059.004 Sample contains strings that are potentially command strings, T1543.002 Executes the "systemctl" command used for controlling the systemd system and service manager, T1497 Contains symbols related to standard C library sleeps (sometimes used to evade sandboxing), T1564.001 Creates hidden files, links and/or directories, T1027.008 Sample has stripped symbol table, T1599.001 Sample and/or dropped files contain functionality for network address and service translation
Behaviour rules binary_yara, drops_files, writes_files, reads_files, Contains symbols related to standard C library sleeps (sometimes used to evade sandboxing), Classification label
Sigma rules critical 0 · high 1 · medium 3 · low 0 — Potential System DLL Sideloading From Non System Locations, Rundll32 Spawned Via Explorer.EXE, Unsigned DLL Loaded by Windows Utility, Sysmon File Executable Creation Detected
Code signature not signed
MITRE ATT&CK techniques T1082 Collects information to fingerprint the system, T1012 Collects information to fingerprint the system, T1071 Yara detections observed in process dumps, payloads or dropped files, T1562 Manipulated process mitigation policies (CFG/DEP) from dynamically allocated (unbacked) memory, T1055 Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching, T1033 Queries process token information to check for Administrator privileges or UAC elevation status, T1069 Performs high-volume NtQueryInformationToken calls for TokenUser and TokenGroups, indicative of wiper/ransomware checking whether it has write permission to each file, T1574 A DLL was loaded from a suspicious directory
MITRE ATT&CK tactics Execution (2), Persistence (2), Privilege Escalation (3), Stealth (7), Discovery (6), Command and Control (1), Impact (1)
Sigma rules critical 0 · high 1 · medium 0 · low 0 — Potential System DLL Sideloading From Non System Locations
Code signature DXVK · version 10.0.17763.1 (WinBuild.160101.0800)
MITRE ATT&CK techniques T1033 Queries process token information to check for Administrator privileges or UAC elevation status, T1082 Queries process token information to check for Administrator privileges or UAC elevation status, T1071 The PE file contains an overlay, T1055 Contains .tls (Thread Local Storage) section, T1574 A DLL was loaded from a suspicious directory, T1027 The binary contains an unknown PE section name indicative of packing, T1027.002 The binary contains an unknown PE section name indicative of packing, T1542.003 May use bcdedit to modify the Windows boot settings
MITRE ATT&CK tactics Execution (1), Persistence (2), Privilege Escalation (1), Stealth (12), Discovery (5), Command and Control (1)
Behaviour rules privilege_elevation_check, dllload_suspicious_directory, antianalysis_tls_section, packer_unknown_pe_section_name, contains_pe_overlay, Sigma detected: Potential System DLL Sideloading From Non System Locations
VirusTotal 1/71ReportFlagged by Microsoft (Trojan:Win32/Wacatac.C!ml; heuristic (machine-learning) — no signature match; engine 1.26090, updated 2026-10-23)
Hybrid Analysis: no verdictReportSandbox: Windows 10 64 bit
Triage
Triage: not set up
Scan date
More from VirusTotal
Threat label trojan.
Tags peexe, 64bits
Crowdsourced YARA rules none matched
Sigma rules none matched
Code signature CrystalWorkshop · version 0.1.0-alpha
MITRE ATT&CK techniques T1082 Attempts to query display device information, possibly to determine if the process is running in a virtualized environment, T1012 Collects information to fingerprint the system, T1562 Manipulated process mitigation policies (CFG/DEP) from dynamically allocated (unbacked) memory, T1055 Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching, T1033 Queries process token information to check for Administrator privileges or UAC elevation status, T1069 Performs high-volume NtQueryInformationToken calls for TokenUser and TokenGroups, indicative of wiper/ransomware checking whether it has write permission to each file, T1553.002 Authenticode signature is invalid, T1036 Authenticode signature is invalid
Hybrid Analysis: no specific threatReportSandbox: Windows 10 64 bit
Triage
Triage: not set up
Scan date
More from VirusTotal
Threat label trojan.
Tags peexe, 64bits
Crowdsourced YARA rules none matched
Sigma rules none matched
Code signature CrystalWorkshop · version 0.1.0-alpha
MITRE ATT&CK techniques T1071 Binary file triggered YARA rule, T1553.002 Authenticode signature is invalid, T1036 Authenticode signature is invalid, T1055 Contains .tls (Thread Local Storage) section, T1574 A DLL was loaded from a suspicious directory, T1027 The PE file contains TLS callbacks which execute before the entry point and before debugger attachment, commonly used by packers for anti-analysis or pre-EP decryption, T1553 Authenticode signature is invalid, T1082 Queried the FIPS cryptography policy, can be used to adapt C2 network encryption or by legitimate encryption software
MITRE ATT&CK tactics Execution (1), Privilege Escalation (1), Stealth (4), Discovery (1), Command and Control (1), Defense Impairment (2)
VirusTotal 1/63ReportFlagged by Microsoft (Trojan:Win32/Wacatac.C!ml; heuristic (machine-learning) — no signature match; engine 1.26090, updated 2026-10-23)
Hybrid Analysis: no verdictReportSandbox: Windows 10 64 bit
Triage
Triage: not set up
Scan date
More from VirusTotal
Threat label trojan.
Tags peexe, 64bits
Crowdsourced YARA rules none matched
Sigma rules none matched
Code signature PulseDepot · version 0.1.0-beta
MITRE ATT&CK techniques T1082 Attempts to query display device information, possibly to determine if the process is running in a virtualized environment, T1012 Collects information to fingerprint the system, T1562 Manipulated process mitigation policies (CFG/DEP) from dynamically allocated (unbacked) memory, T1055 Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching, T1071 Binary file triggered YARA rule, T1033 Queries process token information to check for Administrator privileges or UAC elevation status, T1069 Performs high-volume NtQueryInformationToken calls for TokenUser and TokenGroups, indicative of wiper/ransomware checking whether it has write permission to each file, T1553.002 Authenticode signature is invalid
Sigma rules critical 0 · high 0 · medium 2 · low 0 — Rundll32 Spawned Via Explorer.EXE, Unsigned DLL Loaded by Windows Utility
Code signature not signed
MITRE ATT&CK techniques T1082 Repeatedly opens the MountPointManager device to enumerate drive letters and resolve volume paths to discover all attached drives and network shares, T1071 Yara detections observed in process dumps, payloads or dropped files, T1033 Queries process token information to check for Administrator privileges or UAC elevation status, T1055 Writes to the memory another process, T1574 A DLL was loaded from a suspicious directory, T1064 Executes commands using a shell command-line interpreter, T1543.002 Executes the "systemctl" command used for controlling the systemd system and service manager, T1564.001 Creates hidden files, links and/or directories
MITRE ATT&CK tactics Execution (2), Persistence (2), Privilege Escalation (3), Stealth (5), Discovery (4), Command and Control (1)
VirusTotal 1/71ReportFlagged by Microsoft (Trojan:Win32/Wacatac.C!ml; heuristic (machine-learning) — no signature match; engine 1.26090, updated 2026-10-22)
Hybrid Analysis: suspiciousReportFlagged by Hybrid Analysis (Trojan_Win32_Wacatac_C_ml)Threat score: 76/100Family: Trojan_Win32_Wacatac_C_mlSandbox: Windows 10 64 bit
Triage
Triage: not set up
Scan date
More from VirusTotal
Threat label trojan.
Tags pedll
Crowdsourced YARA rules none matched
Sigma rules none matched
Code signature CrystalWorkshop · version 0.1.0
MITRE ATT&CK techniques T1082 query environment variable, T1129 link function at runtime on Windows, T1027 encrypt data using AES via x86 extensions, T1057 enumerate threads, T1574 linked against MinHook, T1083 get common file path
Behaviour rules check for software breakpoints, query environment variable, link function at runtime on Windows, inspect section memory permissions, set thread local storage value, encrypt data using AES via x86 extensions
Hybrid Analysis: no specific threatReportSandbox: Windows 10 64 bit
Triage
Triage: not set up
Scan date
More from VirusTotal
Tags pedll
Crowdsourced YARA rules none matched
Sigma rules none matched
Code signature CrystalWorkshop · version 0.1.0
MITRE ATT&CK techniques T1027 encrypt data using AES via x86 extensions, T1129 parse PE header, T1574 linked against MinHook, T1083 check if file exists, T1082 query environment variable, T1057 enumerate threads
Behaviour rules resume thread, encrypt data using AES via x86 extensions, compiled with rust, encode data using XOR, check for software breakpoints, print debug messages
MITRE ATT&CK techniques T1071 Binary file triggered YARA rule, T1064 Executes commands using a shell command-line interpreter, T1059.004 Sample contains strings that are potentially command strings, T1543.002 Executes the "systemctl" command used for controlling the systemd system and service manager, T1497 Contains symbols related to standard C library sleeps (sometimes used to evade sandboxing), T1564.001 Creates hidden files, links and/or directories, T1027.008 Sample has stripped symbol table, T1599.001 Sample and/or dropped files contain functionality for network address and service translation
Behaviour rules binary_yara, drops_files, writes_files, reads_files, Contains symbols related to standard C library sleeps (sometimes used to evade sandboxing), Classification label
Sigma rules critical 0 · high 1 · medium 2 · low 0 — Potential System DLL Sideloading From Non System Locations, Rundll32 Spawned Via Explorer.EXE, Unsigned DLL Loaded by Windows Utility
Code signature not signed
MITRE ATT&CK techniques T1082 Attempts to query display device information, possibly to determine if the process is running in a virtualized environment, T1012 Collects information to fingerprint the system, T1129 Loads a new DLL where the caller address originates from dynamically allocated (unbacked) memory, T1106 Attempted to spawn a new child process from dynamically allocated (unbacked) memory, T1059 Loads a new DLL where the caller address originates from dynamically allocated (unbacked) memory, T1202 Uses suspicious command line tools or Windows utilities, T1562 Manipulated process mitigation policies (CFG/DEP) from dynamically allocated (unbacked) memory, T1055 Attempted to spawn a new child process from dynamically allocated (unbacked) memory
VirusTotal 1/71ReportFlagged by Microsoft (Trojan:Win32/Wacatac.C!ml; heuristic (machine-learning) — no signature match; engine 1.26090, updated 2026-10-22)
Hybrid Analysis: suspiciousReportFlagged by Hybrid Analysis (Trojan_Win32_Wacatac_C_ml)Threat score: 76/100Family: Trojan_Win32_Wacatac_C_mlSandbox: Windows 10 64 bit
Triage
Triage: not set up
Scan date
More from VirusTotal
Threat label trojan.
Tags pedll
Crowdsourced YARA rules none matched
Sigma rules none matched
Code signature CrystalWorkshop · version 0.1.0
MITRE ATT&CK techniques T1082 query environment variable, T1129 link function at runtime on Windows, T1027 encrypt data using AES via x86 extensions, T1057 enumerate threads, T1574 linked against MinHook, T1083 get common file path
Behaviour rules check for software breakpoints, query environment variable, link function at runtime on Windows, inspect section memory permissions, set thread local storage value, encrypt data using AES via x86 extensions
Hybrid Analysis: no specific threatReportSandbox: Windows 10 64 bit
Triage
Triage: not set up
Scan date
More from VirusTotal
Tags pedll
Crowdsourced YARA rules none matched
Sigma rules none matched
Code signature CrystalWorkshop · version 0.1.0
MITRE ATT&CK techniques T1027 encrypt data using AES via x86 extensions, T1129 parse PE header, T1574 linked against MinHook, T1083 check if file exists, T1082 query environment variable, T1057 enumerate threads
Behaviour rules resume thread, encrypt data using AES via x86 extensions, compiled with rust, encode data using XOR, check for software breakpoints, print debug messages
VirusTotal 1/63ReportFlagged by Microsoft (Trojan:Win32/Wacatac.C!ml; heuristic (machine-learning) — no signature match; engine 1.26090, updated 2026-10-23)
Hybrid Analysis: no verdictReportSandbox: Windows 10 64 bit
Triage
Triage: not set up
Scan date
More from VirusTotal
Threat label trojan.
Tags peexe, 64bits
Crowdsourced YARA rules none matched
Sigma rules none matched
Code signature PulseDepot · version 0.1.0-beta
MITRE ATT&CK techniques T1082 Attempts to query display device information, possibly to determine if the process is running in a virtualized environment, T1012 Collects information to fingerprint the system, T1562 Manipulated process mitigation policies (CFG/DEP) from dynamically allocated (unbacked) memory, T1055 Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching, T1071 Binary file triggered YARA rule, T1033 Queries process token information to check for Administrator privileges or UAC elevation status, T1069 Performs high-volume NtQueryInformationToken calls for TokenUser and TokenGroups, indicative of wiper/ransomware checking whether it has write permission to each file, T1553.002 Authenticode signature is invalid
VirusTotal 1/71ReportFlagged by Microsoft (Trojan:Win32/Wacatac.C!ml; heuristic (machine-learning) — no signature match; engine 1.26090, updated 2026-10-22)
Hybrid Analysis: suspiciousReportFlagged by Hybrid Analysis (Trojan_Win32_Wacatac_C_ml)Threat score: 76/100Family: Trojan_Win32_Wacatac_C_mlSandbox: Windows 10 64 bit
Triage
Triage: not set up
Scan date
More from VirusTotal
Threat label trojan.
Tags pedll
Crowdsourced YARA rules none matched
Sigma rules none matched
Code signature CrystalWorkshop · version 0.1.0
MITRE ATT&CK techniques T1082 query environment variable, T1129 link function at runtime on Windows, T1027 encrypt data using AES via x86 extensions, T1057 enumerate threads, T1574 linked against MinHook, T1083 get common file path
Behaviour rules check for software breakpoints, query environment variable, link function at runtime on Windows, inspect section memory permissions, set thread local storage value, encrypt data using AES via x86 extensions
Hybrid Analysis: no specific threatReportSandbox: Windows 10 64 bit
Triage
Triage: not set up
Scan date
More from VirusTotal
Tags pedll
Crowdsourced YARA rules none matched
Sigma rules none matched
Code signature CrystalWorkshop · version 0.1.0
MITRE ATT&CK techniques T1027 encrypt data using AES via x86 extensions, T1129 parse PE header, T1574 linked against MinHook, T1083 check if file exists, T1082 query environment variable, T1057 enumerate threads
Behaviour rules resume thread, encrypt data using AES via x86 extensions, compiled with rust, encode data using XOR, check for software breakpoints, print debug messages
