I analyzed the DLL in Ghidra.
It is a 64-bit PE compiled with Visual Studio 2022.
The DLL imports Wininet and connects to the GitHub API (likely for pattern/offset fetching).
I found no references to Discord, Chrome, browser paths, wallet paths, or persistence-related APIs.
CreateFileA is used with GENERIC_READ and OPEN_EXISTING only (no file writing).
There are no imports like OpenProcess, WriteProcessMemory, or CreateRemoteThread in the DLL itself — so it appears to be only the injected payload, not the injector.
No Telegram Bot API usage was found (only plain t.me links as strings).
Based on static analysis, it looks like a typical internal cheat DLL rather than a stealer or RAT.
Disclaimer: I do not take any responsibility if you use this DLL based on my analysis and your computer gets infected with a virus. I am new to these matters, so I might have missed some viruses.