File scan report
Verdict Safe
Is Equilotl.
Only 1 of the 62 antivirus engines that checked it flagged this unsigned executable, using a generic less reliable label, while stronger scanners and corroborating intelligence…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Keep security protection enabled and prefer a copy obtained directly from the project's official release channel. If the current file came from an unknown source, verify its SHA-256 before running it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 62 flagged
- Flagged 1
- No detection 61
- No result 12
- Code signing Unsigned
- Test run Completed
- First seen 4mo ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Trapmine alone flagged the file with a generic machine-learning label; none of the major antivirus engines reported malware. A sandbox mapped possible process injection, but recorded no target process, malicious verdict, persistence, hostile child, or known-bad contacted host, making a false positive substantially more likely.
The detection pattern is weak: only 1 of the 62 antivirus engines that checked it flagged the sample, and that detector is less reliable with a generic machine-learning label. None of the major antivirus engines reported malware, and there is no family consensus. Evidence from the test run mapped T1055, but no injected process, precise technique, persistence mechanism, or malicious sandbox verdict was recorded. The complete reputation check for the three contacted domains and one contacted IP found no known-malicious or suspicious hosts. The file is unsigned, which reduces provenance assurance, but unpacked code, moderate prevalence, and the lack of malware-specific external corroboration favor a false-positive explanation.
What We Detected
Only 1 of the 62 antivirus engines that checked it flagged the executable. The sole detection came from Trapmine and used the generic label “malicious.moderate.ml.score”; no major antivirus engines identified malware and no named family consensus exists.
Threat Behavior
One completed sandbox run mapped activity to MITRE T1055, which can indicate process injection. However, it recorded no injected target process, no exact injection method, no persistence indicators, no malicious sandbox verdict, and no malicious file it created. The host-reputation check covered all three contacted domains and the one contacted IP and found none known to be malicious or suspicious; one additional domain was identified as sandbox background traffic rather than sample activity.
Additional Context
The executable is unsigned, so its publisher cannot be authenticated. The antivirus analysis found no packer, no high-entropy code, and no likely packing, while MalwareBazaar and YARAify supplied no malware-specific match. Conflicting community annotations are insufficient to outweigh the stronger structured evidence.
What To Do Now
Keep security software enabled and obtain the executable from the project's official release channel where possible. If its origin is uncertain, verify its SHA-256 with the publisher or test it in an isolated environment before routine use.
Where this verdict could be wrong3 caveats
- Runtime mapping includes T1055 Process Injection, although no target process or exact injection method was recorded.
- The executable is unsigned, so its publisher and provenance cannot be verified.
- One community annotation reports a malicious sandbox result, but another calls the same hash clean; neither is corroborated by the saved sandbox verdict or trusted engine detections.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the major antivirus engines reported malware.
- The sole detection was a generic label from a less reliable engine.
- The completed host-reputation check covered every observed sample contact and found no known-malicious or suspicious host.
- No malicious sandbox verdict, persistence indicator, or malicious file it created was recorded.
- The antivirus analysis found no packer, likely packing, or high-entropy code, and researcher intelligence produced no malware-specific match.
- The Windows executable is unsigned, so its publisher cannot be authenticated.
- The sandbox mapped possible process injection, although it did not identify a target process or exact method.
- Trapmine produced one generic machine-learning detection.
- Third-party researcher annotations conflict, with one reporting a malicious sandbox assessment.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 9sandbox rule tags
- 2spawned processes
- 3network contacts
- 6filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
9MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1036
- T1055· Process injection
- T1056· Keylogging
- T1071· Application protocol
- T1082· System recon
- T1090
- T1114
- T1573
- T1574· Execution hijack
Observed activity
Processes started
2Programs the file ran, with their command lines.
Equilotl.exe"C:\Users\<USER>\Desktop\Equilotl.exe"Equilotl.exe"C:\Users\user\Desktop\Equilotl.exe"
Network contacts
33 hosts, listed as 2 domains, 1 address. Links show the host and path only.
- Domain
api.github.com - Domain
edge.ds-c7114-microsoft.global.dns.qwilted-cds.cqloud.com - IP address
140.82.114.5
Files
2Files the file created, changed or deleted.
- Written
C:\Users\user\AppData\Roaming\Equicord - Deleted
C:\Users\<USER>\Desktop\Equilotl.exe.old
Registry and auto-start
15Settings the file changed, including ways to start again after a restart.
- Set
HKEY_CURRENT_USER\System\CurrentControlSet\Control\MediaProperties - Set
HKEY_CURRENT_USER\System\CurrentControlSet\Control\MediaProperties\PrivateProperties - Set
HKEY_CURRENT_USER\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\DirectInput - Set
HKEY_CURRENT_USER\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\DirectInput\VID_0627&PID_0001 - Set
HKEY_CURRENT_USER\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\DirectInput\VID_0627&PID_0001\Calibration - Set
HKEY_CURRENT_USER\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\DirectInput\VID_0627&PID_0001\Calibration\0
Show all 15 entries for registry and auto-start
- Set
HKEY_CURRENT_USER\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\DirectInput\VID_0627&PID_0001\DeviceInstances - Set
HKEY_CURRENT_USER\Software\Microsoft\DirectInput - Set
HKEY_CURRENT_USER\Software\Microsoft\DirectInput\EQUILOTL.EXE0000000000E88E00 - Set
HKEY_CURRENT_USER\Software\Microsoft\DirectInput\MostRecentApplication - Set
HKEY_CURRENT_USER\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\DirectInput\VID_0627&PID_0001\Calibration\0\GUID - Set
HKEY_CURRENT_USER\Software\Microsoft\DirectInput\EQUILOTL.EXE0000000000E88E00\Name - Set
HKEY_CURRENT_USER\Software\Microsoft\DirectInput\EQUILOTL.EXE0000000000E88E00\UsesMapper - Set
HKEY_CURRENT_USER\Software\Microsoft\DirectInput\MostRecentApplication\Name - Set
HKEY_CURRENT_USER\Software\Microsoft\DirectInput\MostRecentApplication\Id
Mutexes
4Named locks a program uses so only one copy runs; malware families often reuse them.
DirectInput.{89521361-AA8A-11CF-BFC7-444553540000}DirectInput.{5944E682-C92E-11CF-BFC7-444553540000}\Sessions\1\BaseNamedObjects\DirectInput.{89521361-AA8A-11CF-BFC7-444553540000}\Sessions\1\BaseNamedObjects\DirectInput.{5944E682-C92E-11CF-BFC7-444553540000}
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM host
a1672.dscr.akamai.net
Chapter 04
Technical details
1 of the 62 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- Trapminemalicious.moderate.ml.score
File fingerprint
- Last analyzed
- Oct 17, 2026, 7:57 AM UTC
- SHA-256
2fcb9ff0e8bf201a5304f02b3810a10a3229fe392c8972d47e95741c13f4dc5f- SHA-1
e9b7a18f034b2de57e2fb01ab548080b6994539e- MD5
e901278d6ab0972bf5db1224f30691bf
About this file
Equilotl.exe is a Win32 EXE file of 15.2 MB.
- Type and size
- Win32 EXE · 15.2 MB
- Signer
- UnsignedNo code signature.
- First seen
- Jun 3, 2026On VirusTotal.
- Submitted by
- 131 distinct sources
- Packer
- None detected
- Entropy
- 6.15 of 8
First scanned
Antivirus consensus
1 of 62 engines flagged this file
12 of the 74 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-114 engines0flagged
- Tier-232 engines0flagged
- Low-trust16 engines1flagged
View all 74 engine results
- TrapmineMalicious: malicious.moderate.ml.score
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastNo result
- Avast-MobileNo result
- AVGNo result
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavNo result
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaNo result
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrellixENSNo result
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaNo result
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely uploaded, but first seen within the last six months. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Equilotl.exe safe?
What is Equilotl.exe?
How many antivirus engines detected Equilotl.exe?
What is the SHA-256 hash of Equilotl.exe?
Is it safe to run Equilotl.exe?
How up to date is this analysis of Equilotl.exe?
Community
Member reviews and reports for this exact file hash.