File scan report
Verdict Malicious
Is gaysense.
Twenty of the 70 antivirus engines that checked it flagged this unsigned executable, reinforced by three malware-specific YARA rules and observed defense-impairment behavior.
Read the whole reasonShow less
Strong evidence · Two or more major antivirus engines agree.
If you already ran it, follow the steps below.
What to do now4 steps
This file is harmful. Don't run it, and remove it.
If you haven't run it
Don't run this file. Delete it, then empty the Recycle Bin.
If you already ran it
Disconnect the device from the internet, then run a full antivirus scan. Microsoft Defender Offline (Windows Security > Virus & threat protection > Scan options) also finds malware that hides while Windows runs.
If you typed passwords on the device after running it, change them from another device you trust.
If the scan keeps finding it, or the device still acts strangely, scan again with a second-opinion scanner from another company; if that doesn't fix it, back up your personal files and reinstall Windows.
If you already ran it, do these in order.
If you opened or installed it
Avoid banking and sign-ins on that device until it is clean. These free MalwareTips guides walk you through it.
- Trojan removal guideClear steps for Windows, Mac and Android. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
20 of 70 flagged
- Flagged 20
- No detection 50
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 1mo ago
Chapter 02
Why we think so
6 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The file has substantial corroborated malware evidence: 20 of the 70 antivirus engines that checked it flagged it, including five major antivirus engines, and three malware-specific YARA rules matched. Although the sandbox did not record a malicious verdict and the observed hosts were not reputation-listed, those counter-signals do not outweigh the static detections and defense-impairment technique.
Twenty of the 70 antivirus engines that checked it flagged the executable, representing 14 independent detection sources after related products were consolidated. Five major antivirus engines detected it, with BitDefender identifying Yogi and Microsoft, ESET-NOD32, Ikarus, and Symantec supplying additional trojan, game-hack, or high-confidence labels. Three malware-specific YARA rules, including telebot_framework and VECT_Ransomware, independently reinforce the engine findings. Observation from the test run mapped T1562.001, indicating defense impairment, although the sample crashed and the sandbox did not issue an explicit malicious verdict. The file is unsigned and has only two known submitters, leaving no established publisher identity or widespread distribution to explain the detections as a routine false positive.
What We Detected
Twenty of the 70 antivirus engines that checked it flagged this Win32 executable. Five major antivirus engines detected it: BitDefender named Yogi, Microsoft named Sabsik, ESET-NOD32 identified a potentially unsafe game-hack pattern, Ikarus reported Krypt, and Symantec supplied a high-confidence machine-learning detection. The detections represent 14 independent sources after related products were consolidated.
Threat Behavior
Three malware-specific researcher rules matched, including telebot_framework and VECT_Ransomware. The test run also mapped T1562.001, a technique associated with impairing defenses, alongside debugger-evasion indicators. The observed run appears to have crashed and did not receive an explicit malicious sandbox judgment; no process injection or persistence was recorded. All four observed domains were covered by the available reputation check and none were listed as malicious or suspicious.
What To Do Now
Do not run or redistribute the executable. Keep security software enabled, quarantine or delete the file, and perform a full system scan if it was executed. If it came from a game-cheat or unofficial download source, remove related files and review recently installed software and account activity.
Where this verdict could be wrong4 caveats
- The only sandbox run produced no explicit malicious sandbox verdict and the sample appears to have crashed.
- All 4 observed domains were covered by the host-reputation check, with none listed as malicious or suspicious.
- No packing, high-entropy code, persistence indicators, injected processes, or previously confirmed malicious file it created was identified.
- The major antivirus engines do not strongly agree on one family; Yogi has only one major family vote.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- The completed host-reputation check covered all four observed domains and found no malicious or suspicious listings.
- The sandbox produced no explicit malicious judgment and recorded no process injection or persistence.
- No packer or abnormally high-entropy code section was identified.
- None of the three dropped files has a saved malicious determination.
- Twenty of the 70 antivirus engines that checked it detected the executable, including five major antivirus engines.
- Three malware-specific researcher rules matched, including Telebot- and ransomware-associated patterns.
- The test run identified behavior associated with impairing security defenses.
- The executable has no digital signature or identifiable publisher.
- Only two submitters are known, providing little evidence of legitimate widespread use.
- The file showed debugger-detection or analysis-evasion characteristics.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 17sandbox rule tags
- 1spawned processes
- 3network contacts
- 27filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Checked whether it was running on a test computer.
Note: Listed the programs running on the test computer.
Note: Talked to servers over the internet during the test run.
Note: Looked through folders on the test computer (most installers do this).
Note: Loaded extra code modules while running.
Note: Checked which security software was installed on the test computer.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as recording keystrokes; no keylogging was confirmed.
Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Threat context
How trojans work
A trojan pretends to be something useful or harmless so that you run it. Once open, it does its real job in the background, from stealing data to opening a back door or downloading more malware.
Bottom line:The disguise is the whole trick, so a trustworthy-looking name or icon means nothing.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 6: FileSeen in the test run
gaysense.exe
a0d52449b75bd144bfbb6e9d63b26e6c8a45f298510f83f70a830d48de4c99bf
Uploaded file
- 1
Processes
What ran
- Evidence 2 of 6: ProcessSeen in the test run
gaysense.exe
"C:\Users\user\Desktop\gaysense.exe"
Test run
- 2
Files
Created or changed
- Evidence 3 of 6: Written fileSeen in the test run
Logs
C:\ProgramData\Microsoft\Windows Security Health\Logs
Test run - Evidence 4 of 6: Written fileSeen in the test run
55a870c7-10c5-4006-958a-8c5c7961ed99
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\55a870c7-10c5-4006-958a-8c5c7961ed99
Test run - +1 more recorded observation
- 2
Network
Hosts contacted
- Evidence 5 of 6: Contacted hostSeen in the test run
www.msn.com.edgekey.net
Contacted during the test run.
Test run - Evidence 6 of 6: Contacted hostSeen in the test run
e592.d.akamaiedge.net
Contacted during the test run.
Test run - +1 more recorded observation
6 facts from the test run. See the full activity list.
Includes 17 mapped techniques, every process, file, registry and network entry and 3 dropped files.
Show the technical evidenceChapter 04
Technical details
20 of the 70 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 20
- BitDefender (major engine)Gen:Variant.Yogi.67905
- Emsisoft (major engine)Gen:Variant.Yogi.67905 (B)
- ESET-NOD32 (major engine)Win64/GameHack_AGen.AON potentially unsafe application
- GData (major engine)Gen:Variant.Yogi.67905
- Ikarus (major engine)Trojan.Win64.Krypt
- Microsoft (major engine)Trojan:Win32/Sabsik.EN.D!ml
- Symantec (major engine)ML.Attribute.HighConfidence
- ALYacGen:Variant.Yogi.67905
File fingerprint
- Last analyzed
- Oct 14, 2026, 2:14 AM UTC
- SHA-256
a0d52449b75bd144bfbb6e9d63b26e6c8a45f298510f83f70a830d48de4c99bf- SHA-1
310dfd00416972cf7fa1711f4985bdc054c985e8- MD5
060eb9cdb525729e4b874191d3719de2
About this file
gaysense.exe is a Win32 EXE file of 758.8 kB.
- Type and size
- Win32 EXE · 758.8 kB
- Signer
- UnsignedNo code signature.
- First seen
- Sep 19, 2026On VirusTotal.
- Submitted by
- 2 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 6.41 of 8
First scanned
Includes every engine result (74), 7 matched signature rules, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 8 questions people ask most about this file.
Is gaysense.exe a virus?
What is gaysense.exe?
How many antivirus engines detected gaysense.exe?
What should I do if I already ran gaysense.exe?
How do I remove gaysense.exe?
What kind of malware is gaysense.exe?
What is the SHA-256 hash of gaysense.exe?
How up to date is this analysis of gaysense.exe?
Community
Member reviews and reports for this exact file hash.