Unknown
Our AI analyst is temporarily unavailable.
bbfe3a6d42ef76b4be…e3c422c0bdThe reasoning behind this verdict
The MT AI Engine weighs every signal from this scan — antivirus detections, sandbox behaviour, code signing, prevalence and historical matches — to reach a single, evidence-based verdict.
Our AI analyst is temporarily unavailable. Based on the raw antivirus data we have (2 malicious of 71 reporting engines), we can't commit to a verdict confidently — re-scan in a few minutes for the full AI assessment.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
AI arbiter unavailable (reason: grok_exception:This operation was aborted)
engines.tier1Malicious=0
engines.reporting=71
Wait a few minutes and re-scan for the full AI assessment before deciding.
What to do now
There isn't enough information to give this file a clear rating.
Be cautious — an unknown rating is not the same as a clean bill of health.
Only run it if it came directly from the official maker of the software.
When in doubt, don't open it — or scan it again later once it's more widely seen.
1 contradiction resolved by the scoring engine
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- 162.159.36.2
- C:\Users\<USER>\AppData\Local\Temp\genteert.dll
- C:\Users\<USER>\AppData\Local\Temp\gentee83.tmp
- C:\Users\<USER>\AppData\Local\Temp\gentee83\guig.dll
- C:\Users\<USER>\AppData\Local\Temp\gentee83\setup_temp.gea
- C:\Users\<USER>\AppData\Local\Temp\gentee83\coverPC.jpg
- C:\Users\<USER>\AppData\Local\Temp\gentee83
- C:\Program Files (x86)\Forza Horizon 6\_ci_gentee
- C:\Program Files (x86)\Forza Horizon 6
- ci589824390
- \Sessions\1\BaseNamedObjects\ci589824390
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache.
- 4ff3c7fa3947bf4719cc…bcce01Never scannednever seen before
- b666e6bd71eff3547fb2…31460aNever scannednever seen before
- 5d96f7c1e1d4c30e15f5…956623Never scannednever seen before
- 85cb016a61be38dca7e8…357465Never scannednever seen before
- 005c251c21d6a5ba1c32…8420aaNever scannednever seen before
- a7ee7af20b49a31764ac…7ec364Never scannednever seen before
- 92b14e891426d54302ed…6a7f48Never scannednever seen before
- 31cd36670f7ba226a2a4…baf633Never scannednever seen before
- c8ed921512f4aa3c950a…fd50fbNever scannednever seen before
- 133818badf5289e9f450…23efb1Never scannednever seen before
YARA & heuristic rule matches
One or more medium-severity heuristic rules matched. Not definitive, but the patterns match known malware behaviour.
Sample contacted 1 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.
Evidence162.159.36.2
2 detections across 75 engines
Section entropy & packers
Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Forensic fingerprint
- File name
- Forza Horizon 6 Setup.exe
- Size
- 8.31 MB
- MIME type
- (unknown)
- Detected type
- Win32 EXE
- SHA-256
- bbfe3a6d42ef76b4bed051c094e0dedfe9ef6b8978e668be12b439e3c422c0bd
- MD5
- ebc02b9a1268572d08abcee56aa93a30
- SHA-1
- 6af4d452146d0e1f69f7f684fe44d0e2fce6616e
- PE imphash
- d221b1dc8c3a08622f6512e7876527c8
- First seen (VT)
- 4/4/2026, 11:53:09 AM
- Last analysis (VT)
- 5/12/2026, 11:05:51 PM
- First scan (MalwareTips)
- 5/13/2026, 1:37:36 PM
- Last scan (MalwareTips)
- 5/13/2026, 1:37:35 PM
Safety FAQ
Common questions about Forza Horizon 6 Setup.exe, answered from the scan data above.
- We can't give Forza Horizon 6 Setup.exe a confident verdict yet — too few engines have an opinion on this exact file. Uncommon or brand-new files often show little coverage before vendors catch up, so treat it as untrusted: don't run it unless you're certain of the source.
- Forza Horizon 6 Setup.exe is a Windows executable program, about 8.3 MB. We identify a file by its cryptographic hash rather than its name, because the same filename can be reused by completely different files — the hash below is the reliable fingerprint.
- 2 of 75 antivirus engines flagged Forza Horizon 6 Setup.exe, 2 of them as outright malicious. A small number of detections can include false positives, so we weigh which engines flagged it and what else the file does, not just the raw count.
- The SHA-256 hash of Forza Horizon 6 Setup.exe is bbfe3a6d42ef76b4bed051c094e0dedfe9ef6b8978e668be12b439e3c422c0bd, and its MD5 is ebc02b9a1268572d08abcee56aa93a30. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.
- This report reflects the scan run on May 13, 2026. Because a file's hash never changes, the identity of Forza Horizon 6 Setup.exe is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.