File scan report
Verdict Safe
Is Bubble
Only Jiangmin flagged this older game archive with a generic label, while all major antivirus engines remained silent and the completed sandbox run found no malicious outcome.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Keep security protection enabled and use the archive only if it came from a source you trust. For added assurance, scan the extracted files individually before execution.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 66 flagged
- Flagged 1
- No detection 65
- No result 9
- Code signing Not applicable
- Test run Completed
- First seen 4y ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The single generic detection is confined to one less reliable engine, with none of the 66 antivirus engines that checked it providing major corroboration. One completed sandbox run launched the extracted game executable without a malicious verdict, although a defense-evasion mapping and unclassified extracted files warrant ordinary caution.
One of the 66 antivirus engines that checked it flagged the archive, and that finding came from Jiangmin as a generic HEQMK label. All 17 major antivirus engines that reported results were silent, creating a strong false-positive pattern. is a meaningful counter-signal, but it is isolated and lacks supporting detections or researcher-specific rules. Four extracted files have no saved verdict, and no complete contacted-host reputation result is available, so those areas remain unverified rather than clean.
What We Detected
Only 1 of the 66 antivirus engines that checked it flagged the archive. Jiangmin supplied the generic label Trojan.Generic.heqmk, while all 17 major antivirus engines that reported results produced no detection and no engine-family consensus formed.
Threat Behavior
One completed sandbox run extracted and launched BubbleGutsSim.exe without producing a malicious verdict. It recorded no persistence, process injection, or sample network contacts. The run did map T1562.001, associated with impairing defenses, but this was not corroborated by other hostile behavior. Four extracted files remain unclassified, and a complete host-reputation cross-check is unavailable.
What To Do Now
Keep security software enabled and obtain the archive from its original trusted distribution source. If its origin is uncertain, rescan the extracted executable and files before running them, particularly because the file it created verdict coverage is incomplete.
Where this verdict could be wrong3 caveats
- Jiangmin identified Trojan.Generic.heqmk, although no other engine corroborated that generic family label.
- The runtime mapping included T1562.001, which can indicate impairment of defenses, but the lone completed run produced no malicious verdict.
- Four extracted files lack saved verdicts, so their safety has not been independently established.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 1 of the 66 antivirus engines that checked it raised a detection, and it came from a less reliable engine.
- All 17 reporting major antivirus engines produced no detection.
- The completed sandbox run returned no malicious result.
- No persistence or process injection was recorded.
- No malware-specific researcher rules or malware-repository match corroborated the detection.
- Jiangmin reported a generic trojan label.
- The sandbox mapped behavior associated with impairing defenses.
- Four extracted files do not have saved classifications.
- No complete contacted-host reputation result is available.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 6sandbox rule tags
- 5spawned processes
- 0network contacts
- 10filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
6MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1056· Keylogging
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1497· Sandbox evasion
- T1562.001· Disables security
Observed activity
Processes started
5Programs the file ran, with their command lines.
BubbleGutsSim.exe"C:\Users\<USER>\AppData\Local\Temp\BubbleGutsSim.exe"unarchiver.exeC:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWow64\unarchiver.exe" "C:\Users\user\Desktop\download.zip"7za.exeC:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\z0ocwumr.chc" "C:\Users\user\Desktop\download.zip"cmd.exeC:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\z0ocwumr.chc\BubbleGutsSim.exe"BubbleGutsSim.exeC:\Users\user\AppData\Local\Temp\z0ocwumr.chc\BubbleGutsSim.exe
Files
6Files the file created, changed or deleted.
- Written
C:\Users\user\AppData\Local\Temp\unarchiver.log - Written
C:\Users\user\AppData\Local\Temp\z0ocwumr.chc - Written
C:\Users\user\AppData\Local\Temp\z0ocwumr.chc\BubbleGutsSim.exe - Written
C:\Users\user\AppData\Local\Temp\z0ocwumr.chc\data.win - Written
C:\Users\user\AppData\Local\Temp\z0ocwumr.chc\options.ini - Written
\Device\ConDrv\\Connect
Registry and auto-start
15Settings the file changed, including ways to start again after a restart.
- Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\BUBBLEGUTSSIM.EXE60F7F128004BAA00\Name - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\BUBBLEGUTSSIM.EXE60F7F128004BAA00\UsesMapper - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\MostRecentApplication\Name - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\MostRecentApplication\Id - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\MostRecentApplication\Version - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\DirectInput\MostRecentApplication\MostRecentStart
Show all 15 entries for registry and auto-start
- Set
0\GUID - Set
BUBBLEGUTSSIM.EXE60F7F128004BAA00\Name - Set
BUBBLEGUTSSIM.EXE60F7F128004BAA00\UsesMapper - Set
MostRecentApplication\Id - Set
MostRecentApplication\Version - Set
MostRecentApplication\MostRecentStart - Set
HKEY_CURRENT_USER\System\CurrentControlSet\Control\MediaProperties - Set
HKEY_CURRENT_USER\System\CurrentControlSet\Control\MediaProperties\PrivateProperties - Set
HKEY_CURRENT_USER\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\DirectInput
Mutexes
4Named locks a program uses so only one copy runs; malware families often reuse them.
DirectInput.{89521361-AA8A-11CF-BFC7-444553540000}DirectInput.{5944E682-C92E-11CF-BFC7-444553540000}\Sessions\1\BaseNamedObjects\DirectInput.{89521361-AA8A-11CF-BFC7-444553540000}\Sessions\1\BaseNamedObjects\DirectInput.{5944E682-C92E-11CF-BFC7-444553540000}
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Files this sample writes at runtime
This file drops 4 children at runtime. None are currently flagged malicious in our cache. 4 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 5e2053e3a2467d212c65…6c6328Not checkedno saved verdict
- a123e4eb4df03daa51f5…7c9a1bNot checkedno saved verdict
- 263f41539d1bef6ff13e…04f4deNot checkedno saved verdict
- a8eb2e491ea7fe49274d…dd4ba3Not checkedno saved verdict
Chapter 04
Technical details
1 of the 66 antivirus engines that checked it flags it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- JiangminTrojan.Generic.heqmk
File fingerprint
- Last analyzed
- Oct 14, 2026, 11:52 AM UTC
- SHA-256
71662a93a48fe9a01492979a24928fc026a849377cff6bb9b878c034c3b5342f- SHA-1
d87287148475e017c9d5649b9d02d612c1ed4ba8- MD5
b2ac6fcc9807409439da608d0aa9e482
About this file
BubbleGutsSimulator.zip is a ZIP file of 27.9 MB.
- Type and size
- ZIP · 27.9 MB
- Signer
- Not applicable
- First seen
- Nov 15, 2021On VirusTotal.
- Submitted by
- 88 distinct sources
First scanned
Antivirus consensus
1 of 66 engines flagged this file
9 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust12 engines1flagged
View all 75 engine results
- JiangminMalicious: Trojan.Generic.heqmk
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavNo result
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is BubbleGutsSimulator.zip safe?
What is BubbleGutsSimulator.zip?
How many antivirus engines detected BubbleGutsSimulator.zip?
What is the SHA-256 hash of BubbleGutsSimulator.zip?
Is it safe to open or extract BubbleGutsSimulator.zip?
How up to date is this analysis of BubbleGutsSimulator.zip?
Community
Member reviews and reports for this exact file hash.