File scan report
Verdict Safe
Is Oneclick-
Batch file shows zero engine detections and no malicious sandbox verdict despite rule flags.
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 60 flagged
- Flagged 0
- No detection 60
- No result 15
- Code signing Not applicable
- Test run Completed
- First seen 7mo ago
Chapter 02
Why we think so
2 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
All 60 antivirus engines that checked it returned clean results with no major or less reliable malicious flags. Sandbox execution produced no malicious verdict and contacted hosts carried no prior malicious reputation.
The file triggered two behavioural rules for UAC-bypass patterns and direct-IP contact, yet these remain unsupported by any engine detection or sandbox verdict. Medium prevalence across 381 sources over five months indicates established distribution without corresponding malicious reports. External intelligence sources returned no hits, and the single file it created also carries an unknown verdict. The combination of zero detections, clean sandbox outcome, and neutral host reputation outweighs the rule-based signals.
What We Detected
Zero of the 60 antivirus engines that checked it flagged the batch file. Sandbox analysis recorded techniques common in legitimate software only and no malicious verdict. Three external IPs were contacted, but none matched known-malicious entries in our cache.
Threat Behavior
The sample wrote log files and queried the Windows build number. No persistence mechanisms, registry modifications, or dropped malicious files it created were observed. Rules flagged a UAC-bypass pattern and direct-IP traffic, but these lack corroboration from engines or sandbox verdicts.
What To Do Now
Keep security software enabled. If the script's purpose is unclear, review its source and test in an isolated environment before broader use.
Where this verdict could be wrong2 caveats
- One of our behaviour rules fired on fltmc.exe invocation; rule-based may flag legitimate admin tooling.
- Community comments tag the file #malware and #ransomware despite zero engine detections.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/60 engines malicious
- Sandbox verdict clean
- Medium prevalence with no malicious reports
- No external intelligence hits
- Rule-based rule one of our behaviour rules triggered on fltmc invocation
- Direct-IP contact observed without domain names
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 6sandbox rule tags
- 11spawned processes
- 3network contacts
- 6filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
6MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1059· Runs commands
- T1064
- T1071· Application protocol
- T1083· Scans your files
- T1202
- T1573
Observed activity
Processes started
11Programs the file ran, with their command lines.
cmd.exe"C:\Windows\system32\cmd.exe" /c start /wait "" "C:\Users\<USER>\Desktop\Oneclick-V8.4.bat"cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\<USER>\Desktop\Oneclick-V8.4.bat"fltmccmd.exeC:\Windows\system32\cmd.exe /c curl -s -L https://raw.githubusercontent.com/QuakedK/Oneclick/main/Version.md | findstr /i "Latest_Version"curlcurl -s -L https://raw.githubusercontent.com/QuakedK/Oneclick/main/Version.mdfindstrfindstr /i "Latest_Version"
Show all 11 entries for processes started
cmd.exeC:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildregreg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildchcpchcp 65001cmd.exeC:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Oneclick-V8.4.bat" "fltMC.exeC:\Windows\System32\fltMC.exe fltmc
Network contacts
33 hosts, listed as 2 addresses, 1 link. Links show the host and path only.
- IP address
185.199.111.133 - IP address
104.18.20.213 - URL
http://r12.c.lencr.org/78.crl
Files
6Files the file created, changed or deleted.
- Written
C:\Oneclick Logs\Oneclick Log.txt - Written
C:\Oneclick Logs\Extra\WinVersion.txt - Written
C:\Oneclick Logs - Written
C:\Oneclick Logs\Extra - Written
\Device\ConDrv\\Connect - Written
\Device\Null
Sandbox background — not the file
2The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM host
162.159.36.2
Files this sample writes at runtime
This file drops 1 child at runtime. None are currently flagged malicious in our cache. 1 has no saved verdict and was not checked; that is missing coverage, not a finding.
- bd98457b6ac9dc5c0811…0f64fdNot checkedno saved verdict
Chapter 04
Technical details
None of the 60 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Aug 28, 2026, 12:10 AM UTC
- SHA-256
248e195707624862a4268cae02ff94c6b2cd8135afcb84324142249c494568bf- SHA-1
46647b9ba5eed25a7a4e4d30bb15ca568dcbd7a3- MD5
b3ea15bf4403b1a9e048e7908bac2db5
About this file
Oneclick-V8.4.bat is a DOS batch file file of 278.7 kB.
- Type and size
- DOS batch file · 278.7 kB
- Signer
- Not applicable
- First seen
- Mar 30, 2026On VirusTotal.
- Submitted by
- 381 distinct sources
First scanned
Antivirus consensus
0 of 60 engines flagged this file
15 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-231 engines0flagged
- Low-trust11 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneNo result
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootNo result
- XcitiumClean
- YandexClean
- ZillyaNo result
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.
Sample invoked a known UAC auto-elevation helper (fodhelper / eventvwr / sdclt / wsreset / cmstp / etc.) with custom arguments. These binaries are abused via registry-hijack UAC bypasses; legitimate software never calls them with arguments.
EvidenceC:\Windows\System32\fltMC.exe fltmc
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Oneclick-V8.4.bat safe?
What is Oneclick-V8.4.bat?
How many antivirus engines detected Oneclick-V8.4.bat?
What is the SHA-256 hash of Oneclick-V8.4.bat?
Is it safe to run Oneclick-V8.4.bat?
How up to date is this analysis of Oneclick-V8.4.bat?
Community
Member reviews and reports for this exact file hash.