File scan report
Verdict Safe
Is start.
A small Windows batch launcher script that none of the 61 antivirus engines that checked it flagged; in the sandbox it only set the console encoding, checked the Windows version…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
This script appears to be an ordinary launcher; use it alongside the software it came with and keep your security software enabled.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 61 flagged
- Flagged 0
- No detection 61
- No result 14
- Code signing Not applicable
- Test run Completed
- First seen 3mo ago
Chapter 02
Why we think so
0 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
In two sandbox runs it only switched the console to UTF-8, queried the Windows version and wrote a local log file. We saw no network activity, persistence or injection, and public malware databases have no listing for it.
None of the 61 antivirus engines that checked it flagged the script, and every major antivirus engine that analysed it reported it undetected. The two sandbox runs show ordinary launcher behaviour: cmd.exe running the script, chcp setting UTF-8 output, a Windows version query, and a log file written next to the script. The only network contact was the analysis machine's own certificate-service traffic, and our host reputation check found nothing malicious or suspicious. Malware databases and malware-specific YARA rules returned no hits. The file has been submitted by more than 1,200 different sources over about three months without any detection.
What We Detected
None of the 61 antivirus engines that checked it flagged this batch file. Among the engines that analysed it, all major antivirus engines, such as Kaspersky, ESET, Microsoft and BitDefender, reported it undetected. It has no listing in public malware databases and no malware-specific YARA matches. More than 1,200 different sources have submitted it.
Threat Behavior
In two sandbox runs the script only launched command-prompt instances, set the console code page to UTF-8, queried the Windows version and created a logs folder with a log file. We saw no persistence, registry changes, process injection or contact with outside hosts beyond the analysis machine's own background traffic.
What To Do Now
The evidence points to an ordinary launcher script, most likely bundled with a program. Run it only from the folder of the software it belongs to, and keep your antivirus enabled.
Where this verdict could be wrong2 caveats
- A batch launcher can fetch or run other programs depending on its environment. The sandbox runs only showed what happened in the test setting, not every path the script could take.
- An automated community post links this hash to public sample repositories, but that post does not report any detection or family.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No detections from any of the 75 antivirus engines, including every major antivirus engine that analysed the file
- Sandbox runs showed only console setup, a Windows version check and local logging
- No hits in public malware databases or malware-specific YARA rules
- Submitted by more than 1,200 different sources without any detection
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 2 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 2isolated sandbox runs
- 5sandbox rule tags
- 7spawned processes
- 0network contacts
- 6filesystem & mutex artifacts
What this file did when executed
This file was detonated in 2 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
5MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1033· Reads user info
- T1036
- T1064
- T1082· System recon
- T1202
Observed activity
Processes started
7Programs the file ran, with their command lines.
cmd.exe"C:\Windows\system32\cmd.exe" /c start /wait "" "C:\Users\<USER>\Desktop\start.bat"cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\<USER>\Desktop\start.bat"chcpchcp 65001cmd.exeC:\Windows\system32\cmd.exe /c vercmd.exeC:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\start.bat" "chcp.comC:\Windows\System32\chcp.com chcp 65001
Show all 7 entries for processes started
cmd.exeC:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ver
Files
6Files the file created, changed or deleted.
- Written
C:\Users\<USER>\Desktop\logs\start.log - Written
C:\Users\user\Desktop\logs - Written
C:\Users\user\Desktop\logs\start.log - Written
\Device\ConDrv\\Connect - Written
\Device\Null - Written
stdout
Sandbox background — not the file
2The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM host
eip-terr-na.cdp1.digicert.com.akahost.net
Files this sample writes at runtime
This file drops 3 children at runtime. None are currently flagged malicious in our cache. 3 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 89173798365a0fccd7a1…1334f1Not checkedno saved verdict
- 4fd7a3a4ca84e87a28dd…03cce9Not checkedno saved verdict
- 2b06cdf30ade079c57f6…1b6a21Not checkedno saved verdict
Chapter 04
Technical details
None of the 61 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 18, 2026, 11:17 PM UTC
- SHA-256
600d0e4ae34057349015d45c520795eb2f1e7c9b25fc5afa1330b41b4fa4b0e8- SHA-1
5db0317af667c07c42f566a83687224e761bf845- MD5
f5b0bf8c2005e460f54def7000fb9cc2
About this file
start.bat is a DOS batch file file of 9.8 kB.
- Type and size
- DOS batch file · 9.8 kB
- Signer
- Not applicable
- First seen
- Jul 11, 2026On VirusTotal.
- Submitted by
- 1,256 distinct sources
First scanned
Antivirus consensus
0 of 61 engines flagged this file
14 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-232 engines0flagged
- Low-trust11 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneNo result
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootNo result
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Widely uploaded, but first seen within the last six months. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is start.bat safe?
What is start.bat?
How many antivirus engines detected start.bat?
What is the SHA-256 hash of start.bat?
Is it safe to run start.bat?
How up to date is this analysis of start.bat?
Community
Member reviews and reports for this exact file hash.