Is doze paid v2.exe safe?
Thirteen of 75 engines flagged this unsigned executable, including three independent tier-1 detections, although one sandbox run did not confirm overt malware behavior.
The unsigned executable drew 13 detections from 75 engines, with three independent tier-1 engines raising concern. Labels include USBLH826 and DefenderDisabler, but family agreement is weak, and the single completed sandbox run found no offensive-only activity or known-bad contacted endpoint.
32bfbab9a2b8e6369f…4e9155e02076aaRecommended next actions
Before running
Do not run it until the source and publisher can be verified independently.
If you already ran it
Stop using it, scan the device, and watch for unexpected behavior or security alerts. Get a fresh copy from the developer's official site or an official app store.
Intelligence
The saved assessment, checked against the scan evidence and recorded coverage.
The reasoning behind this verdict
This section explains the evidence supporting the verdict and keeps conflicting or missing signals visible.
The unsigned executable drew 13 detections from 75 engines, with three independent tier-1 engines raising concern. Labels include USBLH826 and DefenderDisabler, but family agreement is weak, and the single completed sandbox run found no offensive-only activity or known-bad contacted endpoint.
The strongest concern is that 13 of 75 engines detected the file, including three independent tier-1 detections. TrendMicro associated it with USBLH826, while Malwarebytes named DefenderDisabler, but the broader labels are inconsistent and no strong tier-1 family consensus exists. The executable is unsigned and has no established publisher history, leaving no provenance-based reassurance. One completed sandbox run did not issue a malicious result or observe offensive-only techniques, and the observed Akamai endpoint was not present in the malicious or suspicious host cache. External researcher-curated sources and similar-file history supplied no corroboration, leaving meaningful but unresolved risk.
What We Detected
Thirteen of 75 antivirus engines flagged the executable. Three independent tier-1 engines contributed detections: Sophos reported a generic malware label, Symantec reported a high-confidence machine-learning attribute, and TrendMicro associated the sample with USBLH826. Malwarebytes additionally used the label DefenderDisabler, but there is no strong agreement on one malware family.
Threat Behavior
The executable is unsigned and lacks an established signer history. One completed sandbox run recorded four broadly applicable techniques but no offensive-only techniques, no persistence indicators, and no malicious sandbox result. The observed Akamai domain and associated IP were covered by the host-reputation check, which found no known-malicious or suspicious endpoint; this does not resolve the static detections.
What To Do Now
Do not run the file on a production or personal system unless its origin and intended function can be independently verified. Keep endpoint protection enabled, quarantine the file, and obtain a fresh copy from an official source if it is expected software.
Where this verdict could be wrong4 caveats
- The single completed sandbox returned a clean result and recorded no offensive-only techniques, so the static detections were not dynamically confirmed.
- Avira and F-Secure were undetected, while several other tier-1 engines timed out; the high-trust evidence is mixed rather than unanimous.
- contactedHosts.inspected=1 found no known-malicious or suspicious endpoint among the observed Akamai domain/IP contact.
- The family labels are inconsistent, and engines.tier1FamilyConsensus.strong=false.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- One completed sandbox produced no malicious verdict
- No offensive-only behavior techniques were recorded
- No known-malicious or suspicious observed endpoint was found
- No malicious dropped child was reported
- No YARAify, CIRCL, or MalwareBazaar corroboration
- 13/75 antivirus detections
- Three independent tier-1 detections
- Unsigned Win32 executable
- DefenderDisabler and USBLH826 labels
- No established signer history
- Filename provides no recognizable publisher or product provenance
Quarantine the executable and verify its source before any use; if it cannot be matched to an official release, delete it. Keep antivirus and endpoint protection enabled.
Coverage & freshness
Complete means the check returned a usable result. It does not mean the file is safe.
Antivirus
Complete13 of 75 engines flagged the file.
Sandbox
Complete1 isolated runtime environment contributed observations.
Network
Partial1 of 2 contacted hosts were cross-checked; coverage is incomplete.
YARA
CompleteRule evaluation completed with no recorded matches.
External intel
Complete3 of 3 independent reference sources completed.
Behavior
Plain-English impact first, then the observed runtime evidence.
Runtime flight recorder
Capture complete- 1isolated sandbox run
- 4MITRE ATT&CK techniques
- 3spawned processes
- 2network contacts
- 1filesystem & mutex artifacts
What this file does
Observed actions and their security significance
High concern: Used an input-capture technique that can record credentials or keystrokes.
Moderate concern: Communicated over a common application protocol; malware can use this for command-and-control.
Moderate concern: Checked the environment for virtualisation or analysis tools.
Note: Loads extra code modules while running.
These are observed capabilities from an isolated analysis. A technique does not prove malicious intent on its own, and the file never ran on your device.
Attack story
Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.
Input file
The submitted object
- FileObserved
doze paid v2.exe
32bfbab9a2b8e6369f421cf8d3b4e6b0e2e48d0f242e6bb7784e9155e02076aa
01Uploaded file
Processes
Runtime execution
- ProcessObserved
Observed process
"C:\Users\<USER>\Desktop\ViseViaPremium.exe"
02Isolated runtime analysis - ProcessObserved
Observed process
"C:\Users\user\Desktop\ViseViaPremium.exe"
03Isolated runtime analysis - +1 more recorded observation in Analyst mode
Files
Created or changed
- Written fileObserved
Connect
\Device\ConDrv\\Connect
04Isolated runtime analysis
Network
Hosts contacted
- Contacted hostObserved
a1672.dscr.akamai.net
Contact observed during runtime.
05Isolated runtime analysis - Contacted hostObserved
162.159.36.2
Contact observed during runtime.
06Isolated runtime analysis - +1 more recorded observation in Analyst mode
6 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- a1672.dscr.akamai.net
- 162.159.36.2
- \Device\ConDrv\\Connect
Detection & Forensics
Consensus, attribution, signatures, code structure, prevalence, and identity.
Evidence integrity
Chain of custody for the facts preserved in this report.
- 0rule hits recorded
- 13 / 75engines flagged
- 80sources in submission history
Why these facts are shown
Each statement identifies whether it was directly recorded or derived from saved scan facts.
- 01
13 of 75 antivirus engines flagged the file, including alibabacloud and Antiy-AVL.
Verdict inputView chapterProvenanceObservedSourceAntivirus analysisObserved at - 02
The hash has been submitted 97 times from 80 sources.
ProvenanceDerivedSourceSaved report factsObserved at - 03
Scanned file: doze paid v2.exe — 32bfbab9a2b8e6369f421cf8d3b4e6b0e2e48d0f242e6bb7784e9155e02076aa
ProvenanceObservedSourceUploaded fileObserved at - 04
Observed process — "C:\Users\<USER>\Desktop\ViseViaPremium.exe"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 05
Observed process — "C:\Users\user\Desktop\ViseViaPremium.exe"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 06
File written: Connect — \Device\ConDrv\\Connect
ProvenanceObservedSourceIsolated runtime analysisObserved at - 07
Contacted host: a1672.dscr.akamai.net — Contact observed during runtime.
ProvenanceObservedSourceIsolated runtime analysisObserved at - 08
Contacted host: 162.159.36.2 — Contact observed during runtime.
ProvenanceObservedSourceIsolated runtime analysisObserved at
Detection sources at a glance
Category: generic-trojan
MalwareBazaar, YARAify, and CIRCL hashlookup completed and returned no entries for this hash.
YARA rules
No matchesThe rule pass completed without a saved public match.
13 of 75 engines flagged this file
View all 75 engine results
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Fingerprint and provenance
- File name
- doze paid v2.exe
- Format
- Win32 EXE
- Code signing
- No verified publisher
- Size
- 10.5 KB
- Last analyzed
- Sep 25, 2026, 4:07 PM UTC
32bfbab9a2b8e6369f421cf8d3b4e6b0e2e48d0f242e6bb7784e9155e02076aaSafety & FAQ
Complete recovery guidance and answers for the next decision.
What to do now
We couldn't fully clear this file. Treat it with caution.
- Recovery step 01
Don't run it unless you're certain it came from a source you trust.
- Recovery step 02
Check where you got it — an unexpected attachment or a random download link is a red flag.
- Recovery step 03
If its origin cannot be confirmed, delete this file and use a fresh copy from a trusted source. Get a fresh copy from the developer's official site or an official app store.
- Recovery step 04
If you're still unsure, scan it again in a day or two — detections often catch up on newer files.
Safety FAQ
Direct answers grounded in the saved verdict and evidence in this report.
Is doze paid v2.exe safe, or is it malware?
What is doze paid v2.exe?
How many antivirus engines detected doze paid v2.exe?
I already downloaded and ran doze paid v2.exe — what should I do?
How do I remove doze paid v2.exe?
What kind of malware is doze paid v2.exe?
What is the SHA-256 hash of doze paid v2.exe?
How up to date is this analysis of doze paid v2.exe?
Community
Member reviews and reports for this exact file hash.