Pay2Key Avast Directory Enumeration Before DLL Hijacking Payload Drop

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•0

Detects instances where a process attempts to access the Avast antivirus directory with SYNCHRONIZE and FILE_EXECUTE flags. This behavior is a known precursor activity for Pay2Key ransomware, which performs security software discovery prior to executing a malicious DLL payload.