Pay2Key Avast Directory Check and Registry SYSTEM Account Query via setup.cmd

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•2

Detects reconnaissance activity associated with Pay2Key ransomware, specifically sandbox or environment checks. This includes process lineage originating from 7ZipSfx temporary directories combined with registry queries for S-1-5-19 (SYSTEM account) or direct file system access to Avast installation directories to verify the presence of security software.