Pay2Key Polyglot setup.cmd IEX In-Memory Payload via Sysnative PowerShell

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects a malicious pattern often associated with Pay2Key where a Batch script executes PowerShell via the Sysnative folder to bypass redirection. The command uses -nop and iex to execute code directly from the script file content (using $env:0) in-memory, indicative of fileless execution techniques.