Pay2Key IFEO Debugger Hijack: agntsvc.exe Redirected to Systray.exe

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects a registry modification where the Image File Execution Options (IFEO) 'Debugger' value for the agent service process 'agntsvc.exe' is set to 'Systray.exe'. This technique is used by the Pay2Key ransomware to hijack the process execution flow, potentially to impair security or backup services.