Pay2Key Sandbox Evasion via timeout.exe /t 10 from SysWOW64 cmd.exe

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•4

Detects Pay2Key ransomware attempting sandbox evasion by executing the Windows timeout utility with a 10-second delay, initiated from the SysWOW64 command prompt.