Pay2Key Avast Directory Probe Before DLL Sideloading

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects the Pay2Key ransomware's reconnaissance behavior of probing the Avast Software installation directory using a 7-Zip self-extracting executable as a precursor to performing DLL sideloading of a malicious powrprof.dll file.