Pay2Key Avast Directory Probe for Conditional DLL Sideloading

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•3

Detects behavior consistent with the Pay2Key ransomware, which checks for the presence of Avast security software directories, verifies SYSTEM account access via registry queries, and performs subsequent DLL sideloading by dropping 'powrprof.dll' into the Avast application folder.