Pay2Key Run Key Persistence via browser.exe in AppData GUID Folder

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•0

Detects the creation or modification of a Windows Registry run key ('browser') that points to an executable located in the AppData\Local directory. This behavior is indicative of an adversary establishing persistence by masquerading a malicious process as a browser.