Pay2Key SFX Dropper Persistence via Run Key with browser.exe in GUID AppData Folder

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects Pay2Key ransomware establishing persistence by modifying Windows registry Run keys to execute a file named 'browser.exe' located within a GUID-named subdirectory inside the user's AppData\Local folder. This behavior is indicative of multi-stage SFX archive deployment.