Pay2Key Registry Run Key Persistence via browser.exe in GUID AppData Path

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•2

Detects the creation or modification of a registry run key under the 'Run' hive where the target executable is located within a GUID-named subdirectory inside the user's AppData/Local folder. This pattern is commonly used by malicious software to maintain persistence by masquerading as a legitimate browser or application process.