Pay2Key Persistence via GUID-Named browser.exe in HKLM Run Key
Detects Pay2Key ransomware establishing persistence by modifying the HKLM Run registry key to execute a browser.exe file located in a GUID-named subdirectory within AppData\Local.
YARA-L
Detects Pay2Key ransomware establishing persistence by modifying the HKLM Run registry key to execute a browser.exe file located in a GUID-named subdirectory within AppData\Local.
Already have an account?