MSI installer staging rnpkeys.exe+rnp.dll+tdwp.dll to ProgramData\keyroll

Ibrahim Saud@tektrix

•updated Sep 26, 2026•0•0•2

Detects the presence of MSI installer packages associated with the Sauron Loader malware, which stage malicious files (rnpkeys.exe, rnp.dll, and tdwp.dll) into the C:\ProgramData\keyroll directory to facilitate DLL side-loading.