rnpkeys.exe side-loaded from non-standard ProgramData path (Sauron Loader)

Ibrahim Saud@tektrix

•updated Sep 26, 2026•0•0•3

Detects the execution of 'rnpkeys.exe' originating from the 'C:\ProgramData\keyroll' directory, which is a non-standard location for executable files and may indicate malicious activity.