Sauron Loader MSI Staging Files in C:\ProgramData\keyroll

Ibrahim Saud@tektrix

•updated 10 days ago•0•0•1

Detects the MSI installer (msiexec.exe) creating files within the 'C:\ProgramData\keyroll' directory, which is characteristic of the staging phase for the Sauron Loader DLL side-loading trio (rnpkeys.exe, rnp.dll, tdwp.dll).