Pay2Key 7za.exe Extracting data2.bin into Avast Directory for DLL Sideloading

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•6

This rule detects the use of 7za.exe to extract specific files (data2.bin) from an archive using a hardcoded password while located within an Avast Software directory. This behavior is indicative of potential malicious activity involving the tampering or extraction of security software components or data.