LegionLoader: 7z.exe spawned by cmd.exe to unpack data.dat payload

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects the use of 7-Zip (7z.exe) executed via the command-line interpreter (cmd.exe) to interact with a specific data file named 'data.dat' associated with the 'Traiolx Custom Utils' project, which may indicate data staging or archival activities performed by an adversary.