LegionLoader 7z.exe Extracting data.dat in Traiolx Custom Utils Directory

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects the execution of 7-Zip (7z.exe) when launched from a specific directory path ('Traiolx Custom Utils') while operating on specific files named 'drata.dat' or 'data.dat'. This behavior is indicative of an adversary staging or archiving sensitive data for potential exfiltration.