7za.exe
Sources: 300M+ executions observed in the wild.
Summary
7-Zip standalone command-line archiver - compresses and extracts archive files. Frequently bundled in installers and used by attackers for data staging.
7za.exe is the 307th most commonly executed Windows program in EchoTrail's dataset, observed 31,701 times across enterprise environments. It typically runs from C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin and it is most often launched by dcconfig.exe.
Get this in your tools
The same record for 7za.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/7za.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin98.45%
- C:\Program Files\UEMS_CentralServer\bin0.72%
- C:\Program Files (x86)\Trend Micro\Client Server Security Agent\HostedAgent0.45%
- C:\Windows\LTSvc0.2%
- C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\zip0.06%
- C:\Program Files (x86)\Trend Micro\Client Server Security Agent\Temp\...0.03%
- C:\Users\...0.03%
- C:\Program Files (x86)\ROCCAT\ROCCAT SWARM\7-Zip0.02%
- D:\Program Files\ME_Secure_Gateway_Server\bin0.02%
- C:\Program Files\Pulseway\Patch0.01%
Top Hashes (SHA256)
- ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d99.18%
- 77613cca716edf68b9d5bab951463ed7fade5bc0ec465b36190a76299c50f1170.2%
- 6df56b3a664d8fe6ae6e3e0bbb57d435f0bc8edc30449de8ca65e897f0ef2b150.11%
- a28825f813ce77e0ce9fe043f4c2921fe0b9cd57083f703949a10ea53ca0e5ec0.08%
- a7096897dfbc985b18caaab7f844f667b69578a0d2fef87a6145045a151beee30.06%
- c40dccf30de1c58a526c21ee3bd5f17d84af678bfcba43a3b4d06d2cbd99a16d0.06%
- d03d8c5fc6af53a6635e5e65dd878b9d3a2addd74199054d999f6ed66f8e46b50.06%
- afbad9e84e63c2aae66f54c31f64418f9b0763b68233ad234cb781d204302fc20.05%
- 543caa1f96c5036b98ca1a258efd5306249c156afe54025faadbb6bdb284591b0.05%
- d993382b2b1a9e558ed74f79798baa50b78405a432b1a854a6ab7ce48c6241cd0.04%
Process Ancestry
Top Grandparents
- Creative Cloud.exe12.9%
- chrome.exe6.45%
- firefox.exe6.45%
- setup.exe4.84%
- cmd.exe3.23%
- RuntimeBroker.exe3.23%
- sh.exe1.61%
Top Parents
- dcconfig.exe68.12%
- dcpatchscan.exe23.15%
- java.exe0.69%
- EDRDCManager.exe0.46%
- dcagentregister.exe0.35%
- LTSVC.exe0.2%
- javaw.exe0.03%
- cmd.exe0.02%
Top Children
- conhost.exe100%
Security Analysis
What does 7za.exe normally do?
Used by software installers, backup scripts, and administrators for file compression/extraction.
When is 7za.exe suspicious?
Compressing sensitive directories (user profiles, database files, email stores). Adding passwords to archives. Large archive creation on endpoints that normally do not archive data.
How do attackers abuse 7za.exe?
Attackers use 7za.exe to compress data before exfiltration, often with password protection to evade DLP. Commonly dropped by attackers as a standalone tool since it has no dependencies.
Detection guidance
Monitor for 7za.exe compressing sensitive directories. Alert on password-protected archive creation (-p flag). Track archive creation volume anomalies.
False positive notes
Many legitimate installers bundle 7za.exe. Backup and deployment tools commonly use it.
Related Processes
Ask Rocky about 7za.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for 7za.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.