7za.exe
Summary
7-Zip standalone command-line archiver - compresses and extracts archive files. Frequently bundled in installers and used by attackers for data staging.
7za.exe is the 307th most commonly executed Windows program in EchoTrail's dataset, observed 31,701 times across enterprise environments. It typically runs from C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin and it is most often launched by dcconfig.exe.
Behavior
Top Paths
- C:\Program Files (x86)\ManageEngine\UEMS_Agent\bin98.45%
- C:\Program Files\UEMS_CentralServer\bin0.72%
- C:\Program Files (x86)\Trend Micro\Client Server Security Agent\HostedAgent0.45%
- C:\Windows\LTSvc0.2%
- C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\zip0.06%
- C:\Program Files (x86)\Trend Micro\Client Server Security Agent\Temp\...0.03%
- C:\Users\...0.03%
- C:\Program Files (x86)\ROCCAT\ROCCAT SWARM\7-Zip0.02%
- D:\Program Files\ME_Secure_Gateway_Server\bin0.02%
- C:\Program Files\Pulseway\Patch0.01%
Top Hashes (SHA256)
- ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d99.18%
- 77613cca716edf68b9d5bab951463ed7fade5bc0ec465b36190a76299c50f1170.2%
- 6df56b3a664d8fe6ae6e3e0bbb57d435f0bc8edc30449de8ca65e897f0ef2b150.11%
- a28825f813ce77e0ce9fe043f4c2921fe0b9cd57083f703949a10ea53ca0e5ec0.08%
- a7096897dfbc985b18caaab7f844f667b69578a0d2fef87a6145045a151beee30.06%
- c40dccf30de1c58a526c21ee3bd5f17d84af678bfcba43a3b4d06d2cbd99a16d0.06%
- d03d8c5fc6af53a6635e5e65dd878b9d3a2addd74199054d999f6ed66f8e46b50.06%
- afbad9e84e63c2aae66f54c31f64418f9b0763b68233ad234cb781d204302fc20.05%
- 543caa1f96c5036b98ca1a258efd5306249c156afe54025faadbb6bdb284591b0.05%
- d993382b2b1a9e558ed74f79798baa50b78405a432b1a854a6ab7ce48c6241cd0.04%
Process Ancestry
Top Grandparents
- Creative Cloud.exe12.9%
- chrome.exe6.45%
- firefox.exe6.45%
- setup.exe4.84%
- cmd.exe3.23%
- RuntimeBroker.exe3.23%
- sh.exe1.61%
Top Parents
- dcconfig.exe68.12%
- dcpatchscan.exe23.15%
- java.exe0.69%
- EDRDCManager.exe0.46%
- dcagentregister.exe0.35%
- LTSVC.exe0.2%
- javaw.exe0.03%
- cmd.exe0.02%
Top Children
- conhost.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does 7za.exe normally do?
Used by software installers, backup scripts, and administrators for file compression/extraction.
When is 7za.exe suspicious?
Compressing sensitive directories (user profiles, database files, email stores). Adding passwords to archives. Large archive creation on endpoints that normally do not archive data.
How do attackers abuse 7za.exe?
Attackers use 7za.exe to compress data before exfiltration, often with password protection to evade DLP. Commonly dropped by attackers as a standalone tool since it has no dependencies.
Detection guidance
Monitor for 7za.exe compressing sensitive directories. Alert on password-protected archive creation (-p flag). Track archive creation volume anomalies.
False positive notes
Many legitimate installers bundle 7za.exe. Backup and deployment tools commonly use it.
Related Processes
Ask Rocky about 7za.exe
Rocky answers questions about 7za.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.