This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=12416

predprey, posted Thu Aug 22, 2019 9:44 pm (50408)

---

Probably a false positive, but thought you should know. Due to the "0000201c00000002.exe" that gets created in the %LOCALAPPDATA%/TEMP folder, Windows Defender labels it as "Trojan:Win32/Wacatac.B!ml"

aluigi, posted Wed Sep 25, 2019 4:53 pm (50881)

---

Uberflate is just a wrapper for kzip.exe:
http://advsys.net/ken/utils.htm

From kzip_exe.c:

Quote:

// kzip (Compiled: Apr 14 2007)
// http://advsys.net/ken/utils.htm

// this is the original kzip.exe written by Ken Silverman unpacked and
// realigned so that it can be debugged by anyone if necessary and
// doesn't spend time unpacking itself everytime.
// the best solution would have been to dump the deflate function
// but it's really chaotic and it's used like a brute forcer for
// reaching the maximum level of compression (the same data compressed
// multiple times) so let's go with this lame way...