For the last few days we have received thousands of AMP detections for Trojan.Script.GenericKDZ.14123, and all in the patch below:
File path: \\?\C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E06025E52106E5FA757142B37BBBEE63
File is always the same (E06025E52106E5FA757142B37BBBEE63). Downloading and submitting multiple instances of the "malicious" file across the detections to VirusTotal results in two of sixty engines indicating it is malicious - Arcabit and NANO-Antivirus.
We have a case open with Cisco since Monday, trying to assess if this really is malicious or if it is a false-positive. None of the endpoints flagged by AMP with this detection seem to have any issues at all. We've searched all sorts of things on Google to see if there are others with the same issue, and so far I can't find any thing. No one seems to be complaining about this.
Anyone else experiencing this same issue?
