Pawel15 0 Posted February 9, 2023 Posted February 9, 2023 Hello! Has anyone encountered such a problem. We start getting "Ransomnote behavioral detection - filecoders [C0619]" alerts. This applies to "%LOCALAPPDATA%\microsoft\onedrive\23.020.0125.0003\kfmlockedfiletoast.png". Is it false positive? Regards!
Administrators Marcos 5,733 Posted February 9, 2023 Administrators Posted February 9, 2023 This is because of writing to or renaming a file with the png extension and "locked" AND "file" substring in the file's name. I'd recommend creating an exclusion for the onedrive folder if you often use files with such name.
Recommended Posts