False positive, I've tested it on 4 different VMs earlier today. If it makes you feel safer, there's a program called Moo0 FileMonitor which allows you to monitor real-time changes to files in your system.