The tester may has clicked on the wrong button when he tried to block the ransomware from running. Instead of block, he accidentally clicked on unblock, because the unblock is red color, and usually people associate the red color with stop. The best will be if it is switched to lockdown mode, so this will eliminate the chance of clicking on the wrong button. From our side we will think of how to improve the UI so it will minimize the possibility of clicking on the wrong button.
