Could it be that he downloaded a fix/fixes for bugbear.......?..............I test a lot of software and usually put the download into a folder with its name.........also, why a folder.......it should be a single file?

I would have expected him to be a bit more subtle? Like give it a name such as "toolbox" or something?

Just a thought..............but you are right............it pays to be careful

Cheers