RgoELC

@nukecad thank you for the detailed response. This could very well be what happened. The PC has been reimaged, so there is no way to be sure now what package he downloaded. I can compare file hashes from the log if I have time, but for now the priority is off as the issue has been resolved. I make sure to educate the users to not download Home-use appliances on their corporate devices. Thank you all!

Free version. The user send me a link to the official website and told me he downloaded from there.

No business user. We don't use CCleaner. The user downloaded this without permission. I will however send them an email anyway. Thx for the address.

Here is some more info about the activities CCleaner 614 performed on our system:

Hello, We just got an escalated ticket about a user who downloaded CCleaner on his system. This version of CCleaner is responsible for several questionable activities on the device, including but not limited to key logging, attempting to encypt credentials, deleting several files. See the details of the ticket below: This is very concerning. Please investigate this with the highest priority.