It was some work folders, because thats what I’m currently using. It might have been other folders and files, but I’ve not gone through them so I havent spotted them.
Might have got to the bottom of this problem, not that I have installed it, but the functonality exists, so like Ransomware uses existing functionality in a lot of cases, like powershell scripts, this exists: