Ransomware hides in
WINDOWS\SYSTEM32
WINDOWS
internet cache
Users folder