Often distributed via spear-phishing or via the Raspberry Robin worm.

Force a password reset for any accounts logged into that machine.

Run a full system scan with an updated EDR (Endpoint Detection and Response) tool.

Often drops itself into %AppData% or C:\Users\Public\ .