I found it in Windows\Temp - it’s an exe and runs at startup
I installed several new services (a new printer, etc) so I can’t be sure. It’s normal for a “healthy” process to be saved in the Temp to run?