I called Inuit Support and since I am on QB 2020 Pro I could not get support - version is too old.

I have done more digging into this.

There is a post on SpiceWorks about this as well.

It appears that I was infected on 10/20/2022 at 1:36PM.

Looking at my windows Installed Apps I did a QuickBooks update on that date.

I have a "QuickBooks Runtime Redistributable" update on 10/20/2022.

In addition to this folder there are 2 registry entries:

HKEY_CURRENT_USER\Run that need to be removed.

The first is "Intuit QuickBooks" and the second "QuickBooks Desktop".

You will see the paths to the bad location.

Next there are two Task Scheduler entries:

"Intuit QuickBooks"

"Intuit QuickBooks 11".

After killing any running processes you can rename/delete the folder.

I'm thinking that this was installed as part of a QB update I did.

I did file a C:\Windows\Intuit\{88C0857B-7734-4EA5-A7D9-636DF8622B63} with a timestamp of 10/20/2022 2:03PM.

the folder is now empty and shows the time correlation of this happening.