That got me doing a deep scan and Defender found the following which was quarantined and then removed. Its within an Oracle file. Please see the screenshot and take appropriate action