Look for a while.
Then open the folders one time. Look in the logs if something like notepad begins to try to get access from then on.
When still no logs appear, open a file which would be opened by notepad. And control again what happens later.
We are searching the trigger now.