Possibly Microsoft Windows Defender senses something.
See:
Scroll down to: “List of attack surface reduction events”
Try: Start your Windows OS machine, into Safe Mode(?) and run a complete scan.
Using the Windows OS command line (command prompt), the following command
dir /p /o:d
Provides a list of files in chronological order, for your present directory. Very handy for finding recent virus invaders and their associates, that generally appear within a certain time frame (recent).
It is a lot of work, marching through Windows OS machine directories, in particular, the AppData then Local then BraveSoftware directory and its sub-folders:
C:\Users[UserName]\AppData\Local\BraveSoftware\
but that is a handy command for finding some things . . . that ought not be on a PC.
Another tool - Kaspersky Rescue Disk:
- Save the Kaspersky Rescue Disk software to a USB memory device or a CD/DVD (to learn how to do this, see support.kaspersky.com/8092).
- Boot up your PC – from the storage device that contains Kaspersky Rescue Disk.
- Update the antivirus databases.
- Run a system scan on your PC and then follow the instructions on your screen.
Learn what you can, online, about where MIcrosoft Windows OS has scheduling features - one or more might be set up to cause the unexpected/undesired activity.