It could very well be the original Microsoft software doing this. Check if your Microsoft account and other cloud accounts you are using on that machine have been compromised.