You may be able to use Procmon to figure out the process responsible for the file creation.
https://video2.skills-academy.com/en-us/sysinternals/downloads/procmon
--please don't forget to close up the thread here by marking answer if the reply is helpful--