Sysinternals has a lsof equivalent (pslist I think?) to let you see what process is currently using a file. As far as if they're safe to delete, there's no magic here any different than Linux best you can do is prove it's not being used *right now*. Software that writes files to disk does so with whatever permissions the process runs as, so if you're lucky you can list the file owner and make an educated guess. That being said you can't really ever know a file is safe to delete if you don't know what put it there. I would run some malware scans, I used to use malwarebytes and MS security essentials (but I've been out of the game for a *long* time) and if the system seems clean leave files in there alone.