so that day i forget if i had logged off the computer or not , i left home at around 2:30pm and i checked my event viewer that everything slowed turn off ( 7036) by itself like Volume Shadow Copy service , Microsoft Software Shadow Copy Provider service and WinHTTP Web Proxy Auto-Discovery Service and that makes sense. However, at 3:34:21pm a event 7036 - "The Application Experience service entered the running state." comes up and ended at 3:44:21pm (exactly 10 mins) . I would like to know if its just some anti-virus programs, windows service running itselfs or someone just accidentally moved my mouse ( i guess the thats why the application experience service ran for 10 mins in exact) or actually some dudes opened my folders and checked my stuff?

Use Process Explorer and Process Monitor from Sysinternals to catch and analyze processes. I would recommend to see the presentation of Mark Russinovich from previous TechEd (presentations 2010-2012 are publicly available.) Share your findings here. Regards Milos