My best advice is to run wireshark and look at the traffic to see exactly what is going on.
That being said, it's connecting to a link-local IPv6 address (fe80::...) and it's TCP 445. So, it's talking on your local network and it's likely either SMB or AD traffic.