The legitimate user will know all honeypot files on his system, and if he'll click then it depend on other variables, we build the legitimate user profile and compare it to the current user every interval of time and in additional we planting honeypot files so it's not black and white answer to what happend if he'll click on the honeypot file.

exactly. the legitimate user know the honeypot files and he'll never select them, the files will named with attractive names like "credit card details"... i don't need that the unlegitimate user will open this file, only one click, if he select the file i want to lock the system, how can i check if honeypot file like: C:\credit_card.txt was selected? BTW this project not suppose to defend against hackers, only against unauthorized user that use my PC or laptop without my acception to extract worth data.

Ive planted honeypot files over few directories. My code is fire event whenever user click with his mouse anywhere. When the event is fire i want to check weather the user made right click or left click on honeypot file, if he does then i can assum hes unlegitimate user. There is a way to check it?