Dive past Task Manager to see per-process disk writes, open handles, and the remote IPs a service is contacting.