What's running under svchost besides everything?
C:\wmic service where processid=3392 get name, servicetype, pathname
Name CDPSvc PathName C:\WINDOWS\system32\svchost.exe -k LocalService -p ServiceType Share Process
Ok. CDPSvc syncs mail, calendar, contact info.
Above doesn't require priv escalation. You could also run netstat -naob as admin to get the process name from the start along with other variations of the commands. Some require priv escalation. Listing parentprocessid helps follow the trail of what invoked that process. Some services run under svchost process and you need service details to figure out what it is. Know what's normal to find the bad.
A Mastodon instance for info/cyber security-minded people.