See Which Apps Are Using the Internet Right Now in Windows

In Command Prompt:

netstat -ano

This lists connections with the owning PID in the last column. Narrow it to live connections only:

netstat -ano | findstr ESTABLISHED

Now turn the PID into a program name:

tasklist /fi "PID eq 8456"

Use the PID from your own output — 8456 here is only an example. In Task Manager's Details tab you can then right-click that process → Open file location to get the exact path for your block rule.

There is a shortcut flag that prints program names directly:

netstat -b

Run it in a normal window and Windows refuses with a plain message: The requested operation requires elevation. That is normal and not an error in your typing — seeing which program owns a connection is treated as administrator information. Two honest consequences: Resource Monitor in a normal session also hides some system rows, so run these tools as administrator when you are hunting seriously; and on a PC where you do not have admin rights, you genuinely cannot get the full picture — that is a design decision of Windows, not a trick to work around.

Once the live view names the program, the rest is the standard recipe: file location from Task Manager, then the outbound block rule from the main guide. If you do this often, Microsoft also gives away TCPView from its Sysinternals collection — a small free viewer that shows the same connections in a cleaner, colour-coded window and can even close a connection on the spot. It changes nothing about the method; it just makes the watching pleasanter.

One limit to know: these tools show now. They cannot tell you what connected yesterday. For history, the firewall's own logging exists (in wf.msc Properties, per profile) and writes dropped packets to a log file — worth switching on only when a mystery keeps repeating.