---

Get-Process svchost | Sort-Object -Property @{Expression={(Get-Counter "\Process($($_.ProcessName)*)\IO Data Bytes/sec" -ErrorAction SilentlyContinue).CounterSamples.CookedValue}} -Descending | Select-Object -First 5 Id, Name | ForEach-Object { $p = $_.Id; Write-Host "PID $p ->"; tasklist /svc /fi "PID eq $p" }