If you think you were compromised and are being spied on, here is what you should do:
Now this a double-edged sword since you cannot be sure whether your desktop activity is being monitored. At the moment you read this, you should pull off the internet plug from your computer because once the attacker sees what you are reading, he/she may kill off the process and hide in the shadows until further notice.
Wait for a couple of minutes then run
cmd, type in
netstat -abno I think, to get PID of every process still listening. If you don't get PID this way, then locate it in task manager, it has to be in one of the manager's tabs. It will tell you which program uses the PID that is listening.
Locate the program with
where example.exe command in cmd. Go to the folders and copy the suspected .exe files to a freshly formatted external device, USB for example. After copying, make sure there are no hidden autorun files on there.
Use public network and possibly a public device to plug in USB and scan the files on virustotal. That should shed some light on the whole thing. However, if malware was encoded into the original file, it could easily bypass detection.
If still not convinced, blast the hard drive. Most efficient way to get rid of parasites. Don't forget to format the USB drive also.
All in all, I don't know which processes actually need network in Win 10 but you should be able to figure that out with the help of search engines. Rest you should kill permanently, even for devices such as printer, if you don't use them.
Also, you could install tcpview, a neat program to monitor your network traffic by process. It is a better version of netstat with live bandwidth and packets information. This way you could actually detect if you are live streaming to a foreign address. On the other hand it is a bit limited because in case of passive spying, logs and/or screenshots that don't eat much bandwidth, you won't be able to tell what data is sent over. For that you would need something like wireshark or tcpdump.