Question

Windows connect to network drive uses which protocol

Answer 1

The Windows file sharing protocol is called SMB, once upon a time short for "Server Message Block". It may run over a "NetBIOS Session" layer (TCP port 139), but more commonly used over raw TCP (port 445).

(Version 1 was also often called "CIFS", although to my knowledge the standards-defined CIFS is not 100% identical to Windows SMBv1.)

On Windows, the SMB server runs as the LanmanServer service, inside one of the svchost.exe processes. (I'm not entirely sure, but I think part of it might be a kernel driver as well, which wouldn't show up in ProcMon due to not making any system calls at the level ProcMon is watching them.)