The router/firwall I use are Mikrotik and the screen cap below is from a tool called Torch on my Mikrotik router. I am unsure how you would do this in Cisco but I have to believe there is an analog.
As shown in the image, I'm filtering traffic on my LAN interface (ether-2) whose source is 192.x.x.7. In this case I'm keeping connections for 30s after they close (Entry Timeout value) but in a case like yours might set that as high as a couple of hours. The most interesting info is the dst ip address and port.
Using a tool like this right on the router I can see exactly how much traffic is getting sent/received per host:port and protocol. Since you've already identified the problem machine, I'd filter to that machine's IP (as I've done in the image). Then, sorting by Rx Rate you'd see the biggest uploads happening and what port they are both coming from and going to. Using well known ports I can narrow down to what application is causing it.
If not a well know port or for whatever reason, you can run a netstat on the machine to see what application is using that port (different OS use diff switches so just look it up or specify your OS and I'll try to answer.)
This is a lot quicker/easier than capturing frames in wireshark (and needing a hub or promiscuous port to do so) then analyzing them and in many cases this will get you your answer or most of the way there.
I don't have enough rep points to attach the image so here's a link to grab it off my server:
Sorry for having to cover up so much of the info but I think you'll get the idea.