Hey everybody, still trying to find the source of a memory leak that causes RAM usage to increase by 2-4% every time the computer wakes from sleep. Some background: I can only see the zombie processes taking up memory using RAMMAP, process explorer/task manager does not show them. I think it is WMI issue, as I see thousands of conhost.exe, cmd.exe, and WMIC.exe processes on RAMMAP which use 28k or 32k Page Table.
Basically is there a way to see the parent process of what launched these processes, I tried using ProcMon, but because it occurs on wake from sleep, I think I keep missing it happening, so I feel the way to solve it would be to somehow be able to click on RAMMAP and directly see what launched a process. Thank you!