RamInspector

A deep RAM usage inspector for Windows. Task Manager hides or blanks a fair chunk of what is actually resident, so this tool enumerates memory straight from the kernel via NtQuerySystemInformation and adds: every session (not just the console), protected (PPL) processes, a brute-force PID probe for DKOM/rootkit-hidden processes, kernel-side memory (paged/non-paged pool, System PID 4, hardware reserved) and an accounting cross-check that shows memory no process claims.