lapto007

... I've tested html files. I've opened over 100 of them. After that ekrn.exe grow bigger about 40-50MB. It could be coinsidence. Maybe something else have done it

Hard to say. Html files are too small to notice anything suspicious. I've noticed it happens when big binary files (size: 50-1500MB) are downloaded.

I've noticed , that this problem occurs when you download files through web browser (checked it with firefox and opera). I would bet that Endpoint keeps downloaded files (or part of it) in memory.