Which process is sending an old password?

I had to change my password, it is used for several purposes, eg. HTTP-proxy, netdrive-connections etc.

Unfortunately, some process under the hood is still using the old password and this periodically loggs me out.

How can I use wireshark to find this process?

I have a 90% guess that is is via http-proxy attempts, but I'm not sure.

Thx in advance, Pit.