Say I have a process called "EvilMalware.exe" that keeps getting restarted (i.e. I kill it and it is restarted after a few seconds).
I looked up the process that starts it and it is
This seems to be a legit windows process for starting stuff.
So how can I figure out what is telling services.exe to keep restarting "EvilMalware.exe"?