After correlating process trees, parent IDs (PPIDs), and digital signatures across thousands of Reddit threads, Sysinternals forums, and endpoint detection logs, one name rises to the top: .