 There's a little tool that I made years ago in 2009. It's called Select My Parent. I have a blog post about it. It's a little tool that allows you to launch a program here like Notepad, but then it will have a parent process, the process with the PID that you specify here, 864, which happens to be the ELSAs process, and you can see Notepad. What I want to show now is that I also implemented this, so this was a C program, and now I also implemented this in VBA, in Excel here in my Task Manager spreadsheet. So in Task Manager here I have a top create process, and with that I can launch a program like Calculator, here Calc.exe. I can click create process and then Calculator is launched. And if we go into Process Explorer from CIS internals, you can see Calculator here with Excel.exe as its parent. So let's close Calculator, and now I'm going to do the same, but I'm going to select a parent. Task Manager here, I have Explorer, which is PID 288, so 288, Calc.exe, create process. Here we have Calculator, and if we look into Process Explorer, Calculator, its parent now is Explorer.exe and no longer Excel.exe. Now I'm not going to share the VBA code, which I done this, but if you want to test it, you can just test it on your environment with my select my parent tool. It's a simple C program, so select my parent, Calculate.exe 288. Let me close Calculator here, like this, and then Calculator is launched, and if you go into Process Explorer, you see that it's not command.exe, it's parent, but it's Explorer.exe. So I'm interested in things about that, so select my parent as to open a handle to the parent process here, Explorer.exe, and that is something, for example, that you can discover with the right CISmon configuration, for example.