I stopped trusting process names and started checking their evidence.