What child is this?

Yarden Shafir explains Windows process reparenting: how child processes can appear under a different parent than the one calling CreateProcess, why ProcMon shows misleading stacks like explorer.exe spawning Windows Terminal, and how both attackers and legitimate apps use it.