What
PowerShell-based process ancestor detection now retrieves the full ancestor chain in a single call.
Details
- Uses a more efficient PowerShell script that walks the process tree in one execution
- Retrieves both process IDs and command lines for ancestors
- Timeout increased from 1 second to 3 seconds for reliability
Evidence
PowerShell script at line 198756 (contains "$currentPid =", batched ancestor retrieval logic)
Strings lifted out of the shipped bundle, so the claim above can be checked against them.