If the process keeps reappearing then most likely it is started by
launchd. Use launchctl to list jobs loaded to launchd:
sudo launchctl list
Job definitions for launchd in .plist files are stored in:
~/Library/LaunchAgents Per-user agents provided by the user.
/Library/LaunchAgents Per-user agents provided by the administrator.
/Library/LaunchDaemons System-wide daemons provided by the administrator.
/System/Library/LaunchAgents Per-user agents provided by Mac OS X.
/System/Library/LaunchDaemons System-wide daemons provided by Mac OS X.
You might also
grep the above files for actual path to executable.
For all processes you can check the output of
ps -ef | grep <process_name> and check the parent process
UID PID PPID C STIME TTY TIME CMD
501 17151 7357 0 9:35AM ttys000 0:00.00 grep grep
In this example
grep process was spawned from process
7357. Later you can check
ps -ef | grep 7357 to find out it was
bash process that started