Figure 12

Figure 12: The parent process of svchost.exe is wscript.exe, which is a child of explorer.exe.