Figure 12: Redline shows the total number of processes running after installing malware (left), then a list of processes running after reboot (right).