A responder runs the two commands below looking for the number of lines that contain the word powershell. Which of the following is a reason why the output is different between the two plugins?

pslist does not deduplicate results - it simply walks the kernel's EPROCESS linked list in order, so each active process appears exactly once without any deduplication logic.

psscan does not search further back in time by design - the difference in count in this context reflects hidden processes currently in memory, not processes from an earlier point in time.

pslist enumerates all currently active processes present in the EPROCESS linked list and does not limit output to only the first instance of any given executable name.

pslist works by traversing the doubly-linked EPROCESS list maintained by the Windows kernel, which rootkits can manipulate through Direct Kernel Object Manipulation (DKOM) to remove malicious processes from the visible list. psscan bypasses this by scanning raw physical memory pages for EPROCESS pool tags, finding structures regardless of whether they appear in the active linked list. A higher count from psscan compared to pslist therefore indicates that one or more processes have been actively hidden from the operating system's process enumeration.