A system and method to monitor executing processes are disclosed. A respective starting fingerprint of memory of each executing process within at least one process is determined during a system startup phase that is prior to a device operational phase. A present fingerprint of memory of the selected executing process within the at least one process is determined during the device operational phase and while a selected executing process is executing. A difference between the respective starting fingerprint of the selected executing process and the present fingerprint of the selected executing process is determined and an indication of the difference for the selected executing process is reported based on determining the difference.