They also _coincidentally_ implemented a feature that autoran ImageGlass as a background service a day before the malware was slipped in.