Post #1046412

See my top-level comment, but WinBoat does seem to set the process name for its Windows VM to “windows”. Now if WinBoat is not used here, I agree this might be malware.