I wish I could tag Shawn in this thread because he's brilliant and knows far more about this than I do. (also I worked with him @ Cisco/Talos/Sourcefire -- he was in malware research, I was part of engineering the malware research environment. Which even for Windows malware is running on FreeBSD btw hehe)