He must have one of those Chinese picture frames.

If you want to see what the suspicion is, uncompress the ventoi installer, and upload to virus total.

Nothing to see here folks, just a bunch of moon landing deniers.