I thought that was probably what you were doing, and it's a good check - one of the ones I tend to do myself when investigating strange things!

Just thought I'd add for other readers some security industry commentary :)