Comment by api

I think it's just that there's more bounty on the Windows side: more business users, more credentials to steal, etc.