She isolated the pattern. Reassembled it into a binary. The binary’s PE header was damaged, but its core routine was intact: a stateful memory mirror originally written by a 2006 security patch.