The first file was small—too small for what it claimed to be. An archive, then an installer, then a patch that ran under the surface like software sediment. Each step was accompanied by a tutorial comment and a community-verified badge: “Worked for me.” He told himself he was learning: how executable files start processes, how installers write to Program Files, how registration keys live in the registry. Technical curiosity dressed the risk in legitimacy.