kernel-mode rootkit variant
Discovered by embedding cosine similarity (sentence-transformers MiniLM, 384-dim).