Not oem0.inf or nv_disp.inf . A custom name. Hand-typed.
She copied it to a sandbox VM and opened it in Notepad. The file was pristine—comments intact, sections clearly marked. It looked like a standard driver INF for a fictional device called "EchoLink." inf file
She checked the file’s metadata. The INF was compiled on a Tuesday. 2:47 AM. One day before Aris went missing. Not oem0
[EchoLink_Install.NT.HW] AddReg = EchoLink_HW_AddReg [EchoLink_HW_AddReg] HKR,, "KernelCallback", 0x00000000, "EchoCallbackRoutine" HKR,, "PayloadAddress", 0x00000001, 0x7FFE0000 inf file
[ArisDevices.NTamd64] %EchoLink.DeviceDesc% = EchoLink_Install, USB\VID_045E&PID_07CD
Device: EchoLink Type: INF-based kernel hook + USB side-channel receiver Status: Not malware. A ghost’s goodbye.