She opened a hex editor and scanned the referenced driver binary— echolink.sys , which the INF would copy to System32\drivers . The SYS file was tiny. Too tiny. It contained only a single export: EchoCallbackRoutine . The rest was encrypted data masquerading as padding.
She closed the VM, encrypted the file, and wrote a new entry in her case notes: inf file
Not oem0.inf or nv_disp.inf . A custom name. Hand-typed. She opened a hex editor and scanned the