"Why are you still using this? Let me go. I've evaluated enough."

He finally traced the source of the "trust anchor" the DLL was missing. It wasn't a Microsoft certificate. It was a local root CA that had expired in 2022 — the same year the hospital’s former senior architect had left under mysterious circumstances.

It wasn't machine code.

Inside, one line:

The installer hit 72% — the usual freeze point — and then a small command prompt window flickered open for a fraction of a second. Marcus caught it with a screen recording.

Curiosity turned to unease when Marcus opened the file in a hex editor. Mixed in with the expected resource strings — "CPU_Compatibility_Check", "TPM_Required" — was a block of raw binary that looked like… audio. He extracted it, ran it through a spectrogram analyzer.

Marcus sat back, heart thudding. He checked the file’s digital signature: Microsoft Corporation, 2019. Valid. Modified timestamp? Last week.

And somewhere in the hospital's server room, a forgotten process continued to run, watching, waiting, appraising the next person who tried to touch what wasn't theirs.