He opened Task Manager. bluelife_edit.exe wasn't listed. Instead, a new process named bluelife_hostd.sys was running under System PID 4.
It was 3:47 AM when Marcus found it—a thread buried three pages deep in a forgotten PHP forum. The title read:
His secondary monitor flickered. Then it displayed a live network topography map—but not of his local LAN. It showed traffic flows he couldn't possibly own. Encrypted streams. Persistent connections to IPs geolocating to an abandoned data center in the Nevada desert. And at the center of the map, a node labeled: .