2
Where in the code does it find our key?
Using Process Monitor, digging into the for the ETL event reading out that value stack trace gives us:
"Frame","Module","Location","Address","Path"
...
"3","ntdll.dll","NtQueryValueKey + 0xa","0x7fbce17344a","C:\Windows\SYSTEM32\ntdll.dll"
"4","KERNELBASE...