“ip-guard, [0x7FFFBB83E044] ANOMALY: use of REX.w is meaningless (default operand size is 64)” HKEY_LOCAL_MACHINE\SOFTWARE\TEC\Ocular.3\agent\config 字符串类型, key: hookapi_filterproc_external value: cmd.exe;wsl.exe foo.reg 1 2 3 4 Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\TEC\Ocular.3\agent\config] "hookapi_filterproc_external"="cmd.exe;wsl.exe"