Ntquerywnfstatedata Ntdll.dll -

{4D5A9B12-C3E8-4F1A-9B7E-2A6D8F1C0E4B}

> SYS_OP_OVERRIDE_ACTIVE < > USER: THORNE_ARIS < > LEVEL: OMEGA < > MEM: [REDACTED] <

She dumped the parameters. The StateName GUID wasn’t a standard Microsoft identifier. It was custom. She traced the bytes: