A .NET tracing environment variable was turned off in a user’s registry on a Windows system. Which built-in command-line tool was used to make this registry change?

DeviceRegistryEvents
| where Timestamp between (startofday(ago(30d))..now())
// Focus on registry value sets or modifications
| where ActionType has_any ("Set", "Create", "Modify", "Write", "Update", "ValueSet", "RegistryValueSet")
// Look for common .NET tracing environment variable names or keywords. Adjust list as needed.
| where RegistrationKey = isempty(RegistryKey) == false or RegistryKey contains "COR_" or RegistryKey contains "Tracing" or RegistryValueName has_any ("COR_ENABLE_PROFILING", "COMPLUS_EnableDiagnostics", "CORECLR_ENABLE_PROFILING", "DOTNET_DiagnosticPorts", "COR_ENABLE_PROFILING", "DOTNET_TRACING", "COREHOST_TRACE")
// Also check registry value data indicating '0' or 'false' or 'off'
| where tostring(RegistryValueData) in ("0","false","False","OFF","off") or RegistryValueData contains "0"
// Narrow to user hive changes as well (HKCU) and typical environment variable locations
| where RegistryKey has_any ("HKEY_CURRENT_USER","HKCU","Environment","HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment")
| project TimeGenerated=Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, RegistryKey, RegistryValueName, RegistryValueData, PreviousRegistryValueData, ActionType, ReportId, TenantId
| extend InitiatingProcessFileName = tolower(InitiatingProcessFileName)
| summarize count(), any(RegistryValueData) by InitiatingProcessFileName, InitiatingProcessCommandLine, DeviceName, InitiatingProcessId, RegistryKey, RegistryValueName
| order by count_ desc
| limit 50

DeviceRegistryEvents
| where RegistryKey contains 'Environment' and RegistryKey contains 'HKEY_CURRENT_USER'
| where ActionType in~ ('RegistryValueSet', 'RegistryValueDeleted', 'RegistryKeySet')
| summarize arg_max(Timestamp, *) by DeviceId, RegistryKey, RegistryValueName
| project Timestamp, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
| limit 100