Windows registry events show that a new key under the Active Setup Installed Components branch was added to launch a payload immediately via runonce.exe. Which component name was created?

DeviceRegistryEvents
| where ActionType == "RegistryValueSet"
| where RegistryKey has @"\SOFTWARE\Microsoft\Active Setup\Installed Components"
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName

let ActiveSetupEvents = DeviceRegistryEvents
| where ActionType in ("RegistryKeyCreated","RegistryValueCreated","RegistryValueSet")
| where RegistryKey has "\\Microsoft\\Active Setup\\Installed Components\\"
| extend ComponentId = tostring(extract(@"(?i)\\active setup\\installed components\\([^\\]+)", 1, RegistryKey))
| where isnotempty(ComponentId);

let KeyCreated = ActiveSetupEvents
| where ActionType == "RegistryKeyCreated"
| summarize KeyCreateTime=min(TimeGenerated),
          CreatedByProcess=any(InitiatingProcessFileName),
          CreatedByCommandLine=any(InitiatingProcessCommandLine)
  by DeviceId, DeviceName, ComponentId;

let ValuePivot = ActiveSetupEvents
| summarize StubPath=anyif(RegistryValueData, tolower(RegistryValueName) == "stubpath"),
          DisplayName=anyif(RegistryValueData, tolower(RegistryValueName) == "displayname"),
          FirstSeen=min(TimeGenerated),
          LastSeen=max(TimeGenerated)
  by DeviceId, DeviceName, ComponentId;

let RunOnce = DeviceProcessEvents
| where FileName =~ "runonce.exe"
| project DeviceId, RunOnceTime=TimeGenerated, RunOnceCmd=ProcessCommandLine;

KeyCreated
| join kind=inner (RunOnce) on DeviceId
| where KeyCreateTime between (RunOnceTime - 15m .. RunOnceTime + 30m)
| join kind=leftouter (ValuePivot) on DeviceId, ComponentId
| extend ComponentName = coalesce(DisplayName, ComponentId)
| project TimeCreated=KeyCreateTime, DeviceName, ComponentName, ComponentId, StubPath, CreatedByProcess, CreatedByCommandLine, RunOnceTime, RunOnceCmd
| order by TimeCreated desc

DeviceRegistryEvents
| where RegistryKey has_cs "Active Setup\\Installed Components"
// Look for created keys or values that reference runonce.exe or RunOnce
| where ActionType in ("RegistryKeyAdded", "RegistryValueSet", "ValueAdded", "SetValue") or RegistryValueData has_cs "runonce.exe" or RegistryValueData has_cs "RunOnce"
| extend Component = extract(@"Installed Components\\([^\\]+)", 1, RegistryKey)
| where isnotempty(Component)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RegistryKey, RegistryValueName, RegistryValueData, Component, ActionType, InitiatingProcessId, ReportId
| sort by TimeGenerated desc

DeviceRegistryEvents
| where RegistryKey has "Active Setup" and RegistryKey has "Installed Components"
| where InitiatingProcessFileName endswith "runonce.exe" or InitiatingProcessCommandLine has "runonce.exe"
| extend Parts = split(RegistryKey, "\\")
| extend CreatedKey = tostring(Parts[array_length(Parts)-1])
| extend ComponentName = iff( RegistryValueName in ("ComponentName","DisplayName"), RegistryValueData, CreatedKey )
| where isnotempty(ComponentName)
| project TimeGenerated, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine, ComponentName
| distinct ComponentName

DeviceRegistryEvents
| where ActionType in ("RegistryKeyCreated", "RegistryValueSet", "RegistryValueCreated")
| where RegistryKey has_any ("HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components", 
                            "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Active Setup\\Installed Components")
| where RegistryValueData has "runonce.exe" or RegistryValueName =~ "StubPath"
| extend ComponentName = extract(@"Installed Components\\([^\\]+)", 1, RegistryKey)
| project TimeGenerated, DeviceName, ActionType, ComponentName, RegistryKey, RegistryValueName, RegistryValueData
| order by TimeGenerated desc

// New Active-Setup component keys created
DeviceRegistryEvents
| where ActionType == "RegistryKeyCreated"
| where RegistryKey has "Active Setup\\Installed Components\\"  // covers both HKLM and HKEY_LOCAL_MACHINE forms
// Pull the component (sub-key) name that follows …Active Setup\Installed Components\
| extend ComponentName = extract(@"Active Setup\\Installed Components\\([^\\]+)", 1, RegistryKey)
| where isnotempty(ComponentName)
// Summarise the observation window for every component per device
| summarize FirstObserved=min(TimeGenerated), LastObserved=max(TimeGenerated) 
          by ComponentName, DeviceName, DeviceId
| order by FirstObserved asc