猫史档案馆

policies: [
  {
    "desiredIntegrityLevel": "S-1-16-4096 Low",
    "desiredMitigations": "00000000002f1367",
    "jobLevel": "Limited User",
    "lockdownLevel": "Limited",
    "platformMitigations": "011110010101喵000010000",
    "policyRules": {
      "CreateNamedPipeW": [
        "prefix_i(p[0], '\\\\.\\pipe\\LOCAL\\chrome.sync.') -> askBroker"
      ],
      "NtCreateFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtOpenFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtQueryAttributesFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtQueryFullAttributesFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtSetInfoRename": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ]
    },
    "processIds": [
      24912
    ]
  },
  {
    "desiredIntegrityLevel": "S-1-16-0 Untrusted",
    "desiredMitigations": "00000000002f1b67",
    "jobLevel": "Lockdown",
    "lockdownLevel": "Lockdown",
    "platformMitigations": "011110011101喵000010000",
    "policyRules": {
      "CreateNamedPipeW": [
        "prefix_i(p[0], '\\\\.\\pipe\\LOCAL\\chrome.sync.') -> askBroker"
      ],
      "GdiDllInitialize": [
        " -> fakeSuccess"
      ],
      "GetStockObject": [
        " -> fakeSuccess"
      ],
      "NtCreateFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "!(p[2] & 5fedff56) && p[3] == 1 && exact_i(p[0], '\\??\\C:\\Windows\\Fonts') -> askBroker",
        "!(p[2] & 5fedff56) && p[3] == 1 && prefix_i(p[0], '\\??\\C:\\Windows\\Fonts\\') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtCreateSection": [
        "exact_i(p[0], '\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\Edge\\Application\\84.0.522.52\\msedge.dll') -> askBroker",
        "exact_i(p[0], '\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\Edge\\Application\\84.0.522.52\\msedge_elf.dll') -> askBroker"
      ],
      "NtOpenFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "!(p[2] & 5fedff56) && p[3] == 1 && exact_i(p[0], '\\??\\C:\\Windows\\Fonts') -> askBroker",
        "!(p[2] & 5fedff56) && p[3] == 1 && prefix_i(p[0], '\\??\\C:\\Windows\\Fonts\\') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtQueryAttributesFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "exact_i(p[0], '\\??\\C:\\Windows\\Fonts') -> askBroker",
        "prefix_i(p[0], '\\??\\C:\\Windows\\Fonts\\') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtQueryFullAttributesFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "exact_i(p[0], '\\??\\C:\\Windows\\Fonts') -> askBroker",
        "prefix_i(p[0], '\\??\\C:\\Windows\\Fonts\\') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtSetInfoRename": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "RegisterClassW": [
        " -> fakeSuccess"
      ]
    },
    "processIds": [
      24400
    ]
  },
  {
    "desiredIntegrityLevel": "S-1-16-0 Untrusted",
    "desiredMitigations": "00000000002f1b67",
    "jobLevel": "Lockdown",
    "lockdownLevel": "Lockdown",
    "platformMitigations": "011110011101喵000010000",
    "policyRules": {
      "CreateNamedPipeW": [
        "prefix_i(p[0], '\\\\.\\pipe\\LOCAL\\chrome.sync.') -> askBroker"
      ],
      "GdiDllInitialize": [
        " -> fakeSuccess"
      ],
      "GetStockObject": [
        " -> fakeSuccess"
      ],
      "NtCreateFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "!(p[2] & 5fedff56) && p[3] == 1 && exact_i(p[0], '\\??\\C:\\Windows\\Fonts') -> askBroker",
        "!(p[2] & 5fedff56) && p[3] == 1 && prefix_i(p[0], '\\??\\C:\\Windows\\Fonts\\') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtCreateSection": [
        "exact_i(p[0], '\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\Edge\\Application\\84.0.522.52\\msedge.dll') -> askBroker",
        "exact_i(p[0], '\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\Edge\\Application\\84.0.522.52\\msedge_elf.dll') -> askBroker"
      ],
      "NtOpenFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "!(p[2] & 5fedff56) && p[3] == 1 && exact_i(p[0], '\\??\\C:\\Windows\\Fonts') -> askBroker",
        "!(p[2] & 5fedff56) && p[3] == 1 && prefix_i(p[0], '\\??\\C:\\Windows\\Fonts\\') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtQueryAttributesFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "exact_i(p[0], '\\??\\C:\\Windows\\Fonts') -> askBroker",
        "prefix_i(p[0], '\\??\\C:\\Windows\\Fonts\\') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtQueryFullAttributesFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "exact_i(p[0], '\\??\\C:\\Windows\\Fonts') -> askBroker",
        "prefix_i(p[0], '\\??\\C:\\Windows\\Fonts\\') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtSetInfoRename": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "RegisterClassW": [
        " -> fakeSuccess"
      ]
    },
    "processIds": [
      24048
    ]
  },
  {
    "desiredIntegrityLevel": "S-1-16-0 Untrusted",
    "desiredMitigations": "00000000002f1b67",
    "jobLevel": "Lockdown",
    "lockdownLevel": "Lockdown",
    "platformMitigations": "011110011101喵000010000",
    "policyRules": {
      "CreateNamedPipeW": [
        "prefix_i(p[0], '\\\\.\\pipe\\LOCAL\\chrome.sync.') -> askBroker"
      ],
      "GdiDllInitialize": [
        " -> fakeSuccess"
      ],
      "GetStockObject": [
        " -> fakeSuccess"
      ],
      "NtCreateFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "!(p[2] & 5fedff56) && p[3] == 1 && exact_i(p[0], '\\??\\C:\\Windows\\Fonts') -> askBroker",
        "!(p[2] & 5fedff56) && p[3] == 1 && prefix_i(p[0], '\\??\\C:\\Windows\\Fonts\\') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtCreateSection": [
        "exact_i(p[0], '\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\Edge\\Application\\84.0.522.52\\msedge.dll') -> askBroker",
        "exact_i(p[0], '\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\Edge\\Application\\84.0.522.52\\msedge_elf.dll') -> askBroker"
      ],
      "NtOpenFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "!(p[2] & 5fedff56) && p[3] == 1 && exact_i(p[0], '\\??\\C:\\Windows\\Fonts') -> askBroker",
        "!(p[2] & 5fedff56) && p[3] == 1 && prefix_i(p[0], '\\??\\C:\\Windows\\Fonts\\') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtQueryAttributesFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "exact_i(p[0], '\\??\\C:\\Windows\\Fonts') -> askBroker",
        "prefix_i(p[0], '\\??\\C:\\Windows\\Fonts\\') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtQueryFullAttributesFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "exact_i(p[0], '\\??\\C:\\Windows\\Fonts') -> askBroker",
        "prefix_i(p[0], '\\??\\C:\\Windows\\Fonts\\') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtSetInfoRename": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "RegisterClassW": [
        " -> fakeSuccess"
      ]
    },
    "processIds": [
      25168
    ]
  },
  {
    "desiredIntegrityLevel": "S-1-16-0 Untrusted",
    "desiredMitigations": "00000000002f1b67",
    "jobLevel": "Lockdown",
    "lockdownLevel": "Lockdown",
    "platformMitigations": "011110011101喵000010000",
    "policyRules": {
      "CreateNamedPipeW": [
        "prefix_i(p[0], '\\\\.\\pipe\\LOCAL\\chrome.sync.') -> askBroker"
      ],
      "GdiDllInitialize": [
        " -> fakeSuccess"
      ],
      "GetStockObject": [
        " -> fakeSuccess"
      ],
      "NtCreateFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "!(p[2] & 5fedff56) && p[3] == 1 && exact_i(p[0], '\\??\\C:\\Windows\\Fonts') -> askBroker",
        "!(p[2] & 5fedff56) && p[3] == 1 && prefix_i(p[0], '\\??\\C:\\Windows\\Fonts\\') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtCreateSection": [
        "exact_i(p[0], '\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\Edge\\Application\\84.0.522.52\\msedge.dll') -> askBroker",
        "exact_i(p[0], '\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\Edge\\Application\\84.0.522.52\\msedge_elf.dll') -> askBroker"
      ],
      "NtOpenFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "!(p[2] & 5fedff56) && p[3] == 1 && exact_i(p[0], '\\??\\C:\\Windows\\Fonts') -> askBroker",
        "!(p[2] & 5fedff56) && p[3] == 1 && prefix_i(p[0], '\\??\\C:\\Windows\\Fonts\\') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtQueryAttributesFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "exact_i(p[0], '\\??\\C:\\Windows\\Fonts') -> askBroker",
        "prefix_i(p[0], '\\??\\C:\\Windows\\Fonts\\') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtQueryFullAttributesFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "exact_i(p[0], '\\??\\C:\\Windows\\Fonts') -> askBroker",
        "prefix_i(p[0], '\\??\\C:\\Windows\\Fonts\\') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtSetInfoRename": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "RegisterClassW": [
        " -> fakeSuccess"
      ]
    },
    "processIds": [
      23244
    ]
  },
  {
    "desiredIntegrityLevel": "S-1-16-0 Untrusted",
    "desiredMitigations": "00000000002f1b67",
    "jobLevel": "Lockdown",
    "lockdownLevel": "Lockdown",
    "platformMitigations": "011110011101喵000010000",
    "policyRules": {
      "CreateNamedPipeW": [
        "prefix_i(p[0], '\\\\.\\pipe\\LOCAL\\chrome.sync.') -> askBroker"
      ],
      "GdiDllInitialize": [
        " -> fakeSuccess"
      ],
      "GetStockObject": [
        " -> fakeSuccess"
      ],
      "NtCreateFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "!(p[2] & 5fedff56) && p[3] == 1 && exact_i(p[0], '\\??\\C:\\Windows\\Fonts') -> askBroker",
        "!(p[2] & 5fedff56) && p[3] == 1 && prefix_i(p[0], '\\??\\C:\\Windows\\Fonts\\') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtCreateSection": [
        "exact_i(p[0], '\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\Edge\\Application\\84.0.522.52\\msedge.dll') -> askBroker",
        "exact_i(p[0], '\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\Edge\\Application\\84.0.522.52\\msedge_elf.dll') -> askBroker"
      ],
      "NtOpenFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "!(p[2] & 5fedff56) && p[3] == 1 && exact_i(p[0], '\\??\\C:\\Windows\\Fonts') -> askBroker",
        "!(p[2] & 5fedff56) && p[3] == 1 && prefix_i(p[0], '\\??\\C:\\Windows\\Fonts\\') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtQueryAttributesFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "exact_i(p[0], '\\??\\C:\\Windows\\Fonts') -> askBroker",
        "prefix_i(p[0], '\\??\\C:\\Windows\\Fonts\\') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtQueryFullAttributesFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "exact_i(p[0], '\\??\\C:\\Windows\\Fonts') -> askBroker",
        "prefix_i(p[0], '\\??\\C:\\Windows\\Fonts\\') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtSetInfoRename": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "RegisterClassW": [
        " -> fakeSuccess"
      ]
    },
    "processIds": [
      11592
    ]
  },
  {
    "desiredIntegrityLevel": "S-1-16-4096 Low",
    "desiredMitigations": "00000000002f3367",
    "jobLevel": "Lockdown",
    "lockdownLevel": "Restricted Non Admin",
    "platformMitigations": "011110110101喵000010000",
    "policyRules": {
      "CreateNamedPipeW": [
        "prefix_i(p[0], '\\\\.\\pipe\\LOCAL\\chrome.sync.') -> askBroker"
      ],
      "NtCreateFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtOpenFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtQueryAttributesFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtQueryFullAttributesFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtSetInfoRename": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ]
    },
    "processIds": [
      22676
    ]
  },
  {
    "desiredIntegrityLevel": "S-1-16-0 Untrusted",
    "desiredMitigations": "00000000002f1b67",
    "jobLevel": "Lockdown",
    "lockdownLevel": "Lockdown",
    "platformMitigations": "011110011101喵000010000",
    "policyRules": {
      "CreateNamedPipeW": [
        "prefix_i(p[0], '\\\\.\\pipe\\LOCAL\\chrome.sync.') -> askBroker"
      ],
      "GdiDllInitialize": [
        " -> fakeSuccess"
      ],
      "GetStockObject": [
        " -> fakeSuccess"
      ],
      "NtCreateFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "!(p[2] & 5fedff56) && p[3] == 1 && exact_i(p[0], '\\??\\C:\\Windows\\Fonts') -> askBroker",
        "!(p[2] & 5fedff56) && p[3] == 1 && prefix_i(p[0], '\\??\\C:\\Windows\\Fonts\\') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtCreateSection": [
        "exact_i(p[0], '\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\Edge\\Application\\84.0.522.52\\msedge.dll') -> askBroker",
        "exact_i(p[0], '\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\Edge\\Application\\84.0.522.52\\msedge_elf.dll') -> askBroker"
      ],
      "NtOpenFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "!(p[2] & 5fedff56) && p[3] == 1 && exact_i(p[0], '\\??\\C:\\Windows\\Fonts') -> askBroker",
        "!(p[2] & 5fedff56) && p[3] == 1 && prefix_i(p[0], '\\??\\C:\\Windows\\Fonts\\') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtQueryAttributesFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "exact_i(p[0], '\\??\\C:\\Windows\\Fonts') -> askBroker",
        "prefix_i(p[0], '\\??\\C:\\Windows\\Fonts\\') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtQueryFullAttributesFile": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "exact_i(p[0], '\\??\\C:\\Windows\\Fonts') -> askBroker",
        "prefix_i(p[0], '\\??\\C:\\Windows\\Fonts\\') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "NtSetInfoRename": [
        "!(p[1] & 1) && !(prefix(p[0], '\\??\\')) -> askBroker",
        "!(p[1] & 1) && scan(p[0], '~') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\chrome.') -> askBroker",
        "prefix_i(p[0], '\\??\\pipe\\LOCAL\\chrome.') -> askBroker"
      ],
      "RegisterClassW": [
        " -> fakeSuccess"
      ]
    },
    "processIds": [
      25208
    ]
  }
]
猜猜我从哪弄来的