[PATCHED] > [RtlCreateProcessParametersEx] > [C:\Windows\syswow64\kernel32.dll] > {ImagePathName->Buffer: C:\Windows\system32\rundll32.exe}
[PATCHED] > [ZwOpenProcess] > [C:\Windows\syswow64\MSCTF.dll] > {DesiredAccess: 33554432}
[PATCHED] > [ZwOpenProcess] > [C:\Windows\syswow64\MSCTF.dll] >...