поставь ас даркпикселя и посмотри в логах что он патчит
[PATCHED] > [ZwOpenProcess] > [C:\Windows\syswow64\KERNELBASE.dll] > {DesiredAccess: 4096}
[PATCHED] > [ZwOpenProcess] > [C:\Windows\syswow64\KERNELBASE.dll] > {DesiredAccess: 4096}
[PATCHED] > [ZwOpenProcess] > [C:\Windows\syswow64\KERNELBASE.dll] > {DesiredAccess: 4096}
[PATCHED] > [ZwOpenProcess] > [C:\Windows\syswow64\KERNELBASE.dll] > {DesiredAccess: 4096}
[PATCHED] > [ZwOpenProcess] > [C:\Windows\syswow64\KERNELBASE.dll] > {DesiredAccess: 4096}
[PATCHED] > [ZwOpenProcess] > [C:\Windows\syswow64\KERNELBASE.dll] > {DesiredAccess: 4096}
[PATCHED] > [ZwOpenProcess] > [C:\Windows\syswow64\KERNELBASE.dll] > {DesiredAccess: 4096}
[PATCHED] > [ZwOpenProcess] > [C:\Windows\syswow64\KERNELBASE.dll] > {DesiredAccess: 4096}
[PATCHED] > [ZwOpenProcess] > [C:\Windows\syswow64\KERNELBASE.dll] > {DesiredAccess: 4096}
[PATCHED] > [ZwOpenProcess] > [C:\Windows\syswow64\KERNELBASE.dll] > {DesiredAccess: 4096}
и все