Abusing a bug in Sysmon's driver to fake source processes' image file names.