Born With a Stolen Soul — Spawning Processes With Swapped Identities via NtSetInformationProcess

How we create a legitimate Windows process, replace its identity before it executes a single instruction, and wake it up as SYSTEM — invisible to most EDR process creation hooks. Introduction — What E