I've been working on a user mode EDR bypass that unloads the EDR DLL and spent the day confused debugging because for some reason my bypass works, but attaching the debugger to see if it worked causes the EDR DLL to get re-loaded, so it looked like it wasn't working the whole time