Unhook, do tracking stuff and hook syscalls again to avoid tracking procmon itself