All this hiding is complete wasting of time. Yes you can smudge your code within the address space of the victim, use tandem of trampolines, morph handlers and so on, but it's not worth a damn, because the logger is working with the sandbox components, which are not possible to completely hide (without breaking their functionality) without sandbox native support. This is just a sandbox, not a VM.
I suggest Buster to only unlink dll from lists (or/and randomize/fake it name) and forget about everything else.
Ring0 - the source of inspiration
