In fact the ProcessModuleInfo structure hosts three different lists of the modules in different order animal on this sample but non of them was able to detect this threat