Thanks for the reply brian but sadly, it doesn't help me because for example if you look at the picture I provided, "ntdll.dll" and some other dlls are listed there which won't be listed in the process lists so I'm a bit lost how PE actually do this.