CreateToolhelp32Snapshot and EnumProcessModules don't work while the AC is active. RtlQueryProcessDebugInformation (from CrySearch) also fails. Could use NtQueryInformationProcess to get the PEB for InLoadOrderModuleList, but that also requires a handle.

Is there a way without using handles?