[ale42]

Given the detection code is in a separated library, it should be relatively easy (supposing the code is not obfuscated) to find out where it is loaded/called.