User-Mode Process & File Hiding — NtQuerySystemInformation Hook (No Driver)

Описание: Hooks NtQuerySystemInformation, NtQueryDirectoryFile and FindFirstFileExW at the ntdll/kernel32 layer to hide processes and files from Task Manager, Process Hacker 2, Explorer and cmd.

No kernel driver. Runs in user-mode only.

Source: github.com/whenthepoweroflove/nt-query-filter

dc: kariexscontxct
ivankozlovsky.com
[email protected]