ring3-kit

The ring3-kit is a user-mode rootkit that hides processes from the Windows Task Manager by hooking the NtQuerySystemInformation API function. Its primary use case is to obfuscate running processes from visibility within system monitoring tools, facilitating stealth operations. Notable features include the DLL injection into Taskmgr.exe, which allows the execution of the hooked code in a modified virtual memory space.