diff --git a/README.md b/README.md index f1cbbb6..4e13ed5 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,11 @@ ### Interesting details The hijack targets chrome and msedge; it also works in explorer, but it is likely to crash. + The callback used is **LdrCallEnclave**. + A Download function is commented out. It worked in the .exe compilation, but when compiled as a dll, it gets caught by AVs; so instead of using wininet, winhttp was used. + The payload uses event objects for process synchronization rather than a traditional mutex. + The COM object is very reliable; it has been working for 6 months without crashes.