diff --git a/README.md b/README.md new file mode 100644 index 0000000..2b37722 --- /dev/null +++ b/README.md @@ -0,0 +1,9 @@ +# COM Hijack for CLSID {9FC8E510-A27C-4B3B-B9A3-BF65F00256A8} + +## Interesting details + +The hijack targets chrome and msedge; it also works in explorer, but it is likely to crash. +The callback used is **LdrCallEnclave**. +A Download function is commented out. It worked in the .exe compilation, but when compiled as a dll, it gets caught by AVs; so instead of using wininet, winhttp was used. +The payload uses event objects for process synchronization rather than a traditional mutex. +The COM object is very reliable; it has been working for 6 months without crashes.