From a58b47cb329c9d3d6f70f19549a606249a1388ef Mon Sep 17 00:00:00 2001
From: Astharot15 <145103263+Astharot15@users.noreply.github.com>
Date: Sun, 12 Jul 2026 15:31:01 +0200
Subject: [PATCH] Add README content for COM Hijack details

Added details about COM Hijack targeting Chrome and Edge.
---
 README.md | 9 +++++++++
 1 file changed, 9 insertions(+)
 create mode 100644 README.md

diff --git a/README.md b/README.md
new file mode 100644
index 0000000..2b37722
--- /dev/null
+++ b/README.md
@@ -0,0 +1,9 @@
+# COM Hijack for CLSID {9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}
+
+## Interesting details
+
+The hijack targets chrome and msedge; it also works in explorer, but it is likely to crash.
+The callback used is **LdrCallEnclave**.
+A Download function is commented out. It worked in the .exe compilation, but when compiled as a dll, it gets caught by AVs; so instead of using wininet, winhttp was used.
+The payload uses event objects for process synchronization rather than a traditional mutex.
+The COM object is very reliable; it has been working for 6 months without crashes.