COM Hijack for CLSID {9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}

Interesting details

The hijack targets chrome and msedge; it also works in explorer, but it is likely to crash. The callback used is LdrCallEnclave. A Download function is commented out. It worked in the .exe compilation, but when compiled as a dll, it gets caught by AVs; so instead of using wininet, winhttp was used. The payload uses event objects for process synchronization rather than a traditional mutex. The COM object is very reliable; it has been working for 6 months without crashes.