Component Object Model Hijacking

COM clients resolve class registrations through the Windows Registry. Replacing a class registration such as InprocServer32 (an in-process DLL) or LocalServer32 (an out-of-process server) can cause a COM activation to load or start an unexpected server. Per-user registrations under HKCU\Software\Classes participate in the merged HKCR view and take priority for the interactive user in applicable contexts; behavior depends on the COM client's security context, architecture, registry view, and activation path. The change can break the legitimate client and does not inherently guarantee execution for other users or elevated execution.