Comment by 0xJRS

Would this mean that fs event based antivirus scanners could be side-stepped by writing a payload to a file and then never closing the handler?