[0xJRS]

Would this mean that fs event based antivirus scanners could be side-stepped by writing a payload to a file and then never closing the handler?

[hackarama]

Good point here, I will definitely check this and report back. :)