[CoolCold]

Here likely meant that system level hooks of antiviral software are invoked on CloseFile call when you do writes, not on OpenFile.

You may want to take a look on https://youtu.be/qbKGw8MQ0i8?si=HO5b0MuljPQN9Sb2