Phrozen Timeline - Phrozen
Enum Attached Files 23 Nov 2020

Above snippet demonstrate how to enumerate files openned by running programs on Windows.

Some file unlocker use that technique to find where a specific file is attached and then force processes using that file to release it handle (via code injection techniques). I will write an example in a future snippet thread.