https://www.coresecurity.com/blog/analysis-bluehammer-lpe-exploiting-windows-defender-updates