What is the COM component IFileOperation and how can it be exploited for unauthorized file copying?

The COM component IFileOperation is a Windows interface for file operations that can be called with elevated privileges if the calling process is a trusted file like explorer.exe or powershell.exe. Attackers exploit this by making an untrusted process appear as a trusted one, enabling file copying into protected directories without triggering UAC. This technique is detailed in the article [Unauthorized file copying via COM component IFileOperation](/news/unauthorized-file-copying-via-com-component-ifileoperation) and is applicable from Windows 7 to Windows 10.