EIP-2026-117564

This exploit demonstrates a Windows Defender detection bypass for TrojanWin32Powessere.G by leveraging path traversal and comma manipulation in rundll32.exe commands. The PoC shows how to execute arbitrary JavaScript via mshtml despite mitigation attempts.