process-hollowing 2 LnvMSRIO.sys, the 13 IOCTLs nobody audited, and an eight-round walk past Cortex XDR Jun 5, 2026 Eight rounds against Cortex XDR's driver-load coverage — process hollowing, the IAT trap, and a 2.7 KB shellcode that finally landed Jun 4, 2026