<?xml version="1.0" encoding="UTF-8"?><urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9" xmlns:news="http://www.google.com/schemas/sitemap-news/0.9" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:image="http://www.google.com/schemas/sitemap-image/1.1" xmlns:video="http://www.google.com/schemas/sitemap-video/1.1"><url><loc>https://blog.buschbeck.dev/</loc><lastmod>2026-08-20T00:00:00.000Z</lastmod><changefreq>weekly</changefreq><priority>1.0</priority></url><url><loc>https://blog.buschbeck.dev/posts/2026-07-04-powershell-dropper/</loc><lastmod>2026-07-04T00:00:00.000Z</lastmod><changefreq>monthly</changefreq><priority>0.8</priority></url><url><loc>https://blog.buschbeck.dev/posts/2026-07-06-fileless-net/</loc><lastmod>2026-07-06T00:00:00.000Z</lastmod><changefreq>monthly</changefreq><priority>0.8</priority></url><url><loc>https://blog.buschbeck.dev/posts/2026-07-10-wannacry/</loc><lastmod>2026-07-10T00:00:00.000Z</lastmod><changefreq>monthly</changefreq><priority>0.8</priority></url><url><loc>https://blog.buschbeck.dev/posts/2026-07-19-lowlevel-windows-functions-in-powershell-complete-deobfuscation/</loc><lastmod>2026-07-19T00:00:00.000Z</lastmod><changefreq>monthly</changefreq><priority>0.8</priority></url><url><loc>https://blog.buschbeck.dev/posts/2026-08-20-vbs-stager-to-in-memory-c-loader/</loc><lastmod>2026-08-20T00:00:00.000Z</lastmod><changefreq>monthly</changefreq><priority>0.8</priority></url><url><loc>https://blog.buschbeck.dev/tags/</loc><changefreq>weekly</changefreq><priority>0.4</priority></url><url><loc>https://blog.buschbeck.dev/tags/csharp/</loc><changefreq>weekly</changefreq><priority>0.4</priority></url><url><loc>https://blog.buschbeck.dev/tags/deobfuscation/</loc><changefreq>weekly</changefreq><priority>0.4</priority></url><url><loc>https://blog.buschbeck.dev/tags/dropper/</loc><changefreq>weekly</changefreq><priority>0.4</priority></url><url><loc>https://blog.buschbeck.dev/tags/electron/</loc><changefreq>weekly</changefreq><priority>0.4</priority></url><url><loc>https://blog.buschbeck.dev/tags/fileless/</loc><changefreq>weekly</changefreq><priority>0.4</priority></url><url><loc>https://blog.buschbeck.dev/tags/golang/</loc><changefreq>weekly</changefreq><priority>0.4</priority></url><url><loc>https://blog.buschbeck.dev/tags/javascript/</loc><changefreq>weekly</changefreq><priority>0.4</priority></url><url><loc>https://blog.buschbeck.dev/tags/net/</loc><changefreq>weekly</changefreq><priority>0.4</priority></url><url><loc>https://blog.buschbeck.dev/tags/nsis/</loc><changefreq>weekly</changefreq><priority>0.4</priority></url><url><loc>https://blog.buschbeck.dev/tags/powershell/</loc><changefreq>weekly</changefreq><priority>0.4</priority></url><url><loc>https://blog.buschbeck.dev/tags/process-hollowing/</loc><changefreq>weekly</changefreq><priority>0.4</priority></url><url><loc>https://blog.buschbeck.dev/tags/ransomware/</loc><changefreq>weekly</changefreq><priority>0.4</priority></url><url><loc>https://blog.buschbeck.dev/tags/remcos/</loc><changefreq>weekly</changefreq><priority>0.4</priority></url><url><loc>https://blog.buschbeck.dev/tags/stealc/</loc><changefreq>weekly</changefreq><priority>0.4</priority></url><url><loc>https://blog.buschbeck.dev/tags/steganography/</loc><changefreq>weekly</changefreq><priority>0.4</priority></url><url><loc>https://blog.buschbeck.dev/tags/vbs/</loc><changefreq>weekly</changefreq><priority>0.4</priority></url><url><loc>https://blog.buschbeck.dev/tags/wannacry/</loc><changefreq>weekly</changefreq><priority>0.4</priority></url><url><loc>https://blog.buschbeck.dev/tags/xworm/</loc><changefreq>weekly</changefreq><priority>0.4</priority></url></urlset>