2nd Dropper (msmvs.exe)

Figure 1: Simple Anti Debug trick

3rd Dropper (conhost.dll)

Figure 2: Strings decryption and function address resolving

Figure 3: Get "els.dll" or system file time

Appendix