Beginner analysts often fall into the trap of looking for "suspicious" variable names. They see bStr, payload, shellcode in code and immediately think "attack!" ...