, or use the file Lab12-03.exe.

Questions

Q:	1. What is the purpose of this malicious payload?
Q:	2. How does the malicious payload inject itself?
Q:	3. What filesystem residue does this program create?

1. What does the code at 0x401000 accomplish?

2. Which process has code injected?

3. What DLL is loaded using LoadLibraryA?

4. What is the fourth argument passed to the CreateRemoteThread call?

5. What malware is dropped by the main executable?

6. What is the purpose of this and the dropped malware?