If running in a Windows environment,  saves a DLL to disk that is injected into the explorer.exe process to execute the payload.  can also be configured to inject and execute within specific processes.