It executed CHOPSTICK by using rundll32 commands such as rundll32.exe "C:\Windows\twain_64.dll". It also executed a .dll for a first stage dropper using rundll32.exe. An It loader Trojan saved a batch script that uses rundll32 to execute a DLL payload.