Then, it drops C:\Users\Public\x.vbs. Then it drops, C:\Users\Public\Natso.bat. Then, it executes `Natso.bat`, which is a "fileless" UAC bypass found by James Forshaw. If C:\Windows\Finex still doesn't exist (which means the UAC bypass failed), it will update the Nasto.bat and execute it using the code shown below. This is another UAC bypass technique based on fodhelper.exe. On our test machine, the last bypass was successful, and `C:\Windows\Finex` was successfully created. After that, the DLL deletes the dropped file and exits