mshlpweb.dll is a loader that uses a known token impersonation technique to elevate permissions and execute install.bat with high privileges. This process runs as a high-integrity process by default, since its set to auto-elevate within its manifest