(IntegrityLevel:High OR IntegrityLevel:System OR IntegrityLevel:S\-1\-16\-16384 OR IntegrityLevel:S\-1\-16\-12288) ParentImage:\\AppData\\Local\\Temp\\system32\\winsat.exe ParentCommandLine:C\:\\Windows\ \\system32\\winsat.exe*