(Image:C\:\\Program\ Files\\Windows\ Media\ Player\\osk.exe OR (Image:C\:\\Windows\\System32\\cmd.exe ParentCommandLine:\"C\:\\Windows\\system32\\mmc.exe\"\ \"C\:\\Windows\\system32\\eventvwr.msc\"\ \/s)) (IntegrityLevel:High OR IntegrityLevel:System OR IntegrityLevel:S\-1\-16\-16384 OR IntegrityLevel:S\-1\-16\-12288)