Privileged execution of NotePad

Spoofing occurs once again:

Followed by process lineage sequence of notepad.exe:

System > smss.exe > smss.exe > winlogon.exe > userinit.exe > explorer.exe > notepad.exe