(Image:\\whoami.exe OR OriginalFileName:whoami.exe) (CommandLine:\ \/groups* OR CommandLine:\ \-groups*)