OriginalFileName:whoami.exe (-Image:\\whoami.exe)