(Image:\\whoami.exe OR OriginalFileName:whoami.exe) (CommandLine:\ \/priv* OR CommandLine:\ \-priv*)