CommandLine:whoami* ((CommandLine:.\/Client\/Common\/* OR CommandLine:.\\Client\\Common\\*) OR CommandLine:C\:\\Windows\\Temp\\Serv\-U.bat*)