((Image:\\whoami.exe OR OriginalFileName:whoami.exe) (CommandLine:\ \/FO\ CSV* OR CommandLine:\ \-FO\ CSV*)) OR CommandLine:whoami*>*