-
PanGpHip.exe
Palo Alto GP Firewall HIP check runs whoami.exe as SYSTEM.
-
ArcGISPortal.exe
Not just bad guys run
whoami. -
HostedAgent.exe
Whoami? HostedAgent, of course!
-
Skype.exe
It runs whoami because it's lost.