EventID:4697 (ServiceFileName:cmd* ServiceFileName:\"set* ServiceFileName:\-f*) (ServiceFileName:\/c* OR ServiceFileName:\/r*)