S2 WinDefend; "C:\ProgramData\Microsoft\Windows Defender\platform\4.18.1807.18075-0\MsMpEng.exe" [X]
CMD: DIR /a c:\Users\kebli\AppData\Local\Comms\UnistoreDB\store.vol
CMD: FOR /F "usebackq delims==" %i IN (`wevtutil el`) DO wevtutil cl "%i"
Reboot: