I see that cmd.exe is marked as file deleted in the DeviceFileEvent table

[Zzhaoxi]

When I am working with the DeviceFileEvent table, I see a log like below

Does that means cmd.exe was removed from the device? Log says that the deleting action was initialed by TiWorker.exe. That confuses me: (