to be clear im not sure that the cmdline being blank is the issue, but more where are the proc exec events comming from?