.

Name	Size	Permissions	Options

Application.evtx	20 MB	-rw-rw-rw-
Camera_DeviceMFT.evtx	68 KB	-rw-rw-rw-
Camera_FrameServer.evtx	68 KB	-rw-rw-rw-
HardwareEvents.evtx	68 KB	-rw-rw-rw-
Internet Explorer.evtx	68 KB	-rw-rw-rw-
Key Management Service.evtx	68 KB	-rw-rw-rw-
Logi-LampArray-Driver%4Errors.evtx	68 KB	-rw-rw-rw-
Logi-LampArray-Driver%4Operational.evtx	68 KB	-rw-rw-rw-
MF_MediaFoundationDeviceProxy.evtx	68 KB	-rw-rw-rw-
Microsoft-AppV-Client%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-AppV-Client%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-AppV-Client%4Virtual Applications.evtx	68 KB	-rw-rw-rw-
Microsoft-Client-License-ESU%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Client-License-Flexible-Platform%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Client-Licensing-Platform%4Admin.evtx	1 MB	-rw-rw-rw-
Microsoft-System-Diagnostics-DiagnosticInvoker%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-User Experience Virtualization-Agent Driver%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-User Experience Virtualization-App Agent%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-User Experience Virtualization-IPC%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-User Experience Virtualization-SQM Uploader%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-AAD%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-AccelLib-AccelCx%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-All-User-Install-Agent%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-AllJoyn%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-AppHost%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-AppID%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-AppLocker%4EXE and DLL.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-AppLocker%4MSI and Script.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-AppModel-Runtime%4Admin.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-AppReadiness%4Admin.evtx	2.07 MB	-rw-rw-rw-
Microsoft-Windows-AppReadiness%4Operational.evtx	1.07 MB	-rw-rw-rw-
Microsoft-Windows-AppXDeployment%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-AppXDeployment-Server%4Operational.evtx	1.07 MB	-rw-rw-rw-
Microsoft-Windows-AppXDeploymentServer%4Operational.evtx	5 MB	-rw-rw-rw-
Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-ApplicabilityEngine%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Application Server-Applications%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Application Server-Applications%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Application-Experience%4Program-Compatibility-Troubleshooter.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Application-Experience%4Program-Inventory.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-Application-Experience%4Steps-Recorder.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-AppxPackaging%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-AssignedAccess%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-AssignedAccessBroker%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Audio%4CaptureMonitor.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Audio%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-Audio%4PlaybackManager.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-Authentication User Interface%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Backup.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Biometrics%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-BitLocker%4BitLocker Management.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-BitLocker-DrivePreparationTool%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-BitLocker-DrivePreparationTool%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Bits-Client%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-Bluetooth-BthLEPrepairing%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Bluetooth-MTPEnum%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-BranchCache%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-BranchCacheSMB%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-CertificateServicesClient-Lifecycle-System%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-CertificateServicesClient-Lifecycle-User%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Cleanmgr%4Diagnostic.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-CloudFiles-Filter%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-CloudRestoreLauncher%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-CloudStore%4Initialization.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-CloudStore%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-CodeIntegrity%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-Compat-Appraiser%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Containers-BindFlt%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Containers-Wcifs%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Containers-Wcnfs%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-CoreApplication%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-CorruptedFileRecovery-Client%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-CorruptedFileRecovery-Server%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Crashdump%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Crypto-DPAPI%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-Crypto-NCrypt%4CertInUse.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Crypto-NCrypt%4KeyMgmt.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-Crypto-NCrypt%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-DAL-Provider%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-DSC%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-DSC%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-DataIntegrityScan%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-DataIntegrityScan%4CrashRecovery.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-DateTimeControlPanel%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Deduplication%4Diagnostic.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Deduplication%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Deduplication%4Scrubbing.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-DeviceGuard%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Autopilot.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Enrollment.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Sync.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-DeviceSetupManager%4Admin.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-DeviceSetupManager%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-DeviceSync%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-DeviceUpdateAgent%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Devices-Background%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Dhcp-Client%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Dhcpv6-Client%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Diagnosis-DPS%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-Diagnosis-PCW%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-Diagnosis-PLA%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Diagnosis-Scheduled%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-Diagnosis-Scripted%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Diagnosis-Scripted%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Diagnostics-Networking%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Diagnostics-Performance%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-DiskDiagnostic%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-DiskDiagnosticDataCollector%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-DiskDiagnosticResolver%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-DriverProxy%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-DucUpdateAgent%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-DxgKrnl-Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-DxgKrnl-Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-EDP-Application-Learning%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-EDP-Audit-Regular%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-EDP-Audit-TCB%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-EFS%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-EapHost%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-EapMethods-RasChap%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-EapMethods-RasTls%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-EapMethods-Sim%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-EapMethods-Ttls%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-EnhancedStorage-EhStorClass%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-EventCollector%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-FMS%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-FailoverClustering-Client%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Fault-Tolerant-Heap%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-FeatureConfiguration%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-FileHistory-Core%4WHC.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-FileHistory-Engine%4BackupLog.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Folder Redirection%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Forwarding%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-GenericRoaming%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-GroupPolicy%4Operational.evtx	4 MB	-rw-rw-rw-
Microsoft-Windows-HelloForBusiness%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-Help%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-HomeGroup Control Panel%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-HomeGroup Listener Service%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-HomeGroup Provider Service%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Host-Network-Service-Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Host-Network-Service-Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-HotspotAuth%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Hyper-V-Compute-Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Hyper-V-Compute-Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Hyper-V-Hierarchical-NIC-Switch%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Hyper-V-Hypervisor-Admin.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-Hyper-V-Hypervisor-Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Hyper-V-StorageVSP-Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Hyper-V-VID-Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Hyper-V-VmSwitch-Operational.evtx	1.07 MB	-rw-rw-rw-
Microsoft-Windows-Hyper-V-Worker-Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Hyper-V-Worker-Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-IKE%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-IPxlatCfg%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-IdCtrls%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-International-RegionalOptionsControlPanel%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Iphlpsvc%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-KdsSvc%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Kernel-ApphelpCache%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Kernel-Boot%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-Kernel-CPU-Starvation%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Kernel-Cache%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-Kernel-Dump%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Kernel-EventTracing%4Admin.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-Kernel-IO%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Kernel-LiveDump%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Kernel-PRM%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Kernel-PnP%4Configuration.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-Kernel-PnP%4Device Management.evtx	1.07 MB	-rw-rw-rw-
Microsoft-Windows-Kernel-PnP%4Driver Watchdog.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Kernel-WDI%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Kernel-WHEA%4Errors.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Kernel-WHEA%4Operational.evtx	1.07 MB	-rw-rw-rw-
Microsoft-Windows-KernelStreaming%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-KeyboardFilter%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Known Folders API Service.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-LAPS%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-LanguagePackSetup%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-LiveId%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-LocationServiceProvider%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-MF-FrameServer%4Camera_DeviceMFT.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-MF-FrameServer%4Camera_FrameServer.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-MF-MediaFoundation%4MF_DeviceProxy.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-MPTF%4MPTF-Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-MUI%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-MUI%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-MemoryDiagnostics-Results%4Debug.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Mobile-Broadband-Experience-Parser-Task%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-ModernDeployment-Diagnostics-Provider%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-ModernDeployment-Diagnostics-Provider%4Autopilot.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-ModernDeployment-Diagnostics-Provider%4Diagnostics.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-ModernDeployment-Diagnostics-Provider%4ManagementService.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Mprddm%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-NCSI%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-NTLM%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-NcdAutoSetup%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-NdisImPlatform%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-NetworkLocationWizard%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-NetworkProfile%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-NetworkProvider%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-NetworkProvisioning%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-NlaSvc%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Ntfs%4Operational.evtx	32 MB	-rw-rw-rw-
Microsoft-Windows-Ntfs%4WHC.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-OOBE-Machine-DUI%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-OcpUpdateAgent%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-OfflineFiles%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-OneBackup%4Debug.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-PCI%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-PCRPF%4PCRPF.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-PackageStateRoaming%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-ParentalControls%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Partition%4Diagnostic.evtx	1.07 MB	-rw-rw-rw-
Microsoft-Windows-PerceptionRuntime%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-PerceptionSensorDataService%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Perflib%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-PersistentMemory-Nvdimm%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-PersistentMemory-PmemDisk%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-PersistentMemory-ScmBus%4Certification.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-PersistentMemory-ScmBus%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Policy%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-PowerShell%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-PowerShell%4Operational.evtx	15 MB	-rw-rw-rw-
Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-PrintBRM%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-PrintService%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Privacy-Auditing%4Operational.evtx	1.07 MB	-rw-rw-rw-
Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Provisioning-Diagnostics-Provider%4AutoPilot.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Provisioning-Diagnostics-Provider%4ManagementService.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-PushNotification-Platform%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-PushNotification-Platform%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-Rdp-Graphics-RdpAvenc%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Rdp-Graphics-RdpAvenc%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Rdp-Graphics-RdpLite%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Rdp-Graphics-RdpLite%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-ReFS%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-ReFsDedupSvc%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-ReadyBoost%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-ReadyBoostDriver%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Regsvr32%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-RemoteApp and Desktop Connections%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-RemoteApp and Desktop Connections%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-RemoteAssistance%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-RemoteAssistance%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-RemoteDesktopServices-RdpCoreTS%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-RemoteDesktopServices-RdpCoreTS%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-RemoteDesktopServices-RemoteFX-Synth3dvsc%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-RemoteDesktopServices-SessionServices%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-Resource-Exhaustion-Resolver%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-RestartManager%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-RetailDemo%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-RetailDemo%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-SENSE%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-SMBClient%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-SMBDirect%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-SMBDirect%4Connectivity.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-SMBDirect%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-SMBServer%4Audit.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-SMBServer%4Connectivity.evtx	1.07 MB	-rw-rw-rw-
Microsoft-Windows-SMBServer%4Operational.evtx	3.07 MB	-rw-rw-rw-
Microsoft-Windows-SMBServer%4Security.evtx	1.07 MB	-rw-rw-rw-
Microsoft-Windows-SMBWitnessClient%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-SMBWitnessClient%4Informational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-SearchUI%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Security-Adminless%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Security-Audit-Configuration-Client%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Security-EnterpriseData-FileRevocationManager%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Security-Isolation-BrokeringFileSystem%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Security-LessPrivilegedAppContainer%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-Security-Mitigations%4UserMode.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Security-Netlogon%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Security-SPP-UX-GenuineCenter-Logging%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Security-SPP-UX-Notifications%4ActionCenter.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Security-UserConsentVerifier%4Audit.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-SecurityMitigationsBroker%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-SenseIR%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-SettingSync%4Debug.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-SettingSync%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-SettingSync-Azure%4Debug.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-SettingSync-Azure%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-SettingSync-OneDrive%4Debug.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-SettingSync-OneDrive%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Shell-ConnectedAccountState%4ActionCenter.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Shell-Core%4ActionCenter.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Shell-Core%4AppDefaults.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-Shell-Core%4LogonTasksChannel.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Shell-Core%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-ShellCommon-StartLayoutPopulation%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-SmartCard-Audit%4Authentication.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-SmartCard-DeviceEnum%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-SmartCard-TPM-VCard-Module%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-SmartCard-TPM-VCard-Module%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-SmbClient%4Audit.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-SmbClient%4Connectivity.evtx	1.07 MB	-rw-rw-rw-
Microsoft-Windows-SmbClient%4Security.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-StateRepository%4Operational.evtx	5 MB	-rw-rw-rw-
Microsoft-Windows-StateRepository%4Restricted.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Storage-ClassPnP%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Storage-NvmeDisk%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Storage-Storport%4Health.evtx	1.07 MB	-rw-rw-rw-
Microsoft-Windows-Storage-Storport%4Operational.evtx	21.07 MB	-rw-rw-rw-
Microsoft-Windows-Storage-Tiering%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-StorageManagement%4Operational.evtx	1.07 MB	-rw-rw-rw-
Microsoft-Windows-StorageManagement-PartUtil%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-StorageSettings%4Diagnostic.evtx	1.07 MB	-rw-rw-rw-
Microsoft-Windows-StorageSpaces-Api%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-StorageSpaces-Driver%4Diagnostic.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-StorageSpaces-ManagementAgent%4WHC.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-StorageSpaces-Parser%4Diagnostic.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-StorageSpaces-Parser%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-StorageSpaces-SpaceManager%4Diagnostic.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-StorageSpaces-SpaceManager%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-StorageVolume%4Diagnostic.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-StorageVolume%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-Store%4Operational.evtx	19.13 MB	-rw-rw-rw-
Microsoft-Windows-Storsvc%4Diagnostic.evtx	1.07 MB	-rw-rw-rw-
Microsoft-Windows-Sudo%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-SystemSettingsThreshold%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-TWinUI%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-TZSync%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-TZUtil%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-TaskScheduler%4Maintenance.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-TenantRestrictions%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-TerminalServices-ClientUSBDevices%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-TerminalServices-ClientUSBDevices%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-TerminalServices-PnPDevices%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-TerminalServices-PnPDevices%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-TerminalServices-Printers%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-TerminalServices-Printers%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-TerminalServices-RDPClient%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-TerminalServices-ServerUSBDevices%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-TerminalServices-ServerUSBDevices%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Time-Service%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-Time-Service-PTP-Provider%4PTP-Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Troubleshooting-Recommended%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Troubleshooting-Recommended%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-UAC%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-USB-UCMUCSICX%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-USB-USBXHCI-Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-UniversalTelemetryClient%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-User Control Panel%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-User Device Registration%4Admin.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-User Profile Service%4Operational.evtx	1.07 MB	-rw-rw-rw-
Microsoft-Windows-User-Loader%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-UserPnp%4ActionCenter.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-UserPnp%4DeviceInstall.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-UserSettingsBackup-BackupUnitProcessor%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-UserSettingsBackup-EarlyDownloader%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-UserSettingsBackup-Orchestrator%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-VDRVROOT%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-VHDMP-Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-VPN%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-VPN-Client%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-VerifyHardwareSecurity%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Volume%4Diagnostic.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-WDAG-PolicyEvaluator-CSP%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-WDAG-PolicyEvaluator-GP%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-WER-Diag%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-WER-PayloadHealth%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-WFP%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-WLAN-AutoConfig%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-WMI-Activity%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-WMPNSS-Service%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-WPD-ClassInstaller%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-WPD-CompositeClassDriver%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-WPD-MTPClassDriver%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-WWAN-SVC-Events%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Wcmsvc%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-WebAuthN%4Operational.evtx	1.07 MB	-rw-rw-rw-
Microsoft-Windows-WebIO%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-WerKernel%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Win32k%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-WinHttp%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-WinINet%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-WinRM%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-Windows Defender%4Operational.evtx	14 MB	-rw-rw-rw-
Microsoft-Windows-Windows Defender%4WHC.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-Windows Firewall With Advanced Security%4FirewallDiagnostics.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-WindowsBackup%4ActionCenter.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-WindowsSystemAssessmentTool%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-WindowsUpdateClient%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-Winlogon%4Operational.evtx	1 MB	-rw-rw-rw-
Microsoft-Windows-Winsock-WS2HELP%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Wired-AutoConfig%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-WorkFolders%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-WorkFolders%4WHC.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-Workplace Join%4Admin.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-ZTDNS%4BlockedConnections.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-ZTDNS%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-Windows-hidcfu%4Operational.evtx	68 KB	-rw-rw-rw-
Microsoft-WindowsPhone-Connectivity-WiFiConnSvc-Channel.evtx	68 KB	-rw-rw-rw-
OpenSSH%4Admin.evtx	68 KB	-rw-rw-rw-
OpenSSH%4Operational.evtx	68 KB	-rw-rw-rw-
Plugin-Passkey-Providers%4Operational.evtx	68 KB	-rw-rw-rw-
SMSApi.evtx	68 KB	-rw-rw-rw-
Security.evtx	20 MB	-rw-rw-rw-
Setup.evtx	1 MB	-rw-rw-rw-
Synced-Passkey-Provider%4Operatonal.evtx	68 KB	-rw-rw-rw-
System.evtx	20 MB	-rw-rw-rw-
WINDOWS_KS_CHANNEL.evtx	1 MB	-rw-rw-rw-
Windows PowerShell.evtx	15 MB	-rw-rw-rw-
microsoft-windows-provisioning-diagnostics-provider%4admin.evtx	1 MB	-rw-rw-rw-

Anon7 - 2021