GIF89a; >
C:/Windows/System32/winevt/Logs/_[ Writable ]
File:C:/Windows/System32/winevt/Logs/Microsoft-Windows-StateRepository%4Operational.evtx