HEX
Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1j PHP/8.4.25
System: Windows NT DESKTOP-4TAV2RJ 10.0 build 19045 (Windows 10) AMD64
User: fred (0)
PHP: 8.4.25
Disabled: NONE
Upload Files
File: C:/Windows/System32/zh-TW/wevtutil.exe.mui
MZ����@���	�!�L�!This program cannot be run in DOS mode.

$5�<�q�R�q�R�q�R�e���p�R�e�P�p�R�Richq�R�PEL�!b

���@ _8.rdata�@@.rsrc` `@@�C��
T88�C��$��8.rdata8x.rdata$zzzdbg �.rsrc$01� X�.rsrc$02  ��Z��9�@p��N��r���{j��h�C����(�@�X�p��������� ���!�Y�d{��MUI����mAf'aC�c[�|�$�P�Q�)稱4l����MUIzh-TW],!q�l��_U-��[�j: %1!s!0%0

 
Nck�x�v-��[�j0%0

$!q�lR�YS COM0%0

,!q�l�S�_ %1!s! gQ�[0%0

,!q�l-��[ %1!s! gQ�[0%0

(
N/e�c}T�N %1!s!0%0

8
Nck�x�vx�� %1!s!0*gc�[x��
T1z0%0

D
Nck�x�vx�� %1!s!0x���]�}��c�[N�N!k�N
N0%0

D
Nck�x�vx�� %1!s!0x���]�}��c�[N�N!k�N
N0%0

8
Nck�x�vx�� %1!s!0*gc�[x��<P0%0

8
Nck�x�vx�� %1!s!0x��
N/f^�g<P0%0

8
Nck�x�vx�� %1!s!0
N/e�cdkx��0%0

,x�� %1!s! �v<P!qHe0%0

T
N�STBfc�[x�� structuredquery � logfile0%0

c�[*YY_xe0%0

 *gc�[�_��_xe0%0

gQ�/���0%0

8!q�l��_U:O
ghV�]\O���k: %1!s!0%0



!q�l���S�[�x0%0

*gc�[}T�N0%0

8!q�l��_U|vL�� %1!s! �v-N|~nj�e0%0

$!q�l��_U|vL��R	�0%0

 !q�lR	�|vL��0%0

(!q�l	�eQnj�n %1!s!0%0

<!q�l��_U|vL�� %1!s! �v�N�N-N|~nj�e0%0

<!q�lR	�|vL�� %1!s! �v�N�N-N|~nj�e0%0

!q�lI�o��N�N0%0

(!q�l{v���� %1!s!0%0

4!q�l���S���j %1!s! �v-��[0%0

4!q�l2QX[-��[b_U(u���j %1!s!0%0

<!q�l���S���j %1!s! �v���rKanj
�0%0

4!q�l	�eQ XML �e�N %1!s!0%0

4!q�l���S XML �{ޞ %1!s!0%0

�(Wnj
�n�U�jHh %1!s! -N~b
N0R

assembly/instrumentation/events:events b

events:instrumentationManifest/events:instrumentation/events:events

�{ޞ0

xmlns:events="http://schemas.microsoft.com/win/2004/08/events"

%0

,l\'` %1!s! �v<P!qHe0%0

,~b
N0R LCID %1!s!0%0

<-��[�j�v9h�{ޞ
N/f����bvQ}T
Tzz��
Nck�x0%0

0	Windows �N�N}T�NRlQ(uz_



�S���`�b�Sܕ�e�N�N���j�|vL���v�vܕnj
�0�[݈��d��[݈�N�Nnj
�n�U0

�WL��gb���N�S/S�Q0\X[�Tnd����j0



O(u�e_:



�`�SO(u!|�w (�O�Y�ep /uni) b�[te (�O�Y�enum-publishers /unicode)

Hr�v}T�N�x��
T1z0}T�N0x���Sx��<P
N@SR'Y\�[0



��xe�NhQ'Y�[h�:y0



wevtutil COMMAND [ARGUMENT [ARGUMENT] ...] [/OPTION:VALUE [/OPTION:VALUE] ...]



}T�N:



el | enum-logs          R�Q���j
T1z0

gl | get-log            �S�_���j-��[nj
�0

sl | set-log            �O9e���j-��[0

ep | enum-publishers    R�Q�N�N|vL��0

gp | get-publisher      �S�_|vL��-��[nj
�0

im | install-manifest   �_nj
�n�U�[݈�N�N|vL������j0

um | uninstall-manifest �_nj
�n�U�d��[݈�N�N|vL������j0

qe | query-events       �_���j�gb��N�N0

gli | get-log-info      �S�_���j�rKanj
�0

epl | export-log        /S�Q���j0

al | archive-log        \X[/S�Q�v���j0

cl | clear-log          nd����j0



}T�Nx��:



/{r | remote}:VALUE

�Y�gc�[�g(W`��z��f�
N�WL�}T�N0VALUE /f`��z��f�
T1z0x�� /im � /um


N/e�c`��z\Omi0



/{u | username}:VALUE

c�[vQ�N{veQ`��z��f��vO(u�0VALUE /fO(u�
T1z�<h_�p�}�W\O(u�bO(u�0

�_�c�[ /r x��Mbi�(u0



/{p | password}:VALUE

c�[KNO(u��v�[�x0�Y*gc�[�b�Y�g VALUE /f "*"��|q}\�c:yO(u�8�eQ�[�x0

�_�c�[ /u x��Mbi�(u0



/{a | authentication}:[Default|Negotiate|Kerberos|NTLM]

#��}�`��z��f��vW�I�^��W0�-�<P�p Negotiate0



/{uni | unicode}:[true|false]

�N Unicode o�:y8��Q0�Y�p true�g�N Unicode 8��Q0



傁��meQ�N�yr�[}T�N�ˊ8�eQ:



wevtutil COMMAND /?

8<P "%1!s!" 
\���x����!qHe0%0

�R�Q@b	g���j�v
T1z0



O(u�e_:



wevtutil { el | enum-logs }



�{�O:



NR�{�OgR�Q@b	g���j�v
T1z0



wevtutil el

 !q�l��_U�S�R	�0%0

!q�lR	��S�0%0

\o�:y�N�N���j-��[nj
��S�b���j/f&T_U(u0�vMR�v���j'Y\
NP��

�N�S2QX[���jKN�jHh�v_0



O(u�e_:



wevtutil { gl | get-log } <LOG_NAME> [/OPTION:VALUE [/OPTION:VALUE] ...]



<LOG_NAME>

/UNX�%R���j�vW[2N0�`�S�N�WL� wevtutil el��No�:y@b	g���j
T1zn�U0



x��:



�`�SO(u!|�w (�O�Y�/f) b�[te (�O�Y�/format)

Hr�vx��
T1z0x���Sx��<P
N@SR'Y\�[0



/{f | format}:[XML|Text]

c�[���j<h_0�-�<P�p Text0�Y�gc�[ XML�8��Qg�N XML <h_2QX[0

�Y�gc�[ Text�2QX[�v8��Q\
N+T XML j�0



�{�O:



NR�{�Og�N XML <h_o�:yܕ�e,g_j�|q}���j�v-��[nj
�0



wevtutil gl System /f:xml

t�O9e���j-��[0



O(u�e_:



wevtutil { sl | set-log } <LOG_NAME> [/OPTION:VALUE [/OPTION:VALUE] ...]



<LOG_NAME>

/UNX�%R���j�vW[2N0�Y�gc�[x�� /c�GR
N�ac�[ <LOG_NAME>��V�pg�_-��[�j

���Sr�nj
�0



x��:



�`�SO(u!|�w (�O�Y�/e) b�[te (�O�Y�/enabled) Hr�vx��
T1z0

x���Sx��<P
N@SR'Y\�[0



/{e | enabled}:[true|false]

_U(ub\P(u���j0



/{q | quiet}:[true|false]

�[\�o�:yx��0O(u�
Ngw0R�NUO�c:yb
�o`0�Y*g

c�[��-�<P�p true0



/{fm | filemax}:<n>

-��[���OYu�N�N�v_U(u��vxe�v
NP��vQ-N�v <n> /f

�N�e 1 �T 16 KN���vtexe0�kP_U(u��vg�^�zNP�jHh��Vdk��Y�g

dk<P�p 2�\g�_MRiQP_U(u��v"uu�N�N0͑�e��_j

g���p\P(u�_�Q͑�e_U(u�S�0

  

/{i | isolation}:[system|application|custom]

���j���!j_0���j�v���!j_zl�[�N���j/f&T

�TN���^�%R-N�vvQ�N���jqQ(u�]\O���k0�Y�g�`

c�[�|q}�����vj���j\�\��|q}���jqQ(u�[

eQ
kP�0�Y�g�`c�[�a(uz_�����vj���j\�\

��a(uz_���jqQ(u�[eQ
kP�0�Y�g�`c�[����

���`_N�_�O(u /ca x���c�O�[hQ'`�c�CQ0



/{lfn | logfilename}:VALUE

���j
T1z0VALUE /f�N�N���j
g�R2QX[dk���j�N�NKN

�jHh�v�[te_0



/{rt | retention}:[true|false]

���j�OYu!j_0���j�OYu!j_zl�[�N���jT�0R'Y\


NP�Bf�v�N�N���j
g�RL��p0�Y�g�gP�N�N���jT�0R

vQ'Y\
NP��N���j�OYu!j_�p true�GRg�OYu�s	g�v

�N�N�&Nhc�h#�eQ�N�N0�Y�g���j�OYu!j_�p false�#�

eQ�N�Ng���[���j-Ng
��v�N�N0



/{ab | autobackup}:[true|false]

���j��R�P�N�SGR0�Y�g��R�P�N�p true�vu���jT�0R'Y\
N

P�Bf\��R�P�N0�SY��Y�g��R�P�N�p true��OYu (�N /rt x��

c�[) �_�-��p true0



/{ms | maxsize}:<n>

���j'Y\
NP��vQ-N�v <n> /fMOCQD}xe�v0ˊ�la�<n> �vg\<P

�p 1048576 (1024KB)�����j8l`�g/f 64KB �v
Pxe��Vdkg�L��V

hc�NeQc�[�v<P0



/{l | level}:<n>

���j�vd\}�{x��vQ-N�v <n> /f�NN	gHe�vd\}<P0�Pi�(u�e	g

\(u�]\O���k�v���j0�`�S�N\ <n> -��p 0 �N�yd�d\}�{x�0



/{k | keywords}:VALUE

���j�vܕu�W[�{x�0VALUE �S�N/f�NN	gHe�v 64 MOCQܕu�W[n�i0

�Pi�(u�e	g\(u�]\O���k�v���j0



/{ca | channelaccess}:VALUE

�N�N���j�vX[�S
kP�0VALUE /fO(u Security Descriptor Definition Language

(SDDL) c�[�v�[hQ'`�c�CQ0ˊd\ MSDN

(http://msdn.microsoft.com)��N�ܕ�e SDDL <h_�vnj
�0



/{c | config}:VALUE

-��[�j�v_�vQ-N�v VALUE /f�[te�jHh_0�Y�gc�[�

\�_dk-��[�j���S��l\'`0�Y�gc�[dkx���GR
N�_c�[

<LOG_NAME> }T�NR�Sxe0���j
T1z\g�r�-��[�j-N

���S0



�{�O:



NR�{�OgO(u-��[�j�O-��[�a(uz_���j�v�OYu!j_0��R�P�N�SGR��N�S���j�v

'Y\
NP�0ˊ�la�-��[�j/f XML �jHh�<h_� wevtutil gl <LOG_NAME> /f:xml �v8�

�Q�vT0



C:\config.xml

<?xml version="1.0" encoding="UTF-8"?>

<channel name="Application" isolation="Application"

         xmlns="http://schemas.microsoft.com/win/2004/08/events">

  <logging>

    <retention>true</retention>

    <autoBackup>true</autoBackup>

    <maxSize>9000000</maxSize>

  </logging>

  <publishing>

  </publishing>

</channel>



wevtutil sl /c:config.xml

�R�Q�N�N|vL��0



O(u�e_:



wevtutil { ep | enum-publishers }



�{�O:



NR�{�OgR�Q�vMR��f�
N�v�N�N|vL��0



wevtutil ep

��S�_�N�N|vL���v-��[nj
�0



O(u�e_:



wevtutil { gp | get-publisher } <PUBLISHER_NAME> [/OPTION:VALUE [/OPTION:VALUE] ...]



<PUBLISHER_NAME>

/UNX�%R�N�N|vL���vW[2N0�`�S�N8�eQ wevtutil ep��N�S�_|vL��
T1zn�U0



x��:



�`�SO(u!|�w (�O�Y�/f) b�[te (�O�Y�/format) Hr�vx��
T1z0x���Sx��<P
N@S

R'Y\�[0



/{ge | getevents}:[true|false]

�S�_dk|vL��@b|v�Q�N�N�v-N|~nj�enj
�0



/{gm | getmessage}:[true|false]

o�:y�[���v
�o`��^�xe<P
�o`X�%R�x0



/{f | format}:[XML|Text]

c�[���j<h_0�-�<P�p Text0�Y�gc�[ XML�g�N XML <h_RpS8��Q0

�Y�gc�[ Text�RpS�v8��Q\
N+T XML j�0



�{�O:



NR�{�Ogo�:yܕ�e Microsoft-Windows-Eventlog �N�N|vL���vnj
��S�bܕ�e

|vL���S|v�QKN�N�N�v-N|~nj�e0



wevtutil gp Microsoft-Windows-Eventlog /ge:true

\	�_�N�N���j0���jbO(uP}�iS�gb����S�N�N0



O(u�e_:



wevtutil { qe | query-events } <PATH> [/OPTION:VALUE [/OPTION:VALUE] ...]



<PATH>

�Ogq�-���`���p <PATH> �Sxe�c�O���j
T1z0
NN���Y�g�`O(u /lf x���

GR�_��p <PATH> �Sxe�c�O���j�v_0

�Y�g�`O(u /sq �Sxe�GR�_��c�OS+TP}�iS�gb�KN�jHh�v_0



x��:



�`�SO(u!|�w (�O�Y�/f) b�[te (�O�Y�/format) Hr�vx��
T1z0x���Sx��<P


N@SR'Y\�[0



/{lf | logfile}:[true|false]

�Y�p true�<PATH> /f���j�v�[te_0



/{sq | structuredquery}:[true|false]

�Y�p true�<PATH> /fS+TP}�iS�gb�KN�jHh�v�[te_0



/{q | query}:VALUE

VALUE /f�{x�@b���S�N�N�v XPath �gb�0�Y*gc�[�\�P�V@b	g�N�N0

vu /sq �p true Bf�!q�lO(udkx��0



/{bm | bookmark}:VALUE

VALUE /fS+THQMR�gb��v�fd|KN�jHh�v�[te_0



/{sbm | savebookmark}:VALUE

VALUE /f2QX[dk�gb��v�fd|KN�jHh�v�[te_0oR�j
T�a�p .xml0



/{rd | reversedirection}:[true|false]

�N�N���S�eT0�Y�p true�\*QHQ�P�Vg�e�N�N0



/{f | format}:[XML|Text|RenderedXml]

�-�<P�p XML0�Y�gc�[ Text�g�Nf�e���S�v�eW[<h_RpS�N�N��^� XML <h_0

�Y�p RenderedXml�GRg�N XML <h_RpS+T	gI�o�nj
��v�N�N0ˊ�la�RpS

Text b RenderedXml <h_�v�N�N��kRpS XML <h_ba0



/{l | locale}:VALUE

VALUE /f�Nyr�[0W@S-��[RpS�N�N�eW[�v0W@S-��[W[2N0vuO(u /f x��RpS�eW[<h_�v

�N�NBfMb�S(u0



/{c | count}:<n>

�����S�v�N�Nxe�v
NP�0



/{e | element}:VALUE

8��Q�N�N XML Bf�S+T9hCQ }�N"uu<h_ck�x�v XML0

VALUE /f�`�`S+T(W9hCQ }gQ�vW[2N0�O�Y�c�[

/e:root g"uu+T	g9hCQ }
\ <root></root> �v8��Q XML0





�{�O:



NR�{�Og�N�eW[<h_o�:y�a(uz_���j-Ng�e�v	NP�N�N0



wevtutil qe Application /c:3 /rd:true /f:text

P�P querytype ��� LogFile Mb��O(ux���gb�0%0

 !q�l��_U�N�N�gb�0%0

((Wc�[�v�fd|~b
N0R�N�N0%0

,(Wc�[�v�N�N��~b
N0R�N�N0%0

!q�l���S�N�N0%0

4!q�l\�fd|2QX[�jHh "%1!s!"0%0

��S�_ܕ�e�N�N���jb���j�v�rKanj
�0



O(u�e_:



wevtutil { gli | get-loginfo } <LOG_NAME>



<LOG_NAME>

���j
T1zb���j_0�Y�gx�� /lf �p true�GR/f���j_�

N���j�v_/f�_���v0�Y�g /lf �p false�GR/f���j
T1z0�`�S�N8�eQ

wevtutil el �N�j�����j
T1zn�U0



x��:



�`�SO(u!|�w (�O�Y�/lf) b�[te (�O�Y�/logfile) Hr�vx��
T1z0x���Sx��<P
N@S

R'Y\�[0



/{lf | logfile}:[true|false]

c�[/f&T�^�z���j0�Y�p true�<LOG_NAME> �p���j_0



�{�O:



wevtutil gli Application

h�_�N�N���jnd��N�N��Sx��d'`0W�P�Nnd��v�N�N0



O(u�e_:



wevtutil { cl | clear-log } <LOG_NAME> [/OPTION:VALUE]



<LOG_NAME>

��nd�KN���j�v
T1z0�`�S�N8�eQ wevtutil el �N�b�S���j
T1zn�U0



x��:



�`�SO(u!|�w (�O�Y�/bu) b�[te (�O�Y�/backup) Hr�vx��
T1z0x���Sx��<P
N@S

R'Y\�[0



/{bu | backup}:VALUE

nd�KN�N�N�v�P�N�jHh0�Y�gc�[�nd��v�N�N\2QX[0Rr��P�N�jHh0�P�N�jHh
T1z-N

�S+T .evtx oR�j
T0



�{�O:



NR�{�OgHQ\�a(uz_���j-N�v@b	g�N�N2QX[0R C:\admin\backups\al0306.evtx�

6q�_�Qnd��[P0



wevtutil.exe cl Application /bu:C:\admin\backups\al0306.evtx

,!q�lnd����j %1!s!0%0

h�_���jbO(uP}�iS�gb��\�N�N/S�Q�jHh0



O(u�e_:



wevtutil { epl | export-log } <PATH> <TARGETFILE>

  [/OPTION:VALUE [/OPTION:VALUE] ...]



<PATH>

�Ogq�-���`���p <PATH> �c�O���j
T1z0
NN���Y�g�`O(u /lf x���

GR�_��p <PATH> <P�c�O���j�v_0�Y�g�`O(u /sq �Sxe�GR�_��c�OS+TP}�iS

�gb�KN�jHh�v_0



<TARGETFILE>

2QX[@b/S�Q�N�NKN�jHh�v_0



x��:



�`�SO(u!|�w (�O�Y�/l) b�[te (�O�Y�/locale) Hr�vx��
T1z0x���Sx��<P


N@SR'Y\�[0



/{lf | logfile}:[true|false]

�Y�p true�<PATH> /f���j�v_0



/{sq | structuredquery}:[true|false]

�Y�p true�<PATH> /fS+TP}�iS�gb�KN�jHh�v_0�Y�gx��S1�Y (FO^�@b	g�v) �N�N�

dk}T�N�S�����N�kBf��Mb���[b0



/{q | query}:VALUE

VALUE /f�{x���/S�QKN�N�N�v XPath �gb�0�Y*gc�[�\�P�V@b	g�N�N0vu /sq �p

true Bf�!q�lO(udkx��0�Y�gx��S1�Y (FO^�@b	g�v) �N�N�

dk}T�N�S�����N�kBf��Mb���[b0



/{ow | overwrite}:[true|false]

�Y�p true�Nc�[�e <TARGETFILE> -N�v�v�v�jHh�]X[(W�\g(W
N�x���v�`�lN���[

r��jHh0



�{�O:



NR�{�Og\�|q}���j-N�v�N�N/S�Q0R

C:\backup\system0506.evtx0



wevtutil epl System C:\backup\system0506.evtx

,!q�l/S�Q���j %1!s!0%0

��N�\_<h_\X[���j0gO(u0W@S-��[�v
T1z�^�zP[�v��@b	g0W@S-��[yr�[�v

nj
�g2QX[(Wr�P[�v�-N0vu archive-log }T�N�^�z�v�v�#�T���jNuOX[(WBf�

!q֊/f&T�]�[݈|vL����������S�jHh-N�v�N�N0



O(u�e_:



wevtutil { al | archive-log } <LOG_FILE> [/OPTION:VALUE [/OPTION:VALUE] ...]



<LOG_FILE>

��\X[�v���j0���j�SO(u export-log b clear-log }T�N"uu0



x��:



�`�SO(u!|�w (�O�Y�/l) b�[te (�O�Y�/locale) Hr�vx��
T1z0

x���Sx��<P
N@SR'Y\�[0



/{l | locale}:VALUE

VALUE /f�Nyr�[0W@S-��[\X[�jHh�v0W@S-��[W[2N0�Y*gc�[�\O(u�vMR�c6R�S

�v0W@S-��[0�Y�@b	g/e�c�v0W@S-��[W[2Nn�U�ˊ�S�� LocaleNameToLCID API �v

Microsoft Developer Network (MSDN) �e�N0

,!q�l\X[���j %1!s!0%0

(�[݈nj
�n�U-N�v�N�N|vL������j0



O(u�e_:



wevtutil { im | install-manifest  } <MANIFEST> [/OPTION:VALUE [/OPTION:VALUE] ...]



<MANIFEST>

�N�Nnj
�n�U�v�jHh_0\�[݈nj
�n�U-N�[��v@b	g|vL������j0

傁��meQ�N㉋N�Nnj
�n�U�O(udkx���vnj
��ˊ�S�

Microsoft Developers Network (MSDN) 
N�v Windows Eventing SDK�

�}@W�http://msdn.microsoft.com.



x��:



�`�SO(u!|�w (�O�Y�/rf) b�[te (�O�Y�/resourceFilePath) Hr�vx��
T1z0

x���Sx��<P
N@SR'Y\�[0





/{rf | resourceFilePath}:VALUE

nj
�n�U-N���S�N�v Provider CQ }�v ResourceFileName l\'`0



VALUE �a�pnj�n�jHh�v�[te_0



/{mf | messageFilePath}:VALUE

nj
�n�U-N���S�N�v Provider CQ }�v MessageFileName l\'`0

VALUE �a�p
�o`�jHh�v�[te_0



/{pf | parameterFilePath}::VALUE

nj
�n�U-N���S�N�v Provider CQ }�v ParameterFileName l\'`0

VALUE �a�p�Sxe�jHh�v�[te_0



�{�O:



NR�{�Og�[݈ myManifest.man nj
�n�U�jHh-N�v|vL���

���j0



wevtutil im myManifest.man /rf:^%systemroot^%/System32/wevtutil.exe

H�]�)R�[݈|vL����S��FO!q�l_U(uNbYP|vL����S�0%0

��d��[݈nj
�n�U-N�v�N�N|vL������j0



O(u�e_:



wevtutil { um | uninstall-manifest } <MANIFEST>



<MANIFEST>

�N�Nnj
�n�U�v�jHh_0\�d��[݈nj
�n�U-N�[��v@b	g|vL������j0

傁��meQ�N㉋N�Nnj
�n�U�O(udkx���vnj
��ˊ�S�

Microsoft Developers Network (MSDN) 
N�v Windows Eventing SDK�

�}@W�http://msdn.microsoft.com0



�{�O:



NR�{�Og�d��[݈ myManifest.man nj
�n�U�jHh-N�v|vL���

���j0



wevtutil um myManifest.man

(8�eQ %1!s! �v�[�x:%0

(!q�l���S�jHh %1!s!0%0

P�Y�g*gc�[x�� remote�GR!q�lO(ux�� username0%0

T�Y�g*gc�[x�� username�GR!q�lO(ux�� password0%0

d**** f�JT: _U(udk^��W�v���jg\�[nd�0�`��_U(u&Nnd�dk���j�U? [y/n]: 

�**** f�JT: ~b
N0R|vL�� %1 nj�n�bdknj�n!q�lX[�S

EventLog 
g�R3^6b (NT SERVICE\EventLog)0

|**** f�JT: |vL�� %1 �]�[݈�e�|q}
N0�Sg�X�R�e<P0�Y�g�`���f�eKNMR�v-��[�

ˊHQ�d��[݈nj
�n�U0

8nj
�n�U-N�v�c�O� %1 :\�S�
T1zl\'`0

Dnj
�n�U-N�v�c�O� %1 S+T�v�S� %2 :\^��Wl\'`0

4�c�O� %1{%2} :\�S�
T1zl\'`0

L�c�O� %1 nj
�n�U�[JT�NO(u
N/e�c�v^��W %3 �v�S� %2

L�c�O� %1 nj
�n�U�[JT�NO(u
N/e�c�v��� %3 �v�S� %2

4�]�[݈�c�O� %1�GUID �p %20

8�s	g�v�c�O� %2{%3} �]�[JT�S� %10

(�c�O�	giQP�S�wQ	g�vT<P0

(�c�O�:\ GUID l\'`0

,�c�O� %1 �v{v�-N:\
T1z0

8�c�O� %1{%2} �v{v�<P�xe�p %30

\�c�O� %1{%2} �v channelreferences {v�_j�xN:\�S�0

@�c�O� %1{%2} �v"}__j�x %3 :\�S�
T1z0

\�c�O� %1{%2} wQ	g�S� ("}_�p %3)�FOr��S�:\�-��v{v�

<P0

l**** f�JT: (Wnj�n�jHh-N~b
N0R|vL�� %10



resourceFileName: %2

x**** f�JT: ~b
N0R|vL�� %1 �vnj�n�jHhb!q�l��_U0



resourceFileName: %2

�**** f�JT: |vL�� %1 �vnj�n�jHh
NS+T-N|~nj�enj�n0

ˊ�R�_\0
�o`�}o�hV
0"uu�v .bin �jHh#�P}0Rc�[�v

�N2�MO�j0



resourceFileName: %2

<dkHr,g�v Windows 
N/e�c�[hQ�[�x8�eQ0%0

TdkHr,g�v Windows 
N�c�O�N�N���j
g�R0
N/e�c}T�N %1!s!0

�**** f�JT: dkHr,g�v Windows 
N
N�c�O�N�N���j
g�R0

|vL����S��]�)R�[݈�FO/fbP!q�l(W�l	gr�
g�R�v�`�lN�p %1!s! W�I�|vL���O�n0

<{v�-N�]�}X[(W�nj
�n�U-N�S�
T1z�vT�v
�Hr�S�0

0{v�-N�]�}X[(W
T�p %1 �v
�Hr�S�0

L{v�-N�]�}X[(W
T�p %1 �v
�Hr�S��\g�S�N�pnj
�n�U-N�v�S�0

�4VS_VERSION_INFO��
{aJ
{aJ?�StringFileInfo�040404B0LCompanyNameMicrosoft CorporationJFileDescriptionEventing }T�NRlQ(uz_n'FileVersion10.0.19041.7291 (WinBuild.160101.0800):
InternalNamewevtutil.exe�.LegalCopyright� Microsoft Corporation. All rights reserved.JOriginalFilenamewevtutil.exe.muij%ProductNameMicrosoft� Windows� Operating SystemDProductVersion10.0.19041.7291DVarFileInfo$Translation�PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING