add four new sample scripts for working with evtx files