ScriptBlockText:Remove\-EtwTraceProvider\ * OR (ScriptBlockText:Set\-EtwTraceProvider\ * ScriptBlockText:0x11*)