If the Service Host: Windows Event Log process is having a high CPU, Disk, Memory, Power usage on your computer, use these fixes.

In the file monitor log after the installer starts to rollback i notice something is written to this file C windows\system32\config\software.log I think the files in here are used by the event log ...

Finding ransomware traces in Event Logs The investigation strategy proposed by JPCERT/CC covers four types of Windows Event Logs: Application, Security, System, and Setup logs.