EventID:854 ((Path:\:\/Perflogs\/* OR Path:\:\/Users\/Public\/* OR Path:\:\/Windows\/Temp\/* OR Path:\/AppdData\/Local\/Temp\/* OR Path:\/Desktop\/* OR Path:\/Downloads\/*) OR (Path:\:\\PerfLogs\\* OR Path:\:\\Users\\Public\\* OR Path:\:\\Windows\\Temp\\* OR Path:\\AppdData\\Local\\Temp\\* OR Path:\\Desktop\\* OR Path:\\Downloads\\*))