(Image:\\wusa.exe CommandLine:\/extract\:*) (CommandLine:\:\\PerfLogs\\* OR CommandLine:\:\\Users\\Public\\* OR CommandLine:\:\\Windows\\Temp\\* OR CommandLine:\\Appdata\\Local\\Temp\\*)