(Provider_Name:MsiInstaller (EventID:1040 OR EventID:1042) (Data:\:\\Windows\\TEMP\\* OR Data:\\\\* OR Data:\\Desktop\\* OR Data:\\PerfLogs\\* OR Data:\\Users\\Public\\*)) (-(Data:\\AppData\\Local\\Temp\\WinGet\\* OR Data:C\:\\Windows\\TEMP\\UpdHealthTools.msi*))