During a threat hunt in Microsoft Defender XDR Advanced Hunting, an analyst wants to find all files with the name 'update.ps1' that were created on any onboarded device within the last 7 days, and return only the device name, file folder path, and the initiating process account. Which KQL query best accomplishes this goal while following efficient query design?