index=* sourcetype="xmlwineventlog:microsoft-windows-sysmon/operational" EventCode=1 | rex field=Image "[\\\/](?<filename>[^\\\/]*)$" | eval filename=lower(filename)| stats dc(filename) as NumFilenames values(filename) as Filenames values(Image) as Images by Hashes | where NumFilenames>1