Filefix sample query

index=* EventCode=1 source="WinEventLog:Microsoft-Windows-Sysmon/Operational"
| eval ParentImage_lower=lower(ParentImage)
| eval Image_lower=lower(Image)
| where (
    (match(ParentImage_lower, ".*\\\\chrome\.exe$") OR
     match(ParentImage_lower, ".*\\\\brave\.exe$") OR
     match(ParentImage_lower, ".*\\\\firefox\.exe$") OR
     match(ParentImage_lower, ".*\\\\msedge\.exe$") OR
     match(ParentImage_lower, ".*\\\\iexplore\.exe$"))
    AND
    (match(Image_lower, ".*\\\\powershell\.exe$") OR
     match(Image_lower, ".*\\\\pwsh\.exe$") OR
     match(Image_lower, ".*\\\\cmd\.exe$") OR
     match(Image_lower, ".*\\\\wscript\.exe$") OR
     match(Image_lower, ".*\\\\cscript\.exe$") OR
     match(Image_lower, ".*\\\\mshta\.exe$") OR
     match(Image_lower, ".*\\\\rundll32\.exe$") OR
     match(Image_lower, ".*\\\\regsvr32\.exe$") OR
     match(Image_lower, ".*\\\\bitsadmin\.exe$") OR
     match(Image_lower, ".*\\\\certutil\.exe$") OR
     match(Image_lower, ".*\\\\schtasks\.exe$") OR
     match(Image_lower, ".*\\\\at\.exe$") OR
     match(Image_lower, ".*\\\\wmic\.exe$") OR
     match(Image_lower, ".*\\\\forfiles\.exe$") OR
     match(Image_lower, ".*\\\\pcalua\.exe$") OR
     match(Image_lower, ".*\\\\msiexec\.exe$") OR
     match(Image_lower, ".*\\\\installutil\.exe$") OR
     match(Image_lower, ".*\\\\regasm\.exe$") OR
     match(Image_lower, ".*\\\\regsvcs\.exe$") OR
     match(Image_lower, ".*\\\\msxsl\.exe$") OR
     match(Image_lower, ".*\\\\odbcconf\.exe$") OR
     match(Image_lower, ".*\\\\ieexec\.exe$") OR
     match(Image_lower, ".*\\\\hh\.exe$") OR
     match(Image_lower, ".*\\\\makecab\.exe$") OR
     match(Image_lower, ".*\\\\expand\.exe$") OR
     match(Image_lower, ".*\\\\extrac32\.exe$") OR
     match(Image_lower, ".*\\\\findstr\.exe$") OR
     match(Image_lower, ".*\\\\sc\.exe$") OR
     match(Image_lower, ".*\\\\net\.exe$") OR
     match(Image_lower, ".*\\\\net1\.exe$") OR
     match(Image_lower, ".*\\\\netsh\.exe$") OR
     match(Image_lower, ".*\\\\nltest\.exe$") OR
     match(Image_lower, ".*\\\\whoami\.exe$") OR
     match(Image_lower, ".*\\\\tasklist\.exe$") OR
     match(Image_lower, ".*\\\\query\.exe$") OR
     match(Image_lower, ".*\\\\qprocess\.exe$") OR
     match(Image_lower, ".*\\\\qwinsta\.exe$") OR
     match(Image_lower, ".*\\\\rwinsta\.exe$") OR
     match(Image_lower, ".*\\\\logoff\.exe$") OR
     match(Image_lower, ".*\\\\shutdown\.exe$") OR
     match(Image_lower, ".*\\\\taskkill\.exe$") OR
     match(Image_lower, ".*\\\\gpresult\.exe$") OR
     match(Image_lower, ".*\\\\systeminfo\.exe$") OR
     match(Image_lower, ".*\\\\dism\.exe$") OR
     match(Image_lower, ".*\\\\bcdedit\.exe$") OR
     match(Image_lower, ".*\\\\vssadmin\.exe$") OR
     match(Image_lower, ".*\\\\wbadmin\.exe$") OR
     match(Image_lower, ".*\\\\diskpart\.exe$") OR
     match(Image_lower, ".*\\\\fsutil\.exe$") OR
     match(Image_lower, ".*\\\\cipher\.exe$") OR
     match(Image_lower, ".*\\\\sdbinst\.exe$") OR
     match(Image_lower, ".*\\\\control\.exe$") OR
     match(Image_lower, ".*\\\\appvlp\.exe$") OR
     match(Image_lower, ".*\\\\mavinject\.exe$") OR
     match(Image_lower, ".*\\\\dllhost\.exe$") OR
     match(Image_lower, ".*\\\\verclsid\.exe$") OR
     match(Image_lower, ".*\\\\psr\.exe$") OR
     match(Image_lower, ".*\\\\infdefaultinstall\.exe$") OR
     match(Image_lower, ".*\\\\cmstp\.exe$") OR
     match(Image_lower, ".*\\\\xwizard\.exe$") OR
     match(Image_lower, ".*\\\\fltmc\.exe$") OR
     match(Image_lower, ".*\\\\winrm\.exe$") OR
     match(Image_lower, ".*\\\\winrs\.exe$") OR
     match(Image_lower, ".*\\\\wusa\.exe$") OR
     match(Image_lower, ".*\\\\pkgmgr\.exe$") OR
     match(Image_lower, ".*\\\\driverquery\.exe$") OR
     match(Image_lower, ".*\\\\pnputil\.exe$") OR
     match(Image_lower, ".*\\\\devcon\.exe$") OR
     match(Image_lower, ".*\\\\sigverif\.exe$") OR
     match(Image_lower, ".*\\\\mmc\.exe$") OR
     match(Image_lower, ".*\\\\runas\.exe$") OR
     match(Image_lower, ".*\\\\runonce\.exe$") OR
     match(Image_lower, ".*\\\\runoncex\.exe$") OR
     match(Image_lower, ".*\\\\replace\.exe$") OR
     match(Image_lower, ".*\\\\print\.exe$") OR
     match(Image_lower, ".*\\\\scriptrunner\.exe$") OR
     match(Image_lower, ".*\\\\syncappvpublishingserver\.exe$") OR
     match(Image_lower, ".*\\\\presentationhost\.exe$")
)
)
| table _time, Computer, User, ParentImage, ParentCommandLine, Image, CommandLine, ProcessId, ParentProcessId, Hashes
| sort -_time