diff --git a/DeepBlueHash-collector.ps1 b/DeepBlueHash-collector.ps1
index c8de3a6..6e44d3f 100644
--- a/DeepBlueHash-collector.ps1
+++ b/DeepBlueHash-collector.ps1
@@ -1,20 +1,39 @@
-$hashdirectory=".\hashes\"
+$hashdirectory=".\hashes\"
 $events = get-winevent @{logname="Microsoft-Windows-Sysmon/Operational";id=1,6,7} 
 ForEach ($event in $events) {
     if ($event.id -eq 1){ # Process creation
-        $path=$event.Properties[3].Value   # Full path of the file
-        $hash=$event.Properties[11].Value  # Hashes
+        
+		if ($event.Properties.Count -le 16){
+		$path=$event.Properties[3].Value   # Full path of the file
+       		$hash=$event.Properties[11].Value  # Hashes
+		}
+		Else {
+		$path=$event.Properties[4].Value   # Full path of the file
+	        $hash=$event.Properties[16].Value  # Hashes		
+		}
     }
     Else{
         # Hash and path are part of the message field in Sysmon events 6 and 7. Need to parse the XML
         $eventXML = [xml]$event.ToXml()
         If ($event.id -eq 6){ # Driver (.sys) load    
-            $path=$eventxml.Event.EventData.Data[1]."#text" # Full path of the file
+            if ($event.Properties.Count -le 6){
+	    $path=$eventXML.Event.EventData.Data[1]."#text" # Full path of the file
             $hash=$eventXML.Event.EventData.Data[2]."#text" # Hashes
+	}
+	Else{
+		$path=$eventXML.Event.EventData.Data[2]."#text" # Full path of the file
+		$hash=$eventXML.Event.EventData.Data[3]."#text" # Hashes
+		}
         }
         ElseIf ($event.id -eq 7){ # Image (.dll) load
-            $path=$eventxml.Event.EventData.Data[4]."#text" # Full path of the file
+            if ($event.Properties.Count -lt 14){
+            $path=$eventXML.Event.EventData.Data[4]."#text" # Full path of the file
             $hash=$eventXML.Event.EventData.Data[5]."#text" # Hashes   
+		}
+	Else{
+		$path=$eventXML.Event.EventData.Data[5]."#text" # Full path of the file
+            	$hash=$eventXML.Event.EventData.Data[10]."#text" # Hashes   
+		} 
         }
         Else{
             Out-Host "Logic error 1, should not reach here..."