def rule(event):
    if any(
        [
            event.deep_get("Image", default="").endswith("\\SystemInformer.exe"),
            event.deep_get("OriginalFileName", default="") == "SystemInformer.exe",
            event.deep_get("Description", default="") == "System Informer",
            event.deep_get("Product", default="") == "System Informer",
            any(
                [
                    "MD5=19426363A37C03C3ED6FEDF57B6696EC" in event.deep_get("Hashes", default=""),
                    "SHA1=8B12C6DA8FAC0D5E8AB999C31E5EA04AF32D53DC"
                    in event.deep_get("Hashes", default=""),
                    "SHA256=8EE9D84DE50803545937A63C686822388A3338497CDDB660D5D69CF68B68F287"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=B68908ADAEB5D662F87F2528AF318F12"
                    in event.deep_get("Hashes", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
