def rule(event):
    if any(
        [
            all(
                [
                    any(
                        [
                            "\\EDR-Freeze" in event.deep_get("Image", default=""),
                            "\\EDRFreeze" in event.deep_get("Image", default=""),
                        ]
                    ),
                    event.deep_get("Image", default="").endswith(".exe"),
                ]
            ),
            any(
                [
                    "IMPHASH=1195F7935954A2CD09157390C33F8E8C"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=129F58DE3D687FB7F012BF6C3D679997"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=2C617A175D0086251642C6619F7CC8BA"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=8828F0B906F7844358FB92A899E9520F"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=AF76D95157EC554DC1EF178E4E66D447"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=E1B04316B61ACA31DD52ABBEC0A37FD5"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=8B2D5B54AFCFEC60D54F6B31D80ED4A0"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=AB8BB31EDD91D2A05FE7B62A535E9EB7"
                    in event.deep_get("Hashes", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
