def rule(event):
    if any(
        [
            event.deep_get("Image", default="").endswith("\\NimScan.exe"),
            any(
                [
                    "IMPHASH=41BB1C7571B3A724EB83A1D2B96DBB8C"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=B1B6ADACB172795480179EFD18A29549"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=0D1F896DC7642AD8384F9042F30279C2"
                    in event.deep_get("Hashes", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
