def rule(event):
    if any(
        [
            event.deep_get("TargetFilename", default="").endswith(
                ":\\ProgramData\\4800-84DC-063A6A41C5C"
            ),
            event.deep_get("TargetFilename", default="").endswith(":\\ProgramData\\clip.exe"),
            event.deep_get("TargetFilename", default="").endswith(":\\ProgramData\\DSROLE.dll"),
            event.deep_get("TargetFilename", default="").endswith(":\\ProgramData\\Forest64.exe"),
            event.deep_get("TargetFilename", default="").endswith(":\\ProgramData\\readme.md"),
            event.deep_get("TargetFilename", default="").endswith(":\\ProgramData\\Version.dll"),
            event.deep_get("TargetFilename", default="").endswith(
                ":\\ProgramData\\wsmprovhost.exe"
            ),
        ]
    ):
        return True
    return False
