def rule(event):
    if all(
        [
            any(
                [
                    "\\Sputnik\\Sputnik" in event.deep_get("FileName", default=""),
                    "\\MapleStudio\\ChromePlus" in event.deep_get("FileName", default=""),
                    "\\QIP Surf" in event.deep_get("FileName", default=""),
                    "\\BlackHawk" in event.deep_get("FileName", default=""),
                    "\\7Star\\7Star" in event.deep_get("FileName", default=""),
                    "\\CatalinaGroup\\Citrio" in event.deep_get("FileName", default=""),
                    "\\Google\\Chrome" in event.deep_get("FileName", default=""),
                    "\\Coowon\\Coowon" in event.deep_get("FileName", default=""),
                    "\\CocCoc\\Browser" in event.deep_get("FileName", default=""),
                    "\\uCozMedia\\Uran" in event.deep_get("FileName", default=""),
                    "\\Tencent\\QQBrowser" in event.deep_get("FileName", default=""),
                    "\\Orbitum" in event.deep_get("FileName", default=""),
                    "\\Slimjet" in event.deep_get("FileName", default=""),
                    "\\Iridium" in event.deep_get("FileName", default=""),
                    "\\Vivaldi" in event.deep_get("FileName", default=""),
                    "\\Chromium" in event.deep_get("FileName", default=""),
                    "\\GhostBrowser" in event.deep_get("FileName", default=""),
                    "\\CentBrowser" in event.deep_get("FileName", default=""),
                    "\\Xvast" in event.deep_get("FileName", default=""),
                    "\\Chedot" in event.deep_get("FileName", default=""),
                    "\\SuperBird" in event.deep_get("FileName", default=""),
                    "\\360Browser\\Browser" in event.deep_get("FileName", default=""),
                    "\\360Chrome\\Chrome" in event.deep_get("FileName", default=""),
                    "\\Comodo\\Dragon" in event.deep_get("FileName", default=""),
                    "\\BraveSoftware\\Brave-Browser" in event.deep_get("FileName", default=""),
                    "\\Torch" in event.deep_get("FileName", default=""),
                    "\\UCBrowser\\" in event.deep_get("FileName", default=""),
                    "\\Blisk" in event.deep_get("FileName", default=""),
                    "\\Epic Privacy Browser" in event.deep_get("FileName", default=""),
                    "\\Nichrome" in event.deep_get("FileName", default=""),
                    "\\Amigo" in event.deep_get("FileName", default=""),
                    "\\Kometa" in event.deep_get("FileName", default=""),
                    "\\Xpom" in event.deep_get("FileName", default=""),
                    "\\Microsoft\\Edge" in event.deep_get("FileName", default=""),
                    "\\Liebao7Default\\EncryptedStorage" in event.deep_get("FileName", default=""),
                    "\\AVAST Software\\Browser" in event.deep_get("FileName", default=""),
                    "\\Kinza" in event.deep_get("FileName", default=""),
                    "\\Mozilla\\SeaMonkey\\" in event.deep_get("FileName", default=""),
                    "\\Comodo\\IceDragon\\" in event.deep_get("FileName", default=""),
                    "\\8pecxstudios\\Cyberfox\\" in event.deep_get("FileName", default=""),
                    "\\FlashPeak\\SlimBrowser\\" in event.deep_get("FileName", default=""),
                    "\\Moonchild Productions\\Pale Moon\\"
                    in event.deep_get("FileName", default=""),
                ]
            ),
            any(
                [
                    "\\Profiles\\" in event.deep_get("FileName", default=""),
                    "\\User Data" in event.deep_get("FileName", default=""),
                ]
            ),
            any(
                [
                    any(
                        [
                            "\\Login Data" in event.deep_get("FileName", default=""),
                            "\\Cookies" in event.deep_get("FileName", default=""),
                            "\\EncryptedStorage" in event.deep_get("FileName", default=""),
                            "\\WebCache\\" in event.deep_get("FileName", default=""),
                        ]
                    ),
                    any(
                        [
                            event.deep_get("FileName", default="").endswith("cert9.db"),
                            event.deep_get("FileName", default="").endswith("cookies.sqlite"),
                            event.deep_get("FileName", default="").endswith("formhistory.sqlite"),
                            event.deep_get("FileName", default="").endswith("key3.db"),
                            event.deep_get("FileName", default="").endswith("key4.db"),
                            event.deep_get("FileName", default="").endswith("Login Data.sqlite"),
                            event.deep_get("FileName", default="").endswith("logins.json"),
                            event.deep_get("FileName", default="").endswith("places.sqlite"),
                        ]
                    ),
                ]
            ),
            not any(
                [
                    any(
                        [
                            event.deep_get("Image", default="").endswith("\\Sputnik.exe"),
                            event.deep_get("Image", default="").endswith("\\ChromePlus.exe"),
                            event.deep_get("Image", default="").endswith("\\QIP Surf.exe"),
                            event.deep_get("Image", default="").endswith("\\BlackHawk.exe"),
                            event.deep_get("Image", default="").endswith("\\7Star.exe"),
                            event.deep_get("Image", default="").endswith("\\Sleipnir5.exe"),
                            event.deep_get("Image", default="").endswith("\\Citrio.exe"),
                            event.deep_get("Image", default="").endswith("\\Chrome SxS.exe"),
                            event.deep_get("Image", default="").endswith("\\Chrome.exe"),
                            event.deep_get("Image", default="").endswith("\\Coowon.exe"),
                            event.deep_get("Image", default="").endswith("\\CocCocBrowser.exe"),
                            event.deep_get("Image", default="").endswith("\\Uran.exe"),
                            event.deep_get("Image", default="").endswith("\\QQBrowser.exe"),
                            event.deep_get("Image", default="").endswith("\\Orbitum.exe"),
                            event.deep_get("Image", default="").endswith("\\Slimjet.exe"),
                            event.deep_get("Image", default="").endswith("\\Iridium.exe"),
                            event.deep_get("Image", default="").endswith("\\Vivaldi.exe"),
                            event.deep_get("Image", default="").endswith("\\Chromium.exe"),
                            event.deep_get("Image", default="").endswith("\\GhostBrowser.exe"),
                            event.deep_get("Image", default="").endswith("\\CentBrowser.exe"),
                            event.deep_get("Image", default="").endswith("\\Xvast.exe"),
                            event.deep_get("Image", default="").endswith("\\Chedot.exe"),
                            event.deep_get("Image", default="").endswith("\\SuperBird.exe"),
                            event.deep_get("Image", default="").endswith("\\360Browser.exe"),
                            event.deep_get("Image", default="").endswith("\\360Chrome.exe"),
                            event.deep_get("Image", default="").endswith("\\dragon.exe"),
                            event.deep_get("Image", default="").endswith("\\brave.exe"),
                            event.deep_get("Image", default="").endswith("\\torch.exe"),
                            event.deep_get("Image", default="").endswith("\\UCBrowser.exe"),
                            event.deep_get("Image", default="").endswith("\\BliskBrowser.exe"),
                            event.deep_get("Image", default="").endswith(
                                "\\Epic Privacy Browser.exe"
                            ),
                            event.deep_get("Image", default="").endswith("\\nichrome.exe"),
                            event.deep_get("Image", default="").endswith("\\AmigoBrowser.exe"),
                            event.deep_get("Image", default="").endswith("\\KometaBrowser.exe"),
                            event.deep_get("Image", default="").endswith("\\XpomBrowser.exe"),
                            event.deep_get("Image", default="").endswith("\\msedge.exe"),
                            event.deep_get("Image", default="").endswith("\\LiebaoBrowser.exe"),
                            event.deep_get("Image", default="").endswith("\\AvastBrowser.exe"),
                            event.deep_get("Image", default="").endswith("\\Kinza.exe"),
                            event.deep_get("Image", default="").endswith("\\seamonkey.exe"),
                            event.deep_get("Image", default="").endswith("\\icedragon.exe"),
                            event.deep_get("Image", default="").endswith("\\cyberfox.exe"),
                            event.deep_get("Image", default="").endswith("\\SlimBrowser.exe"),
                            event.deep_get("Image", default="").endswith("\\palemoon.exe"),
                        ]
                    ),
                    any(
                        [
                            "\\Sputnik\\" in event.deep_get("Image", default=""),
                            "\\MapleStudio\\" in event.deep_get("Image", default=""),
                            "\\QIP Surf\\" in event.deep_get("Image", default=""),
                            "\\BlackHawk\\" in event.deep_get("Image", default=""),
                            "\\7Star\\" in event.deep_get("Image", default=""),
                            "\\Fenrir Inc\\" in event.deep_get("Image", default=""),
                            "\\CatalinaGroup\\" in event.deep_get("Image", default=""),
                            "\\Google\\" in event.deep_get("Image", default=""),
                            "\\Coowon\\" in event.deep_get("Image", default=""),
                            "\\CocCoc\\" in event.deep_get("Image", default=""),
                            "\\uCozMedia\\" in event.deep_get("Image", default=""),
                            "\\Tencent\\" in event.deep_get("Image", default=""),
                            "\\Orbitum\\" in event.deep_get("Image", default=""),
                            "\\Slimjet\\" in event.deep_get("Image", default=""),
                            "\\Iridium\\" in event.deep_get("Image", default=""),
                            "\\Vivaldi\\" in event.deep_get("Image", default=""),
                            "\\Chromium\\" in event.deep_get("Image", default=""),
                            "\\GhostBrowser\\" in event.deep_get("Image", default=""),
                            "\\CentBrowser\\" in event.deep_get("Image", default=""),
                            "\\Xvast\\" in event.deep_get("Image", default=""),
                            "\\Chedot\\" in event.deep_get("Image", default=""),
                            "\\SuperBird\\" in event.deep_get("Image", default=""),
                            "\\360Browser\\" in event.deep_get("Image", default=""),
                            "\\360Chrome\\" in event.deep_get("Image", default=""),
                            "\\Comodo\\" in event.deep_get("Image", default=""),
                            "\\BraveSoftware\\" in event.deep_get("Image", default=""),
                            "\\Torch\\" in event.deep_get("Image", default=""),
                            "\\UCBrowser\\" in event.deep_get("Image", default=""),
                            "\\Blisk\\" in event.deep_get("Image", default=""),
                            "\\Epic Privacy Browser\\" in event.deep_get("Image", default=""),
                            "\\Nichrome\\" in event.deep_get("Image", default=""),
                            "\\Amigo\\" in event.deep_get("Image", default=""),
                            "\\Kometa\\" in event.deep_get("Image", default=""),
                            "\\Xpom\\" in event.deep_get("Image", default=""),
                            "\\Microsoft\\" in event.deep_get("Image", default=""),
                            "\\Liebao7\\" in event.deep_get("Image", default=""),
                            "\\AVAST Software\\" in event.deep_get("Image", default=""),
                            "\\Kinza\\" in event.deep_get("Image", default=""),
                            "\\Mozilla\\" in event.deep_get("Image", default=""),
                            "\\8pecxstudios\\" in event.deep_get("Image", default=""),
                            "\\FlashPeak\\" in event.deep_get("Image", default=""),
                            "\\Moonchild Productions\\" in event.deep_get("Image", default=""),
                        ]
                    ),
                    all(
                        [
                            event.deep_get("Image", default="") == "System",
                            event.deep_get("ParentImage", default="") == "Idle",
                        ]
                    ),
                    any(
                        [
                            event.deep_get("Image", default="").startswith("C:\\Program Files\\"),
                            event.deep_get("Image", default="").startswith(
                                "C:\\Program Files (x86)\\"
                            ),
                            event.deep_get("Image", default="").startswith(
                                "C:\\Windows\\System32\\"
                            ),
                            event.deep_get("Image", default="").startswith(
                                "C:\\Windows\\SysWOW64\\"
                            ),
                        ]
                    ),
                ]
            ),
            not any(
                [
                    all(
                        [
                            "\\Microsoft\\Windows Defender\\"
                            in event.deep_get("Image", default=""),
                            any(
                                [
                                    event.deep_get("Image", default="").endswith(
                                        "\\MpCopyAccelerator.exe"
                                    ),
                                    event.deep_get("Image", default="").endswith("\\MsMpEng.exe"),
                                ]
                            ),
                        ]
                    ),
                    any(
                        [
                            event.deep_get("Image", default="").endswith("\\thor.exe"),
                            event.deep_get("Image", default="").endswith("\\thor64.exe"),
                        ]
                    ),
                    event.deep_get("ParentImage", default="")
                    == "C:\\Windows\\System32\\msiexec.exe",
                    event.deep_get("Image", default="").endswith("\\everything.exe"),
                ]
            ),
        ]
    ):
        return True
    return False
