def rule(event):
    if event.deep_get("TargetFilename", default="") in [
        "C:\\ProgramData\\GoogleUpdate\\config.dat",
        "C:\\ProgramData\\GoogleUpdate\\GoogleUpdate.exe",
        "C:\\ProgramData\\GoogleUpdate\\GoogleUpdate\\tmp.bat",
        "C:\\ProgramData\\GoogleUpdate\\goopdate.dll",
    ]:
        return True
    return False
