def rule(event):
    if any(
        [
            event.deep_get("Image", default="").endswith("\\nimgrab.exe"),
            any(
                [
                    "MD5=2DD44C3C29D667F5C0EF5F9D7C7FFB8B" in event.deep_get("Hashes", default=""),
                    "SHA256=F266609E91985F0FE3E31C5E8FAEEEC4FFA5E0322D8B6F15FE69F4C5165B9559"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=C07FDDD21D123EA9B3A08EEF44AAAC45"
                    in event.deep_get("Hashes", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
