def rule(event):
    if any(
        [
            any(
                [
                    "\\WinDivert.sys" in event.deep_get("ImageLoaded", default=""),
                    "\\WinDivert64.sys" in event.deep_get("ImageLoaded", default=""),
                    "\\NordDivert.sys" in event.deep_get("ImageLoaded", default=""),
                    "\\lingtiwfp.sys" in event.deep_get("ImageLoaded", default=""),
                    "\\eswfp.sys" in event.deep_get("ImageLoaded", default=""),
                ]
            ),
            any(
                [
                    "IMPHASH=0604bb7cb4bb851e2168d5c7d9399087"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=2e5f0e649d97f32b03c09e4686d0574f"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=52f8aa269f69f0edad9e8fcdaedce276"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=c0e5d314da39dbf65a2dbff409cc2c76"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=58623490691babe8330adc81cd04a663"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=8ee39b48656e4d6b8459d7ba7da7438b"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=45ee545ae77e8d43fc70ede9efcd4c96"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=a1b2e245acd47e4a348e1a552a02859a"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=2a5f85fe4609461c6339637594fa9b0a"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=6b2c6f95233c2914d1d488ee27531acc"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=9f2fdd3f9ab922bbb0560a7df46f4342"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=d8a719865c448b1bd2ec241e46ac1c88"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=0ea54f8c9af4a2fe8367fa457f48ed38"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=9d519ae0a0864d6d6ae3f8b6c9c70af6"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=a74929edfc3289895e3f2885278947ae"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=a66b476c2d06c370f0a53b5537f2f11e"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=bdcd836a46bc2415773f6b5ea77a46e4"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=c28cd6ccd83179e79dac132a553693d9"
                    in event.deep_get("Hashes", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
