def rule(event):
    if any(
        [
            event.deep_get("ImageLoaded", default="").endswith("\\wfshbr64.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\ktmutil7odm.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\ktes.sys"),
            event.deep_get("ImageLoaded", default="").endswith(
                "\\a26363e7b02b13f2b8d697abb90cd5c3.sys"
            ),
            event.deep_get("ImageLoaded", default="").endswith("\\kt2.sys"),
            event.deep_get("ImageLoaded", default="").endswith(
                "\\4748696211bd56c2d93c21cab91e82a5.sys"
            ),
            event.deep_get("ImageLoaded", default="").endswith("\\malicious.sys"),
            event.deep_get("ImageLoaded", default="").endswith(
                "\\a236e7d654cd932b7d11cb604629a2d0.sys"
            ),
            event.deep_get("ImageLoaded", default="").endswith("\\spwizimgvt.sys"),
            event.deep_get("ImageLoaded", default="").endswith(
                "\\c94f405c5929cfcccc8ad00b42c95083.sys"
            ),
            event.deep_get("ImageLoaded", default="").endswith("\\fur.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\wantd.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\windbg.sys"),
            event.deep_get("ImageLoaded", default="").endswith(
                "\\4118b86e490aed091b1a219dba45f332.sys"
            ),
            event.deep_get("ImageLoaded", default="").endswith("\\gmer64.sys"),
            event.deep_get("ImageLoaded", default="").endswith(
                "\\1fc7aeeff3ab19004d2e53eae8160ab1.sys"
            ),
            event.deep_get("ImageLoaded", default="").endswith("\\poortry2.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\wintapix.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\daxin_blank6.sys"),
            event.deep_get("ImageLoaded", default="").endswith(
                "\\6771b13a53b9c7449d4891e427735ea2.sys"
            ),
            event.deep_get("ImageLoaded", default="").endswith("\\blacklotus_driver.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\air_system10.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\dkrtk.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\7.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\sense5ext.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\ktgn.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\ndislan.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\nlslexicons0024uvn.sys"),
            event.deep_get("ImageLoaded", default="").endswith(
                "\\be6318413160e589080df02bb3ca6e6a.sys"
            ),
            event.deep_get("ImageLoaded", default="").endswith("\\4.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\wantd_2.sys"),
            event.deep_get("ImageLoaded", default="").endswith(
                "\\e29f6311ae87542b3d693c1f38e4e3ad.sys"
            ),
            event.deep_get("ImageLoaded", default="").endswith("\\daxin_blank3.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\gftkyj64.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\daxin_blank2.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\wantd_4.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\reddriver.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\834761775.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\mlgbbiicaihflrnh.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\mjj0ge.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\daxin_blank.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\daxin_blank5.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\poortry1.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\msqpq.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\mimidrv.sys"),
            event.deep_get("ImageLoaded", default="").endswith(
                "\\e939448b28a4edc81f1f974cebf6e7d2.sys"
            ),
            event.deep_get("ImageLoaded", default="").endswith("\\prokiller64.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\nodedriver.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\wantd_3.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\lctka.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\kapchelper_x64.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\daxin_blank4.sys"),
            event.deep_get("ImageLoaded", default="").endswith(
                "\\a9df5964635ef8bd567ae487c3d214c4.sys"
            ),
            event.deep_get("ImageLoaded", default="").endswith("\\wantd_6.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\ntbios.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\wantd_5.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\pciecubed.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\mimikatz.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\nqrmq.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\2.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\poortry.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\ntbios_2.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\fgme.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\telephonuafy.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\typelibde.sys"),
            event.deep_get("ImageLoaded", default="").endswith("\\daxin_blank1.sys"),
            event.deep_get("ImageLoaded", default="").endswith(
                "\\ef0e1725aaf0c6c972593f860531a2ea.sys"
            ),
            event.deep_get("ImageLoaded", default="").endswith(
                "\\5a4fe297c7d42539303137b6d75b150d.sys"
            ),
        ]
    ):
        return True
    return False
