def rule(event):
    if any(
        [
            event.deep_get("Image", default="").endswith("\\AdFind.exe"),
            event.deep_get("OriginalFileName", default="") == "AdFind.exe",
            any(
                [
                    "IMPHASH=d144de8117df2beceaba2201ad304764"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=12ce1c0f3f5837ecc18a3782408fa975"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=bca5675746d13a1f246e2da3c2217492"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=4fbf3f084fbbb2470b80b2013134df35"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=49b639b4acbecc49d72a01f357aa4930"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=53e117a96057eaf19c41380d0e87f1c2"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=680dad9e300346e05a85023965867201"
                    in event.deep_get("Hashes", default=""),
                    "IMPHASH=21aa085d54992511b9f115355e468782"
                    in event.deep_get("Hashes", default=""),
                ]
            ),
        ]
    ):
        return True
    return False
