Fals positive Report on Simple-Help.com #6058

Rule UUID

693a44e9-7f26-4cb6-b787-214867672d3a

Example EventLog

Hashes:SHA1=5017D1862F8856A97473E9A7E71F61736A038EB9,MD5=DFCDCEE2864C207D66D89E2560CE66A5,SHA256=1A673341796145F7BCF26F8AB9E9A88D54B28A19DCDBAD2BB539C44EE2EE4820,IMPHASH=8627ACFA518D8AB1999ED9FBB56F3B09
Image:C:\Users\Bruno\Desktop\ARADOS-Help.exe
EventID:29
TargetFilename:C:\Users\Bruno\AppData\Roaming\JWrapper-Remote Support\JWrapper-Remote Support Bundle-00122956108\JWrapperTemp-1781017728-2-app\jwutils_win64.dll

Hashes:SHA1=CB32EEFF09764B45E0FF2A878A4D5D0CC99055B4,MD5=5B4BBC684CB72E1385434B57A2E6CEBE,SHA256=756099653163515BCA887999E699806F3F49D8E765041F55B7DA1B5BEDFFD1B0,IMPHASH=757492C5713605BC46A20F88C2B4BA5E
Image:C:\Users\Bruno\Desktop\ARADOS-Help.exe
EventID:29
TargetFilename:C:\Users\Bruno\AppData\Roaming\JWrapper-Remote Support\JWrapper-Remote Support Bundle-00122956108\JWrapperTemp-1781017728-2-app\session_win.exe

Hashes:SHA1=00D40F95B6BE6F147386FEB5A3CE956811A3E927,MD5=EBD2468FA5872647D96F6DAD425A59CD,SHA256=800B4A758F509649839B96B7A1C5CA5EE70AAE840C68C7B1290C80F2DDDD8F4E,IMPHASH=46937D478C9E39D70E118E173A6BEBEF
Image:C:\Users\Bruno\Desktop\ARADOS-Help.exe
EventID:29
TargetFilename:C:\Users\Bruno\AppData\Roaming\JWrapper-Remote Support\JWrapper-Remote Support Bundle-00122956108\JWrapperTemp-1781017728-2-app\elev_win.exe

Hashes:SHA1=0B8B6247A8B15AB5D5755DC0AEBA35ED23D2D760,MD5=B55DD6B98F8CE77DE7F655313F65C452,SHA256=A82BB45AA96A199D0E7A63DFCF8650B3C519DC34BFE85572A5E702484B18CE4E,IMPHASH=D08C4E7EA99294003F89278D84E700A7
Image:C:\Users\Bruno\Desktop\ARADOS-Help.exe
EventID:29
TargetFilename:C:\Users\Bruno\AppData\Roaming\JWrapper-Remote Support\JWrapper-Remote Support Bundle-00122956108\JWrapperTemp-1781017728-2-app\jwutils_win32.dll

Hashes:SHA1=741C2D32B818309B16DA4931618F963F4777F27D,MD5=56CFEA9E1F0E665CBF17417CB36C6E34,SHA256=11C69DF5821EC766365E795CF3D3E3F70A3609DC035FA1D3CCB381EEA348CE82,IMPHASH=30AB6A828862FCC8CBA39462248B734C
Image:C:\Users\Bruno\Desktop\ARADOS-Help.exe
EventID:29
TargetFilename:C:\Users\Bruno\AppData\Roaming\JWrapper-Remote Support\JWrapper-Remote Support Bundle-00122956108\JWrapperTemp-1781017728-2-app\SimpleService.exe

Description

The file that rule detects is https://www.virustotal.com/gui/file/aef080a6f94557b00cde715f64d7646593ba10a101c3c868c8af4f39bd871192/detection
It is a instance of Simple Help used for remote support of customers.