RMM
HelpWire
HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates.
Tool overview
- Category
- RMM
- Research authors
- Michael Haag
- Created
- 2026-05-22
- Last modified
- 2026-05-22
- Privileges
- User context for attended Quick Connect; elevated/root authorization may be requested for privileged actions, and unattended access can install a service/daemon after client approval.
- Free / availability
- Yes
- Verification required
- Official public installers downloaded from helpwire.app/get.helpwire.app on 2026-05-22; Windows Authenticode signature verified with osslsigncode, macOS app verified as notarized Developer ID, and Windows/macOS/Linux public artifacts queried in VirusTotal with 0 malicious and 0 suspicious detections.
- Supported platforms
Linux
Windows
macOS
Capabilities
Executables & installation paths
- Filename
- HelpWire Quick.exe
- OriginalFileName
- helpwire.exe
- Description
- HelpWire Operator
Installation paths
helpwire.exe
HelpWire Quick.exe
HelpWire.lnk
HelpWire Unattended Access.lnk
/Applications/HelpWire Operator.app
helpwire-operator/bin/helpwire-operator
/lib/systemd/system/helpwire-unattended.service
Code signing
- signer name
- Electronic Team, Inc.
- issuer
- DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
- certificate thumbprint
- 14C914AE140C6560793EBE42E7BB6AB7F5F56168
- tbs sha256
- 79A081B4DA60339A549DD378BEF3EB4B731177668B9D42D74B50745EE8CA84E1
- tbs sha1
- BD13E42C0FF14E0E7B74A9A2AFB395B5E0B16D89
- valid from
- 2024-07-31
- valid to
- 2027-07-30
- src file sha256
- 9de79ff72aa09670b3d7115e9e92e1fb7e95efb607d1dab402bb7d0994fbbcec
- src file path
- downloaded_files/helpwire/9de79ff72aa09670b3d7115e9e92e1fb7e95efb607d1dab402bb7d0994fbbcec
- src file company
- Electronic Team, Inc.
search names
HelpWire Quick.exe
helpwire.exe
company names
Electronic Team, Inc.
signer names
Electronic Team, Inc.
FORENSIC EVIDENCE
Disk artifacts
- File
- helpwire.exe
- Description
- Windows HelpWire Operator / Quick Connect executable; observed original file name in PE metadata.
- OS
- Windows
- File
- HelpWire Quick.exe
- Description
- Public Windows Quick Connect download filename.
- OS
- Windows
- File
- HelpWire.lnk
- Description
- Windows Start Menu or desktop shortcut string embedded in the Windows client.
- OS
- Windows
- File
- HelpWire Unattended Access.lnk
- Description
- Windows unattended access shortcut string embedded in the Windows client.
- OS
- Windows
- File
- /Applications/HelpWire Operator.app
- Description
- macOS HelpWire Operator app bundle inside the public DMG.
- OS
- macOS
- File
- helpwire-operator/bin/helpwire-operator
- Description
- Linux Quick Connect operator executable inside the public tarball.
- OS
- Linux
- File
- /lib/systemd/system/helpwire-unattended.service
- Description
- Linux unattended access systemd service path embedded in the Linux client.
- OS
- Linux
FORENSIC EVIDENCE
Event log artifacts
- EventID
- 7045
- ProviderName
- Service Control Manager
- LogFile
- System
- ServiceName
- helpwire-unattended
- ImagePath
- Not recorded
- Description
- Potential Windows service installation event for HelpWire unattended access. Confirm exact Windows service name during live install triage.
FORENSIC EVIDENCE
Network artifacts
- Description
- HelpWire web, API, download, and signaling domains
- Domains
- helpwire.app
- get.helpwire.app
- api.helpwire.app
- staging.helpwire.app
- account.flexihub.com
- Ports
- 443
- Description
- HelpWire STUN / NAT traversal infrastructure observed in client strings
- Domains
- stun.helpwire.app
- stunserver.stunprotocol.org
- Ports
- 3478
FORENSIC EVIDENCE
Other artifacts
- Type
- URI Scheme
- Value
- helpwire://
- Type
- Windows Authenticode SHA256
- Value
- 9de79ff72aa09670b3d7115e9e92e1fb7e95efb607d1dab402bb7d0994fbbcec
- Type
- macOS DMG SHA256
- Value
- 8224b40d1a55e123166643dcb3f976a7b193ed1bac653b5ca6acc8c7760ceaa2
- Type
- Linux Quick Connect tarball SHA256
- Value
- 1455062fa16b23e95faef4f705fad630343df360ace56dd9ffe456eff4321d09
Detections
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/helpwire_network_sigma.yml
- Description
- Detects potential network activity of HelpWire RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/helpwire_files_sigma.yml
- Description
- Detects potential files activity of HelpWire RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/helpwire_processes_sigma.yml
- Description
- Detects potential processes activity of HelpWire RMM tool
References
- https://www.helpwire.app/
- https://www.helpwire.app/download/windows/
- https://www.helpwire.app/download/windows/thank-you/
- https://www.helpwire.app/download/macos/thank-you/
- https://www.helpwire.app/download/linux/thank-you/
- https://www.helpwire.app/unattended-remote-access/
- https://kb.helpwire.app/operator-application/installation/
- https://kb.helpwire.app/unattended/request-unattended-access/
- https://kb.helpwire.app/unattended/connect/