RMM
PChelpware
PChelpware (also known as PCHelpWare) is a free and open-source remote support and remote desktop software developed by the UltraVNC team. Built on VNC technology and following the RFB protocol, PChelpware is designed specifically for remote technical support scenarios, virtual training, and helpdesk operations.
Tool overview
- Category
- RMM
- Research authors
- Daniel Koifman (KoifSec)
- Created
- 2025-11-12
- Last modified
- 2025-11-12
- Privileges
- User
- Free / availability
- Yes
- Verification required
- Yes
- Supported platforms
Windows
Capabilities
Executables & installation paths
Installation paths
*\PcHelpWare_viewer.exe
FORENSIC EVIDENCE
Disk artifacts
- File
- C:\temp_phw
- Description
- Folder that is created upon PcHelpWare execution
- OS
- Windows
Detections
- Splunk
- https://raw.githubusercontent.com/Koifman/Deathcon25/refs/heads/main/rmm_rodeo/pchelpware/spl.spl
- Description
- Splunk SPL query detecting PChelpware activity through Sysmon EventCode 1 (process creation).