Versions

8.0.0.1	14.29%
8.0.0.1	14.29%
6.0.0.1	28.57%
6.0.0.1	42.86%

There are 4 versions of emlproxy.exe in the wild, the latest version being 8.0.0.1. It is started as a Windows Service with the name 'Core Mail Protection'. In addition, it is run under the context of the SYSTEM account with extensive privileges (the administrator accounts have the same privileges). The average file size is about 37.86 KB. The file is a digitally signed and issued to Quick Heal Technologies (Pvt) Ltd. by VeriSign. Some variations of the file have been seen to be installed with the program Quick Heal Internet Security from Quick Heal Technologies Pvt. Ltd.. The executable is a .NET framework assembly utilizing the CLR. During the process's lifecycle, the typical CPU resource utilization is about 0.0024% including both foreground and background operations, the average private memory consumption is about 49.13 MB. Addionally, typically read and write I/O disk operations is about 11.24 KB per minute for reads and 7.13 KB per minute for writes.

Mail Protection Service is a module for the Quick Heal AntiVirus product that is designed to help protect against various phishing attacks. The Anti-Phishing modules is loaded by the Quick Heal Windows Service, Core Scanning Server.