Versions

8.0.0.1	12.50%
8.0.0.1	12.50%
6.0.0.1	37.50%
6.0.0.1	37.50%

There are 4 versions of quhlpsvc.exe in the wild, the latest version being 8.0.0.1. It is started as a Windows Service with the name 'Quick Update Service'. In addition, it is run under the context of the SYSTEM account with extensive privileges (the administrator accounts have the same privileges). The average file size is about 108.99 KB. The file is a digitally signed and issued to Quick Heal Technologies (Pvt) Ltd. by VeriSign. The executable is a .NET framework assembly utilizing the CLR. During the process's lifecycle, the typical CPU resource utilization is about 0.0003% including both foreground and background operations, the average private memory consumption is about 2.83 MB with the maximum memory reaching around 5.96 MB. Addionally, typically read and write I/O disk operations is about 92 Bytes per minute for reads and 2 Bytes per minute for writes.

Quick Update Helper Service is a module for the Quick Heal AntiVirus product that is designed to help protect against various phishing attacks. The Anti-Phishing modules is loaded by the Quick Heal Windows Service, Core Scanning Server.