sysnetwk.exe

Microsoft Windows Operating System

Lei Qing

While the file properties state the file is developed by 'Microsoft Corporation', this is not the case and it is designed just to look like a legitimate Microsoft system file. The application sysnetwk.exe, “Windows System Network Core Module” by Lei Qing has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This executable runs as a local area network (LAN) Internet proxy server listening on port 8080 and has the ability to intercept and modify all inbound and outbound Internet traffic on the local host.
Publisher:
Microsoft Corporation  (signed by Lei Qing)

Product:
Microsoft Windows Operating System

Description:
Windows System Network Core Module

Version:
6.3.9600.17284 (aaa.140822-1915)

MD5:
c6a5692f9c154d71083479d37dcffc07

SHA-1:
2cdda967ad5d355f5391da40c1de5830a12da6f8

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
3/7/2026 2:25:09 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Adware.Elex.LeiQing.Meta (M)
16.7.9.11

File size:
10.4 MB (10,956,752 bytes)

Product version:
sysnetwk 2.4

Copyright:
Microsoft Corporation. All rights reserved.

Original file name:
sysnetwk.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Documents and Settings\{user}\Application data\microsoft\network\dsq\network\sysnetwk.exe

Digital Signature
Signed by:

Authority:
WoSign CA Limited

Valid from:
8/19/2015 3:00:23 AM

Valid to:
8/19/2016 3:00:23 AM

Subject:
CN=Lei Qing, L=Tianjin, S=Tianjin, C=CN

Issuer:
CN=WoSign Class 2 Code Signing CA, O=WoSign CA Limited, C=CN

Serial number:
2B8E845E7AA055FC643B525DF3001A41

File PE Metadata
OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
3.0

CTPH (ssdeep):
98304:BIe6OXyckgBTITQBKfX9ccxYXQVbSj8RPHEf8oKtHWjwa6jE:B6OXyckgBTIMBKfX9cxXQRSjSPHEfCjE

Entry address:
0x54020

Entry point:
83, EC, 0C, 8B, 44, 24, 0C, 8D, 5C, 24, 10, 89, 44, 24, 04, 89, 5C, 24, 08, C7, 04, 24, FF, FF, FF, FF, E9, 01, 00, 00, 00, CC, E9, 0B, D3, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 8B, 5C, 24, 04, 64, C7, 05, 34, 00, 00, 00, 00, 00, 00, 00, 89, E5, 8B, 4B, 04, 89, C8, C1, E0, 02, 29, C4, 89, E7, 8B, 73, 08, FC, F3, A5, FF, 13, 89, EC, 8B, 5C, 24, 04, 89, 43, 0C, 89, 53, 10, 64, 8B, 05, 34, 00, 00, 00, 89, 43, 14, C3, CC, CC, CC, CC, 83, EC, 18, C7, 04, 24, F4, FF, FF, FF, 89, E5, FF, 15, 58, A0...
 
[+]

Code size:
7.2 MB (7,573,504 bytes)

Local Proxy Server
Proxy for:
Internet Settings

Local host address:
http://127.0.0.1:8080/

Local host port:
8080

Default credentials:
No


Remove sysnetwk.exe - Powered by Reason Core Security