sysnetwk.exe

Microsoft Windows Operating System

Lei Qing

While the file properties state the file is developed by 'Microsoft Corporation', this is not the case and it is designed just to look like a legitimate Microsoft system file. The application sysnetwk.exe, “Windows System Network Core Module” by Lei Qing has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This executable runs as a local area network (LAN) Internet proxy server listening on port 8080 and has the ability to intercept and modify all inbound and outbound Internet traffic on the local host.
Publisher:
Microsoft Corporation  (signed by Lei Qing)

Product:
Microsoft Windows Operating System

Description:
Windows System Network Core Module

Version:
6.3.9600.17284 (aaa.140822-1915)

MD5:
55d48a5ac4e24ab00ec9410c4fd3ebe1

SHA-1:
a81e651942eb2063b43e60b3920909ee13a487f1

SHA-256:
fc1f5348d1668fb974310c45f5b5effeaea7a69c11df74b9b51eec934ccb0762

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
3/7/2026 2:25:30 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Adware.Elex.LeiQing.Meta (M)
16.7.9.11

File size:
14.2 MB (14,852,000 bytes)

Product version:
sysnetwk 2.3

Copyright:
Microsoft Corporation. All rights reserved.

Original file name:
sysnetwk.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\ProgramData\microsoft\network\dsq\network\sysnetwk.exe

Digital Signature
Signed by:

Authority:
WoSign CA Limited

Valid from:
8/19/2015 5:00:23 AM

Valid to:
8/19/2016 5:00:23 AM

Subject:
CN=Lei Qing, L=Tianjin, S=Tianjin, C=CN

Issuer:
CN=WoSign Class 2 Code Signing CA, O=WoSign CA Limited, C=CN

Serial number:
2B8E845E7AA055FC643B525DF3001A41

File PE Metadata
OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
3.0

CTPH (ssdeep):
98304:y8w8dYYgW6QYQs9garyI0j0/ckVc3euoxa:Q8dYbW6QYF9gan60/ckVee5a

Entry address:
0x52A40

Entry point:
83, EC, 0C, 8B, 44, 24, 0C, 8D, 5C, 24, 10, 89, 44, 24, 04, 89, 5C, 24, 08, C7, 04, 24, FF, FF, FF, FF, E9, 01, 00, 00, 00, CC, E9, 0B, D3, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 8B, 5C, 24, 04, 64, C7, 05, 34, 00, 00, 00, 00, 00, 00, 00, 89, E5, 8B, 4B, 04, 89, C8, C1, E0, 02, 29, C4, 89, E7, 8B, 73, 08, FC, F3, A5, FF, 13, 89, EC, 8B, 5C, 24, 04, 89, 43, 0C, 89, 53, 10, 64, 8B, 05, 34, 00, 00, 00, 89, 43, 14, C3, CC, CC, CC, CC, 83, EC, 18, C7, 04, 24, F4, FF, FF, FF, 89, E5, FF, 15, 58, F0...
 
[+]

Code size:
4.7 MB (4,971,520 bytes)

Local Proxy Server
Proxy for:
Internet Settings

Local host address:
http://127.0.0.1:8080/

Local host port:
8080

Default credentials:
No


Remove sysnetwk.exe - Powered by Reason Core Security