sysnetwk.exe

Microsoft Windows Operating System

Lei Qing

While the file properties state the file is developed by 'Microsoft Corporation', this is not the case and it is designed just to look like a legitimate Microsoft system file. The application sysnetwk.exe, “Windows System Network Core Module” by Lei Qing has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This executable runs as a local area network (LAN) Internet proxy server listening on port 8080 and has the ability to intercept and modify all inbound and outbound Internet traffic on the local host.
Publisher:
Microsoft Corporation  (signed by Lei Qing)

Product:
Microsoft Windows Operating System

Description:
Windows System Network Core Module

Version:
6.3.9600.17284 (aaa.140822-1915)

MD5:
b8dba4c401d56a834f25f19eb6400d88

SHA-1:
d66bcc68601e40d14ad621501f3f5018da9325d1

SHA-256:
33576a24fbb531e8a594951f0180dff3e384e69e7164b967b52d7ae42aef47ed

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
3/7/2026 2:25:10 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Adware.Elex.LeiQing.Meta (M)
16.7.9.11

File size:
7.1 MB (7,428,048 bytes)

Product version:
sysnetwk 2.3

Copyright:
Microsoft Corporation. All rights reserved.

Original file name:
sysnetwk.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\ProgramData\microsoft\network\dsq\network\sysnetwk.exe

Digital Signature
Signed by:

Authority:
WoSign CA Limited

Valid from:
8/19/2015 5:00:23 AM

Valid to:
8/19/2016 5:00:23 AM

Subject:
CN=Lei Qing, L=Tianjin, S=Tianjin, C=CN

Issuer:
CN=WoSign Class 2 Code Signing CA, O=WoSign CA Limited, C=CN

Serial number:
2B8E845E7AA055FC643B525DF3001A41

File PE Metadata
OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
3.0

CTPH (ssdeep):
49152:nyDs0j0k2nts1qWX8skcHB7sTPr2LNl+NUBMNeX/TKZ/HDNXoWohlTpxa5XFt5PM:nyI0j0/ckVc3euoxa

Entry address:
0x52E90

Entry point:
83, EC, 0C, 8B, 44, 24, 0C, 8D, 5C, 24, 10, 89, 44, 24, 04, 89, 5C, 24, 08, C7, 04, 24, FF, FF, FF, FF, E9, 01, 00, 00, 00, CC, E9, 0B, D3, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 8B, 5C, 24, 04, 64, C7, 05, 34, 00, 00, 00, 00, 00, 00, 00, 89, E5, 8B, 4B, 04, 89, C8, C1, E0, 02, 29, C4, 89, E7, 8B, 73, 08, FC, F3, A5, FF, 13, 89, EC, 8B, 5C, 24, 04, 89, 43, 0C, 89, 53, 10, 64, 8B, 05, 34, 00, 00, 00, 89, 43, 14, C3, CC, CC, CC, CC, 83, EC, 18, C7, 04, 24, F4, FF, FF, FF, 89, E5, FF, 15, 58, 00...
 
[+]

Code size:
4.7 MB (4,974,080 bytes)

Local Proxy Server
Proxy for:
Internet Settings

Local host address:
http://127.0.0.1:8080/

Local host port:
8080

Default credentials:
No


Remove sysnetwk.exe - Powered by Reason Core Security