GridinSoft Threat Intelligence

NETwtn04.sys threat report

Detected as Trojan.Generic File reputation report
MD5 e944ad1849c4b81b060963e78ca96ce0
Latest seen 2024-10-03 23:04:58 (2 years ago)
First seen 2024-10-03 23:04:58 (2 years ago)
Size 7 MB
Publisher Intel Corporation
Product Intel® Wireless WiFi Link Adapter

GridinSoft Anti-Malware detection

Detected by GridinSoft before you download

The current ThreatInfo record shows this exact file hash detected as Trojan.Generic. Download GridinSoft Anti-Malware to scan the device, confirm whether this file is present, and remove the detected object if it is found.

Detection name
Trojan.Generic
Recommended action
Scan and remove
Last analysis
2024-10-03 23:04:58 (2 years ago)
File hash
e944ad1849c4b81b060963e78ca96ce0
Download Anti-Malware

Why it matters

Why GridinSoft flags this file

Detection

GridinSoft identifies the sample as Trojan.Generic, part of the Trojan threat category.

Category context

Malware disguised as legitimate software or delivered through deceptive packaging. Related Trojan reports help compare this file with nearby detections, publishers, and hashes.

Timeline

First seen 2024-10-03 23:04:58 (2 years ago); latest analysis 2024-10-03 23:04:58 (2 years ago).

Publisher context

Company metadata: Intel Corporation. Product metadata: Intel® Wireless WiFi Link Adapter.

Observed locations

ThreatInfo has seen this file in user or system paths listed below. Unexpected locations increase the need for local verification.

Recommended action

What to do next

  1. Compare the MD5 above with the file found on the device.
  2. Check whether the file appears in the observed locations or under one of the alternate names.
  3. Run GridinSoft Anti-Malware to confirm the detection and remove the file if it is present. Review the Trojan category for related samples and common context.

File context

NETwtn04.sys is a Windows file recorded in the ThreatInfo database. It is associated with Intel® Wireless WiFi Link Adapter. The reported company name is Intel Corporation. The current detection status is Trojan.Generic, based on the latest analysis from 2024-10-03 23:04:58 (2 years ago). ThreatInfo groups this verdict with Trojan reports for broader family-level investigation.

If NETwtn04.sys appears on your computer unexpectedly, treat it as suspicious. Check its location, digital signature, and recent system changes before allowing it to run. A full anti-malware scan is recommended when this file is detected as Trojan.Generic.

File Details

Product Name: Intel® Wireless WiFi Link Adapter
Company Name: Intel Corporation
MD5: e944ad1849c4b81b060963e78ca96ce0
Size: 7 MB
First Published: 2024-10-03 23:04:58 (2 years ago)
Latest Published: 2024-10-03 23:04:58 (2 years ago)
Status: Trojan.Generic (on last analysis)
Analysis Date: 2024-10-03 23:04:58 (2 years ago)

Detection screenshot

NETwtn04.sys detection screenshot

The screenshot is a visual record of a GridinSoft Anti-Malware detection for this sample. Use the hash and metadata above as the primary identifiers when comparing the file on your system.

Common Places:

%sysdrive%\drivers\options\01_wlan\intel\wlan\win7plus\win32\drivers

ThreatInfo has observed NETwtn04.sys in the locations listed above. Files found in temporary folders, user profile folders, startup locations, or unusual application directories should be reviewed more carefully than files installed under a known program directory.

Geographic signal

Observed country distribution

ThreatInfo has seen NETwtn04.sys across 1 countries. Use this signal to compare local evidence with where the sample is most often reported.

Top country Germany
Share 100.0%
Low High activity

The strongest geographic signal for this file is Germany with 100.0% of observed hits. Geographic distribution can help identify targeted campaigns, regional software bundles, or where a file is most commonly reported.

OS Version:

Windows 10 100.0%

The most common operating system signal for NETwtn04.sys is Windows 10 with 100.0% of observed hits. If your system differs from the common profile, check whether the file was introduced by a specific installer, archive, or removable device.

Analysis

NETwtn04.sys is identified as pe for 32-bit systems. The subsystem is Native. PE header values are useful for triage, especially when they do not match the expected publisher, product, or release timeline.

Format pe
Architecture 32-bit
Subsystem Native
Entry point 0x00045c70
Image base 0x00400000

PE Sections:

Sections 33
Raw data 8137728

Section layout highlights raw-size concentration, repeated names, packer markers, and hashes that can be compared across related samples.

.text 4186624 bytes · 51.4% of section data
MD5 9e8d0331a24217c0d01cb659f3b5260e
.rdata 566784 bytes · 7.0% of section data
MD5 7ec5ab293fcbcb28c1b459090cdefb1b
.data 118272 bytes · 1.5% of section data
MD5 13e8a1d8a27625c576039b57831afb3c
PAGEcsrv 76288 bytes · 0.9% of section data
Uncommon name
MD5 cc4aa299c57b29b6193db53a475bab17
PAGEcjaw 90624 bytes · 1.1% of section data
Uncommon name
MD5 d7a94495b7f3ca1f9ffd61c7e5da980a
PAGEcwfd 104448 bytes · 1.3% of section data
Uncommon name
MD5 cec6adf27ad8c64d90caa62fb056ab28
PAGE 20480 bytes · 0.3% of section data
Uncommon name
MD5 e316202c0ffb3223fa57a48d47c7bcfe
PAGEcnlo 1536 bytes · 0.0% of section data
Uncommon name
MD5 e2604aed87aa24057124a240f09cc2be
PAGEccln 86528 bytes · 1.1% of section data
Uncommon name
MD5 4cd1979a081488d09c0cd8e572c7e474
PAGEcsec 29184 bytes · 0.4% of section data
Uncommon name
MD5 00b25bd0049b4737c2fc3b6d450ed0d4
PAGEcsv_ 68096 bytes · 0.8% of section data
Uncommon name
MD5 59cbd9b90962fb8c09dbdf3ee9270e57
PAGEcimg 7168 bytes · 0.1% of section data
Uncommon name
MD5 ec75b8e09a8645929a00c90d40eb2690
PAGEcpsm 5632 bytes · 0.1% of section data
Uncommon name
MD5 f00590b01a9a94bad2805736435bffdd
PAGEcctw 5632 bytes · 0.1% of section data
Uncommon name
MD5 7700a8c3b93ebc8db2471d99296492bb
PAGEdoid 25600 bytes · 0.3% of section data
Uncommon name
MD5 1d18d0683f780b8c0bd6599006ffd376
PAGEdcln 2048 bytes · 0.0% of section data
Uncommon name
MD5 226ec127d9d1c8d8f1f94ffdb14d677c
PAGEdsv_ 2560 bytes · 0.0% of section data
Uncommon name
MD5 20511cf899b288fb9941c1d2b15f5bd5
PAGEDATA 512 bytes · 0.0% of section data
Uncommon name
MD5 bf619eac0cdf3f68d496ea9344137e8b
PAGEdreg 265216 bytes · 3.3% of section data
Uncommon name
MD5 19b8ece5bd2ae3c8ec2e8b8d31fe7ac0
PAGEdStn 512 bytes · 0.0% of section data
Uncommon name
MD5 547a0d24b86b2b96d4441d5d147321b2
PAGEdSnd 512 bytes · 0.0% of section data
Uncommon name
MD5 5b8dc0f02bbf44e16838ea337a5f1cb7
PAGEdSnF 512 bytes · 0.0% of section data
Uncommon name
MD5 5da576bcb229acf6b909d9580fea493d
PAGEdWsP 512 bytes · 0.0% of section data
Uncommon name
MD5 faa07c55315532ab27166e03c238c532
PAGEdPsr 2048 bytes · 0.0% of section data
Uncommon name
MD5 eec6eba537891125a7692d085fd730e6
PAGEdThP 512 bytes · 0.0% of section data
Uncommon name
MD5 4cb45690ccc4756af036f82ef98dc2df
PAGEdQua 1024 bytes · 0.0% of section data
Uncommon name
MD5 1fd31a63e392e3e24de356e9f33ee079
PAGEdjaw 1024 bytes · 0.0% of section data
Uncommon name
MD5 9916bbf8eac10f040d8e3b6973e41659
PAGEdctw 512 bytes · 0.0% of section data
Uncommon name
MD5 dddcc03e2b592ffd37f7ac3ccb835596
PAGEdimg 512 bytes · 0.0% of section data
Uncommon name
MD5 2f138b8178c047d49aab4235a9d1b891
PAGEdrlg 2097152 bytes · 25.8% of section data
Uncommon name
MD5 b2d1236c286a3c0704224fe4105eca49
INIT 4608 bytes · 0.1% of section data
Uncommon name
MD5 7c74c0781fc9378c9708a028be4c0bd5
.rsrc 46080 bytes · 0.6% of section data
MD5 1fb553d824ef5d34399487157fd633ee
.reloc 318976 bytes · 3.9% of section data
MD5 db19cf641c5a32c210747f208e384d18

PE section names and hashes can reveal packing, injected resources, or unusual build artifacts. Sections with uncommon names, very large raw data, or hashes that differ from a trusted copy deserve additional review.

Report conclusion

GridinSoft detects this file as Trojan.Generic

This report identifies NETwtn04.sys by MD5 e944ad1849c4b81b060963e78ca96ce0. It is part of the Trojan report group. If the same file is present on your device, scan the system and remove the detected object after confirming the hash and location.

Download GridinSoft Anti-Malware Scan the device and confirm whether this exact hash is present. Check this hash on VirusTotal

Recommended next steps

  • Compare the local file MD5 with e944ad1849c4b81b060963e78ca96ce0.
  • Check the file path, publisher, and signature against the details in this report.
  • Run a GridinSoft scan and remove the object if the same hash is found. Use the Trojan category to compare similar reports.