GridinSoft Threat Intelligence

NETwtw02.sys threat report

Detected as Trojan.Generic File reputation report
MD5 47eec86947d2ac87e14ca9f00648756f
Latest seen 2024-09-16 23:07:59 (2 years ago)
First seen 2024-09-16 23:07:54 (2 years ago)
Size 6 MB
Publisher Intel Corporation
Product Intel® Wireless WiFi Link Adapter

GridinSoft Anti-Malware detection

Detected by GridinSoft before you download

The current ThreatInfo record shows this exact file hash detected as Trojan.Generic. Download GridinSoft Anti-Malware to scan the device, confirm whether this file is present, and remove the detected object if it is found.

Detection name
Trojan.Generic
Recommended action
Scan and remove
Last analysis
2024-09-16 23:07:59 (2 years ago)
File hash
47eec86947d2ac87e14ca9f00648756f
Download Anti-Malware

Why it matters

Why GridinSoft flags this file

Detection

GridinSoft identifies the sample as Trojan.Generic, part of the Trojan threat category.

Category context

Malware disguised as legitimate software or delivered through deceptive packaging. Related Trojan reports help compare this file with nearby detections, publishers, and hashes.

Timeline

First seen 2024-09-16 23:07:54 (2 years ago); latest analysis 2024-09-16 23:07:59 (2 years ago).

Publisher context

Company metadata: Intel Corporation. Product metadata: Intel® Wireless WiFi Link Adapter.

Observed locations

ThreatInfo has seen this file in user or system paths listed below. Unexpected locations increase the need for local verification.

Recommended action

What to do next

  1. Compare the MD5 above with the file found on the device.
  2. Check whether the file appears in the observed locations or under one of the alternate names.
  3. Run GridinSoft Anti-Malware to confirm the detection and remove the file if it is present. Review the Trojan category for related samples and common context.

File context

NETwtw02.sys is a Windows file recorded in the ThreatInfo database. It is associated with Intel® Wireless WiFi Link Adapter. The reported company name is Intel Corporation. The current detection status is Trojan.Generic, based on the latest analysis from 2024-09-16 23:07:59 (2 years ago). ThreatInfo groups this verdict with Trojan reports for broader family-level investigation.

If NETwtw02.sys appears on your computer unexpectedly, treat it as suspicious. Check its location, digital signature, and recent system changes before allowing it to run. A full anti-malware scan is recommended when this file is detected as Trojan.Generic.

File Details

Product Name: Intel® Wireless WiFi Link Adapter
Company Name: Intel Corporation
MD5: 47eec86947d2ac87e14ca9f00648756f
Size: 6 MB
First Published: 2024-09-16 23:07:54 (2 years ago)
Latest Published: 2024-09-16 23:07:59 (2 years ago)
Status: Trojan.Generic (on last analysis)
Analysis Date: 2024-09-16 23:07:59 (2 years ago)

Detection screenshot

NETwtw02.sys detection screenshot

The screenshot is a visual record of a GridinSoft Anti-Malware detection for this sample. Use the hash and metadata above as the primary identifiers when comparing the file on your system.

Common Places:

%programfiles%\intel\wifidrivers
%system%\driverstore\filerepository

ThreatInfo has observed NETwtw02.sys in the locations listed above. Files found in temporary folders, user profile folders, startup locations, or unusual application directories should be reviewed more carefully than files installed under a known program directory.

Geographic signal

Observed country distribution

ThreatInfo has seen NETwtw02.sys across 1 countries. Use this signal to compare local evidence with where the sample is most often reported.

Top country Belgium
Share 100.0%
Low High activity

The strongest geographic signal for this file is Belgium with 100.0% of observed hits. Geographic distribution can help identify targeted campaigns, regional software bundles, or where a file is most commonly reported.

OS Version:

Windows 10 100.0%

The most common operating system signal for NETwtw02.sys is Windows 10 with 100.0% of observed hits. If your system differs from the common profile, check whether the file was introduced by a specific installer, archive, or removable device.

Analysis

NETwtw02.sys is identified as pe for 64-bit systems. The subsystem is Native. PE header values are useful for triage, especially when they do not match the expected publisher, product, or release timeline.

Format pe
Architecture 64-bit
Subsystem Native
Entry point 0x00024cc8
Image base 0x0000000140000000

PE Sections:

Sections 34
Raw data 6717952

Section layout highlights raw-size concentration, repeated names, packer markers, and hashes that can be compared across related samples.

.text 2911232 bytes · 43.3% of section data
MD5 eac534fb5d278293a966d45634f206b4
.rdata 632320 bytes · 9.4% of section data
MD5 2c9e67b9c064d3b89e6c8cbbbe1b8ec6
.data 127488 bytes · 1.9% of section data
MD5 e9f47bbf056f5d2e657c3de6556d78cd
.pdata 183808 bytes · 2.7% of section data
MD5 33475cbfb8cd1491e6e5c6eb2b9758ab
.gfids 512 bytes · 0.0% of section data
Uncommon name
MD5 b09f5a36ab2abdf4571eb3f486ea9842
PAGEcsrv 86016 bytes · 1.3% of section data
Uncommon name
MD5 b066913fc83c1799a262019da402c625
PAGEcjaw 88576 bytes · 1.3% of section data
Uncommon name
MD5 9490b795858fa3778e04812cca437458
PAGEcwfd 62464 bytes · 0.9% of section data
Uncommon name
MD5 51ec0729174b5c876b62a3a3f8ed3372
PAGE 1536 bytes · 0.0% of section data
Uncommon name
MD5 dda3fc1e3e292fe5d5ae6d473bf6008e
PAGEcnlo 1024 bytes · 0.0% of section data
Uncommon name
MD5 3d77627be20b8b85d03a69ded1c81433
PAGEccln 52224 bytes · 0.8% of section data
Uncommon name
MD5 ca111dc36f923fdf0feb1295b948e69f
PAGEcsec 30208 bytes · 0.4% of section data
Uncommon name
MD5 c009fd0016914ea7ceae1b0559102202
PAGEcsv_ 57856 bytes · 0.9% of section data
Uncommon name
MD5 ac923b6397eef6497b860aee51ee29fe
PAGEcimg 5120 bytes · 0.1% of section data
Uncommon name
MD5 25c4e24e1f61fdc58a6c5c34685e6454
PAGEcast 10752 bytes · 0.2% of section data
Uncommon name
MD5 fdc180653e0099c936c66a1376b0bbe4
PAGEcpsm 7168 bytes · 0.1% of section data
Uncommon name
MD5 3e211f9122b16a3f9ba011f3f2760168
PAGEcctw 2560 bytes · 0.0% of section data
Uncommon name
MD5 47937e09b029e022bc2b4babb45d5638
PAGEdoid 28672 bytes · 0.4% of section data
Uncommon name
MD5 02784bb147ef6fc4152862be229a1719
PAGEdcln 3584 bytes · 0.1% of section data
Uncommon name
MD5 bf9233eef8de4b157fcf664626c116f0
PAGEdsv_ 2560 bytes · 0.0% of section data
Uncommon name
MD5 f160403194d5fabee31246df7fa27088
PAGEdreg 256512 bytes · 3.8% of section data
Uncommon name
MD5 3643024e472c5b4eedf86cd36bb4350d
PAGEdscn 512 bytes · 0.0% of section data
Uncommon name
MD5 8672a4d2ffffe8b8c4936f2ef2b283f0
PAGEdStn 2560 bytes · 0.0% of section data
Uncommon name
MD5 642a0b5c04c5bc119ebe75787fc8bdee
PAGEdSnF 2560 bytes · 0.0% of section data
Uncommon name
MD5 fb7d48f53f2425be4331ac059fa04e0d
PAGEdPsr 2048 bytes · 0.0% of section data
Uncommon name
MD5 7dab9d216d5d0299c1d4979fd046bb25
PAGEdwi1 2560 bytes · 0.0% of section data
Uncommon name
MD5 a9d5d72c535127e1810f1846ceada337
PAGEdwi2 2560 bytes · 0.0% of section data
Uncommon name
MD5 e70732b7a3500c179e4e955e4943725a
PAGEdjaw 1536 bytes · 0.0% of section data
Uncommon name
MD5 4cba9a71799280272e37ad4f9e8c24e8
PAGEdimg 1024 bytes · 0.0% of section data
Uncommon name
MD5 ea8940d173a85585873d454a2f2b7edf
PAGEdctw 512 bytes · 0.0% of section data
Uncommon name
MD5 f794dcd5b00d814d12cac3ee63e5039c
PAGEdrlg 2097152 bytes · 31.2% of section data
Uncommon name
MD5 b2d1236c286a3c0704224fe4105eca49
INIT 4608 bytes · 0.1% of section data
Uncommon name
MD5 cb6765fdff37283e9ebf2d9ad991a8c8
.rsrc 27648 bytes · 0.4% of section data
MD5 255af08d56acdd6406c2de14d714906a
.reloc 20480 bytes · 0.3% of section data
MD5 c026642a2ee82f8b26f74bc81bc30e5f

PE section names and hashes can reveal packing, injected resources, or unusual build artifacts. Sections with uncommon names, very large raw data, or hashes that differ from a trusted copy deserve additional review.

Report conclusion

GridinSoft detects this file as Trojan.Generic

This report identifies NETwtw02.sys by MD5 47eec86947d2ac87e14ca9f00648756f. It is part of the Trojan report group. If the same file is present on your device, scan the system and remove the detected object after confirming the hash and location.

Download GridinSoft Anti-Malware Scan the device and confirm whether this exact hash is present. Check this hash on VirusTotal

Recommended next steps

  • Compare the local file MD5 with 47eec86947d2ac87e14ca9f00648756f.
  • Check the file path, publisher, and signature against the details in this report.
  • Run a GridinSoft scan and remove the object if the same hash is found. Use the Trojan category to compare similar reports.