GridinSoft Threat Intelligence

NETwtw04.sys threat report

Detected as Trojan.Generic File reputation report
MD5 264c5c0db5c707e00fb45f833187afac
Latest seen 2024-09-16 23:07:55 (2 years ago)
First seen 2024-09-16 23:07:55 (2 years ago)
Size 8 MB
Publisher Intel Corporation
Product Intel® Wireless WiFi Link Adapter

GridinSoft Anti-Malware detection

Detected by GridinSoft before you download

The current ThreatInfo record shows this exact file hash detected as Trojan.Generic. Download GridinSoft Anti-Malware to scan the device, confirm whether this file is present, and remove the detected object if it is found.

Detection name
Trojan.Generic
Recommended action
Scan and remove
Last analysis
2024-09-16 23:07:55 (2 years ago)
File hash
264c5c0db5c707e00fb45f833187afac
Download Anti-Malware

Why it matters

Why GridinSoft flags this file

Detection

GridinSoft identifies the sample as Trojan.Generic, part of the Trojan threat category.

Category context

Malware disguised as legitimate software or delivered through deceptive packaging. Related Trojan reports help compare this file with nearby detections, publishers, and hashes.

Timeline

First seen 2024-09-16 23:07:55 (2 years ago); latest analysis 2024-09-16 23:07:55 (2 years ago).

Publisher context

Company metadata: Intel Corporation. Product metadata: Intel® Wireless WiFi Link Adapter.

Observed locations

ThreatInfo has seen this file in user or system paths listed below. Unexpected locations increase the need for local verification.

Recommended action

What to do next

  1. Compare the MD5 above with the file found on the device.
  2. Check whether the file appears in the observed locations or under one of the alternate names.
  3. Run GridinSoft Anti-Malware to confirm the detection and remove the file if it is present. Review the Trojan category for related samples and common context.

File context

NETwtw04.sys is a Windows file recorded in the ThreatInfo database. It is associated with Intel® Wireless WiFi Link Adapter. The reported company name is Intel Corporation. The current detection status is Trojan.Generic, based on the latest analysis from 2024-09-16 23:07:55 (2 years ago). ThreatInfo groups this verdict with Trojan reports for broader family-level investigation.

If NETwtw04.sys appears on your computer unexpectedly, treat it as suspicious. Check its location, digital signature, and recent system changes before allowing it to run. A full anti-malware scan is recommended when this file is detected as Trojan.Generic.

File Details

Product Name: Intel® Wireless WiFi Link Adapter
Company Name: Intel Corporation
MD5: 264c5c0db5c707e00fb45f833187afac
Size: 8 MB
First Published: 2024-09-16 23:07:55 (2 years ago)
Latest Published: 2024-09-16 23:07:55 (2 years ago)
Status: Trojan.Generic (on last analysis)
Analysis Date: 2024-09-16 23:07:55 (2 years ago)

Detection screenshot

NETwtw04.sys detection screenshot

The screenshot is a visual record of a GridinSoft Anti-Malware detection for this sample. Use the hash and metadata above as the primary identifiers when comparing the file on your system.

Common Places:

%programfiles%\intel\wifidrivers

ThreatInfo has observed NETwtw04.sys in the locations listed above. Files found in temporary folders, user profile folders, startup locations, or unusual application directories should be reviewed more carefully than files installed under a known program directory.

Geographic signal

Observed country distribution

ThreatInfo has seen NETwtw04.sys across 1 countries. Use this signal to compare local evidence with where the sample is most often reported.

Top country Belgium
Share 100.0%
Low High activity

The strongest geographic signal for this file is Belgium with 100.0% of observed hits. Geographic distribution can help identify targeted campaigns, regional software bundles, or where a file is most commonly reported.

OS Version:

Windows 10 100.0%

The most common operating system signal for NETwtw04.sys is Windows 10 with 100.0% of observed hits. If your system differs from the common profile, check whether the file was introduced by a specific installer, archive, or removable device.

Analysis

NETwtw04.sys is identified as pe for 64-bit systems. The subsystem is Native. PE header values are useful for triage, especially when they do not match the expected publisher, product, or release timeline.

Format pe
Architecture 64-bit
Subsystem Native
Entry point 0x00050080
Image base 0x0000000140000000

PE Sections:

Sections 34
Raw data 8699392

Section layout highlights raw-size concentration, repeated names, packer markers, and hashes that can be compared across related samples.

.text 4475392 bytes · 51.4% of section data
MD5 515f5d130964c97916402ffee10fc2f5
.rdata 811008 bytes · 9.3% of section data
MD5 69d84ea54fe6e6e7b7859dc404419920
.data 152064 bytes · 1.7% of section data
MD5 03a800a4868443657cd0d3fb06548c08
.pdata 208896 bytes · 2.4% of section data
MD5 247064d953b8d7b7b138791b76bf8496
PAGEcsrv 90624 bytes · 1.0% of section data
Uncommon name
MD5 c01145752cb3a15c57008a7462e907c8
PAGEcjaw 102912 bytes · 1.2% of section data
Uncommon name
MD5 f5235460fc6fdabb3132bb46aa31e704
PAGEcwfd 116736 bytes · 1.3% of section data
Uncommon name
MD5 d19362e628a55748ee8aece29e0b7735
PAGE 25600 bytes · 0.3% of section data
Uncommon name
MD5 a13155889bba50ba68147739d01925a6
PAGEcnlo 1536 bytes · 0.0% of section data
Uncommon name
MD5 d35fdc423537619ba1cbeb7c2fda777e
PAGEccln 95744 bytes · 1.1% of section data
Uncommon name
MD5 87fb47c2db92ff68342add9b4ab42362
PAGEcsec 31232 bytes · 0.4% of section data
Uncommon name
MD5 adad54a2c7be2d658c0e75ad3c791b39
PAGEcsv_ 79872 bytes · 0.9% of section data
Uncommon name
MD5 37649d88515282a42a440bc2634f0ba6
PAGEcimg 8192 bytes · 0.1% of section data
Uncommon name
MD5 4704ef052ac10cf85e8e11c5763ac141
PAGEcpsm 6656 bytes · 0.1% of section data
Uncommon name
MD5 32920938f0249e18e0ef20f1b72102c3
PAGEcctw 5632 bytes · 0.1% of section data
Uncommon name
MD5 674b9433cbf94820b11aed54b1e5e5ed
PAGEdoid 29184 bytes · 0.3% of section data
Uncommon name
MD5 8371aefb84bb1ef683d79ebff619d817
PAGEdcln 4096 bytes · 0.0% of section data
Uncommon name
MD5 76eb86a47f2cc2edf04a5b0c7440e46e
PAGEdsv_ 2560 bytes · 0.0% of section data
Uncommon name
MD5 3dad592b368a6baccc7fb0050bea3e3d
PAGEDATA 512 bytes · 0.0% of section data
Uncommon name
MD5 bf619eac0cdf3f68d496ea9344137e8b
PAGEdreg 265216 bytes · 3.0% of section data
Uncommon name
MD5 efaf5a82d422d2d02c279547556438f1
PAGEdStn 1024 bytes · 0.0% of section data
Uncommon name
MD5 b0932534d09f20ced9dd2b4fa7496a4e
PAGEdSnd 512 bytes · 0.0% of section data
Uncommon name
MD5 66cbcd8755acf87f0417d72303826785
PAGEdSnF 1024 bytes · 0.0% of section data
Uncommon name
MD5 e46f6ad80de4991f1cee15436273e8ad
PAGEdWsP 1024 bytes · 0.0% of section data
Uncommon name
MD5 ddad026b82b6cac7f0860b4bdb131b35
PAGEdPsr 2048 bytes · 0.0% of section data
Uncommon name
MD5 02ec54f5a2ee434d0f150a5467cd359a
PAGEdThP 512 bytes · 0.0% of section data
Uncommon name
MD5 9571ccc80958cf7f8f060bd2961a44d6
PAGEdQua 1024 bytes · 0.0% of section data
Uncommon name
MD5 44682c22c11cb309260df2be68649892
PAGEdjaw 1536 bytes · 0.0% of section data
Uncommon name
MD5 94ff772c3c2d244c6bb63d3341bb09c9
PAGEdctw 512 bytes · 0.0% of section data
Uncommon name
MD5 dddcc03e2b592ffd37f7ac3ccb835596
PAGEdimg 512 bytes · 0.0% of section data
Uncommon name
MD5 17e326f3da991ea49b52a79fda92b3ef
PAGEdrlg 2097152 bytes · 24.1% of section data
Uncommon name
MD5 b2d1236c286a3c0704224fe4105eca49
INIT 5120 bytes · 0.1% of section data
Uncommon name
MD5 9db50833aeef3e9576a5df804262f6ce
.rsrc 46080 bytes · 0.5% of section data
MD5 7a0ca471713d7db3c36ceab3363d1093
.reloc 27648 bytes · 0.3% of section data
MD5 b0049540494541559bbca867af67f216

PE section names and hashes can reveal packing, injected resources, or unusual build artifacts. Sections with uncommon names, very large raw data, or hashes that differ from a trusted copy deserve additional review.

Report conclusion

GridinSoft detects this file as Trojan.Generic

This report identifies NETwtw04.sys by MD5 264c5c0db5c707e00fb45f833187afac. It is part of the Trojan report group. If the same file is present on your device, scan the system and remove the detected object after confirming the hash and location.

Download GridinSoft Anti-Malware Scan the device and confirm whether this exact hash is present. Check this hash on VirusTotal

Recommended next steps

  • Compare the local file MD5 with 264c5c0db5c707e00fb45f833187afac.
  • Check the file path, publisher, and signature against the details in this report.
  • Run a GridinSoft scan and remove the object if the same hash is found. Use the Trojan category to compare similar reports.