NETwtw06.sys threat report

MD5 fe1269315d2999724a9bb9a3aa8e6eaf
Latest seen 2024-10-24 23:00:41 (2 years ago)
First seen 2024-10-24 23:00:41 (2 years ago)
Size 8 MB
Publisher Intel Corporation

GridinSoft Anti-Malware detection

Detected by GridinSoft before you download

The current ThreatInfo record shows this exact file hash detected as Trojan.Generic. Download GridinSoft Anti-Malware to scan the device, confirm whether this file is present, and remove the detected object if it is found.

Detection name
Trojan.Generic
Recommended action
Scan and remove
Last analysis
2024-10-24 23:00:41 (2 years ago)
File hash
fe1269315d2999724a9bb9a3aa8e6eaf
Download Anti-Malware

Why it matters

Why GridinSoft flags this file

Detection

GridinSoft identifies the sample as Trojan.Generic.

Timeline

First seen 2024-10-24 23:00:41 (2 years ago); latest analysis 2024-10-24 23:00:41 (2 years ago).

Publisher context

Company metadata: Intel Corporation. Product metadata: Intel® Wireless WiFi Link Adapter.

Observed locations

ThreatInfo has seen this file in user or system paths listed below. Unexpected locations increase the need for local verification.

Recommended action

What to do next

  1. Compare the MD5 above with the file found on the device.
  2. Check whether the file appears in the observed locations or under one of the alternate names.
  3. Run GridinSoft Anti-Malware to confirm the detection and remove the file if it is present.

NETwtw06.sys is a Windows file recorded in the ThreatInfo database. It is associated with Intel® Wireless WiFi Link Adapter. The reported company name is Intel Corporation. The current detection status is Trojan.Generic, based on the latest analysis from 2024-10-24 23:00:41 (2 years ago).

If NETwtw06.sys appears on your computer unexpectedly, treat it as suspicious. Check its location, digital signature, and recent system changes before allowing it to run. A full anti-malware scan is recommended when this file is detected as Trojan.Generic.

Product Name: Intel® Wireless WiFi Link Adapter
Company Name: Intel Corporation
MD5: fe1269315d2999724a9bb9a3aa8e6eaf
Size: 8 MB
First Published: 2024-10-24 23:00:41 (2 years ago)
Latest Published: 2024-10-24 23:00:41 (2 years ago)
Status: Trojan.Generic (on last analysis)
Analysis Date: 2024-10-24 23:00:41 (2 years ago)
NETwtw06.sys detection screenshot

The screenshot is a visual record of a GridinSoft Anti-Malware detection for this sample. Use the hash and metadata above as the primary identifiers when comparing the file on your system.

%programfiles%\intel\wifidrivers

ThreatInfo has observed NETwtw06.sys in the locations listed above. Files found in temporary folders, user profile folders, startup locations, or unusual application directories should be reviewed more carefully than files installed under a known program directory.

100.0%

The strongest geographic signal for this file is Sweden with 100.0% of observed hits. Geographic distribution can help identify targeted campaigns, regional software bundles, or where a file is most commonly reported.

Windows 10 100.0%

The most common operating system signal for NETwtw06.sys is Windows 10 with 100.0% of observed hits. If your system differs from the common profile, check whether the file was introduced by a specific installer, archive, or removable device.

NETwtw06.sys is identified as pe for 64 systems. The subsystem is Native. PE header values are useful for triage, especially when they do not match the expected publisher, product, or release timeline.

Subsystem: Native
PE Type: pe
OS Bitness: 64
Image Base: 0x0000000140000000
Entry Address: 0x0004d740

PE Sections:

Name Size of data MD5
.text 4446208 a39e19d3d65edf68e0eb373f57502344
.rdata 783872 a3356d2235385adce6f59b856ef51411
.data 149504 7e28934ab2893b85058316a07bbe66a3
.pdata 202752 1365e93a84cee10b939bf2db99e3a52a
PAGEcsrv 87552 d1269e0bda3b1847f201213a23edeecf
PAGEcjaw 95232 3ad152963a8f71cc6a5843aee234265b
PAGE 27648 04a0add76c2c457292b283476f48bca6
PAGEcsec 31232 e1a214025417c6fafd09aac793d7db0b
PAGEcnlo 1536 8b63063694eca0719cc6c4ac67f97cbe
PAGEcwfd 97792 03e1bc60a4591e1e64ca86ceacb29150
PAGEccln 81408 cb1c41825f971b2918113250d67602af
PAGEcsv_ 77824 ba8d2ff6d963d59af7f699626d4cb48a
PAGEcimg 9216 f40e18e8dd7f283c724d3a782f6b76f8
PAGEcpsm 7168 0bb24a8c97c1accbdd5ee47c8cba958d
PAGEcctw 4608 7a61729b17010bebaed196838275bc52
PAGEdoid 28160 725395c96036450cb08a81e322407b00
PAGEdcln 4096 e6c0dd3a273423a1fcff6cda57a10996
PAGEdsv_ 2560 3dad592b368a6baccc7fb0050bea3e3d
PAGEdreg 270848 63478171051626aa1b8acd8ca8cf5a17
PAGEdSnF 512 fb0810974531a17223c64c5371095be8
PAGEdWsP 512 318e70de1108237766e0ff471586ad4e
PAGEdPsr 1024 ef59110a1ebfdb27ec91eb21dec6a31d
PAGEdThP 512 d55f934d4ac58e2d1d2557fb26d7ea1a
PAGEdQua 1024 9f7e50a044b02aae292d18dedbb18b21
PAGEdjaw 1024 efa9ab66cc5c9218c3ac205b7fc76379
PAGEdctw 512 dddcc03e2b592ffd37f7ac3ccb835596
PAGEdimg 2048 1e60d92c044f3f959db9de3891a3ac63
PAGEdrlg 2097152 b2d1236c286a3c0704224fe4105eca49
INIT 5632 4299fd6f4a74c4f3077fdfd3e2538e13
.rsrc 46592 02b18c6b40fa16d6f4cc7f56ce655e0e
.reloc 27136 94a995c7175d62a70c3da5eb6845eb53

PE section names and hashes can reveal packing, injected resources, or unusual build artifacts. Sections with uncommon names, very large raw data, or hashes that differ from a trusted copy deserve additional review.

More information: