GridinSoft Threat Intelligence

Netwtw04.sys file report

Under review File reputation report
MD5 51c119893a361b11f7096be05065661b
Latest seen 2023-06-02 23:59:46 (2 years ago)
First seen 2023-06-02 23:59:46 (2 years ago)
Size 8 MB
Publisher Intel Corporation
Product Intel® Wireless WiFi Link Adapter
Signed by Intel Corporation;Microsoft Windows Hardware Compatibility Publisher

Why it matters

Evidence available for this file

Detection

No final classification is available yet.

Timeline

First seen 2023-06-02 23:59:46 (2 years ago); latest analysis 2023-06-02 23:59:46 (2 years ago).

Publisher context

Company metadata: Intel Corporation. Product metadata: Intel® Wireless WiFi Link Adapter.

Digital signature

Signed by Intel Corporation;Microsoft Windows Hardware Compatibility Publisher. The signature is reported as valid, but signed files can still be bundled or abused.

Observed locations

ThreatInfo has seen this file in user or system paths listed below. Unexpected locations increase the need for local verification.

Recommended action

What to do next

  1. Use the hash and metadata below to verify the exact file identity.
  2. Review publisher, signature, paths, and PE details for inconsistencies.
  3. Run a local scan if the file appears unexpectedly or starts with Windows.

File context

Netwtw04.sys is a Windows file recorded in the ThreatInfo database. It is associated with Intel® Wireless WiFi Link Adapter. The reported company name is Intel Corporation. The current detection status is Undefined, based on the latest analysis from 2023-06-02 23:59:46 (2 years ago).

ThreatInfo does not have a final classification for this file yet. Use the technical details below to compare the hash, size, signature, and observed locations with the copy found on your device.

File Details

Product Name: Intel® Wireless WiFi Link Adapter
Company Name: Intel Corporation
MD5: 51c119893a361b11f7096be05065661b
Size: 8 MB
First Published: 2023-06-02 23:59:46 (2 years ago)
Latest Published: 2023-06-02 23:59:46 (2 years ago)
Status: Undefined (on last analysis)
Analysis Date: 2023-06-02 23:59:46 (2 years ago)

Overview

Signed By: Intel Corporation;Microsoft Windows Hardware Compatibility Publisher
Status: Valid

The signature on Netwtw04.sys is reported as valid. A valid signature helps confirm publisher identity, but it does not automatically make the file safe if the installer was bundled, abused, or downloaded from an untrusted source.

Common Places:

%commonappdata%\outbyte\driver updater\2.x\temp

ThreatInfo has observed Netwtw04.sys in the locations listed above. Files found in temporary folders, user profile folders, startup locations, or unusual application directories should be reviewed more carefully than files installed under a known program directory.

Geographic signal

Observed country distribution

ThreatInfo has seen Netwtw04.sys across 1 countries. Use this signal to compare local evidence with where the sample is most often reported.

Top country Spain
Share 100.0%
Low High activity

The strongest geographic signal for this file is Spain with 100.0% of observed hits. Geographic distribution can help identify targeted campaigns, regional software bundles, or where a file is most commonly reported.

OS Version:

Windows 10 100.0%

The most common operating system signal for Netwtw04.sys is Windows 10 with 100.0% of observed hits. If your system differs from the common profile, check whether the file was introduced by a specific installer, archive, or removable device.

Analysis

Netwtw04.sys is identified as pe for 64-bit systems. The subsystem is Native. PE header values are useful for triage, especially when they do not match the expected publisher, product, or release timeline.

Format pe
Architecture 64-bit
Subsystem Native
Entry point 0x00050fb0
Image base 0x0000000140000000

PE Sections:

Sections 33
Raw data 8765440

Section layout highlights raw-size concentration, repeated names, packer markers, and hashes that can be compared across related samples.

.text 4606976 bytes · 52.6% of section data
MD5 8a8f7ead1794958abca3e7aebe3a9cf8
.rdata 807936 bytes · 9.2% of section data
MD5 706693dd8ba268e3680289ce57c3d63c
.data 151552 bytes · 1.7% of section data
MD5 ecfa703bf1f8cf2169d0280efdc87cfa
.pdata 185856 bytes · 2.1% of section data
MD5 ea316c87d44526fc9185ae4c3ac64558
PAGEcsrv 87552 bytes · 1.0% of section data
Uncommon name
MD5 fa14e372a25ac4975f5be5f644092553
PAGEcjaw 103424 bytes · 1.2% of section data
Uncommon name
MD5 5480aebba238a35f72c37904c83412fb
PAGEcwfd 121344 bytes · 1.4% of section data
Uncommon name
MD5 1a97a9fd0ac31c5df97a3d30e3d57664
PAGE 1536 bytes · 0.0% of section data
Uncommon name
MD5 7d8d18cc503836181a053d65b364d3f5
PAGEcnlo 2048 bytes · 0.0% of section data
Uncommon name
MD5 4617280785f088a6750cd2e0ec5bd326
PAGEccln 95232 bytes · 1.1% of section data
Uncommon name
MD5 3995e681c539899e69e7303bab7bb209
PAGEcsec 25600 bytes · 0.3% of section data
Uncommon name
MD5 062bbee408e9eb300e88690258963092
PAGEcsv_ 71680 bytes · 0.8% of section data
Uncommon name
MD5 1e0c43644dbeac83ab9bbe1feeea9bd8
PAGEcimg 8704 bytes · 0.1% of section data
Uncommon name
MD5 4cccaf0fb71f7d0c2c228882495acf19
PAGEcpsm 6144 bytes · 0.1% of section data
Uncommon name
MD5 754461e75436c0a9058519765c66348b
PAGEcctw 6144 bytes · 0.1% of section data
Uncommon name
MD5 7ee363dd080de7b1b5ccd58fe237cfbb
PAGEdoid 26624 bytes · 0.3% of section data
Uncommon name
MD5 93438065f5f32de1bd17094192dd6cc7
PAGEdcln 4096 bytes · 0.0% of section data
Uncommon name
MD5 0b41f8a699aa651c349065836b78d323
PAGEdsv_ 2560 bytes · 0.0% of section data
Uncommon name
MD5 3dad592b368a6baccc7fb0050bea3e3d
PAGEdreg 265216 bytes · 3.0% of section data
Uncommon name
MD5 549f9feb39cea24c764802a30be18a16
PAGEdStn 1024 bytes · 0.0% of section data
Uncommon name
MD5 14098fc456e7601851b25b4eb963e316
PAGEdSnd 512 bytes · 0.0% of section data
Uncommon name
MD5 065b5d4c6b5c08ce85ec9978d4ec43f8
PAGEdSnF 1024 bytes · 0.0% of section data
Uncommon name
MD5 93f2ea55aa36eb89e359813450aba027
PAGEdWsP 1024 bytes · 0.0% of section data
Uncommon name
MD5 16d10dc0dcefcd565c51d0b65eec24cf
PAGEdPsr 2048 bytes · 0.0% of section data
Uncommon name
MD5 42ac354a2e98a1f73456a498f0ef7eec
PAGEdThP 512 bytes · 0.0% of section data
Uncommon name
MD5 7fb656f5f4a1b4ffa56d259b7c18bb26
PAGEdQua 1024 bytes · 0.0% of section data
Uncommon name
MD5 8c13f6f19bc812d4c0a25d06026da821
PAGEdjaw 1536 bytes · 0.0% of section data
Uncommon name
MD5 0534211935e9396a14fed966755c505d
PAGEdctw 512 bytes · 0.0% of section data
Uncommon name
MD5 dddcc03e2b592ffd37f7ac3ccb835596
PAGEdimg 512 bytes · 0.0% of section data
Uncommon name
MD5 31c7c69e000598491c7e49e1b059c3f9
PAGEdrlg 2097152 bytes · 23.9% of section data
Uncommon name
MD5 b2d1236c286a3c0704224fe4105eca49
INIT 5120 bytes · 0.1% of section data
Uncommon name
MD5 44234ea4e77ec8d1bea88eb62713307c
.rsrc 46080 bytes · 0.5% of section data
MD5 49fb8304505817dee527b1c1e13f272c
.reloc 27136 bytes · 0.3% of section data
MD5 d9a17e7c8b4e573361a7fb55aca13cab

PE section names and hashes can reveal packing, injected resources, or unusual build artifacts. Sections with uncommon names, very large raw data, or hashes that differ from a trusted copy deserve additional review.

Report conclusion

This file is still under review

ThreatInfo has not assigned a final verdict yet. Compare the file hash, location, signature, and publisher before trusting the file on a production system.

Scan with GridinSoft Anti-Malware Use a local scan if the file origin or behavior is unclear. Check this hash on VirusTotal

Recommended next steps

  • Compare the local file MD5 with 51c119893a361b11f7096be05065661b.
  • Check the file path, publisher, and signature against the details in this report.
  • Run a GridinSoft scan if the source, path, or behavior looks unusual.