Pretty much every firewall/anti-virus program has heuristic scanning features that look at what something DOES, rather than what something IS. Think of your firewall as The Secret Service. In this case wfxload.exe is doing the equivalent of reaching into his coat pocket for his wallet. Your friendly Secret Service agent sees this, and says into his little radio that someone might be reaching for a gun, and wfxload.exe gets grabbed. Once they know there's no danger, they let him go.
