home

fltw.exe

Beehive Software Ltd.

The executable fltw.exe has been detected as malware by 6 anti-virus scanners. It runs as a separate (within the context of its own process) windows Service named “WtFilterServ”.
Publisher:
Beehive Software Ltd.  (signed and verified)

Version:
2.0.6.0

MD5:
8d892ae70fbc74b70db4c0ab920a0433

SHA-1:
1c4cb193e0d89fdeefcedaf319c97c210f0e6439

SHA-256:
00722a7ba30d74965abc1f42cc36b604b516a8aa1646587eefbcf5c094eda557

Scanner detections:
6 / 68

Status:
Malware

Analysis date:
7/4/2025 9:30:34 AM UTC  (today)

Scan engine
Detection
Engine version

Comodo Security
Heur.Pck.Enigma
6849

F-Prot
W32/Internet-Trojan-patched-based
v6.4.6.2.117

K7 AntiVirus
Trojan
13.63083

Trend Micro
PAK_Generic.009
10.465.02

Vba32 AntiVirus
Backdoor.Win32.Bifrose.cueo
3.12.14.2

VIPRE Antivirus
Trojan.Win32.Packer.EnigmaProtector1.1X-1.3X
7413

File size:
1.1 MB (1,131,920 bytes)

Product version:
2.0.6.0

File type:
Executable application (Win32 EXE)

Common path:
C:\windows\syswow64\fltw.exe

Digital Signature
Signed by:
Beehive Software Ltd.

Authority:
VeriSign, Inc.

Valid from:
1/14/2010 3:00:00 AM

Valid to:
1/16/2011 2:59:59 AM

Subject:
CN=Beehive Software Ltd., OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Beehive Software Ltd., L=Murom, S=Vladimir rgn., C=RU

Issuer:
CN=VeriSign Class 3 Code Signing 2009-2 CA, OU=Terms of use at https://www.verisign.com/rpa (c)09, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
56A53D14620AA8D9A5FEBDE5EA879613

File PE Metadata
Compilation timestamp:
10/13/2010 9:33:06 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:3WahzC75Wk0PWTE0BwZFpCJW3biFFChUU3jKMGyOoK5Q:3FhA5naCJsYFChUSjKLJJQ

Entry address:
0x5002

Entry point:
55, 8B, EC, 83, C4, F0, B8, 00, 10, 40, 00, E8, 01, 00, 00, 00, 9A, 83, C4, 10, 8B, E5, 5D, E9, A6, EA, 48, 00, A2, 5D, 21, FF, 85, A4, 42, F7, 2D, C8, 41, BC, 7E, 32, A0, 66, 96, 9A, 74, 6F, DF, 59, DE, E7, 69, 08, 99, 61, 87, 3F, 7D, 3C, AA, 80, 4E, 45, 73, 09, 50, 5B, E5, 4D, B9, 8D, 8B, 14, 3C, C3, FE, 78, 9E, 6C, AC, BF, C0, 52, 68, A1, C6, 1E, E7, 7D, B7, F8, 44, 29, F9, BD, 1F, D4, A6, 1F, 43, A6, 22, 0A, 98, 7F, C2, 32, 1D, 55, 53, 1D, E6, 82, 0C, 51, E2, 1C, 93, 45, 92, 30, AA, 61, 91, 2E, 1E, A5...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
1006.5 KB (1,030,656 bytes)

Service
Display name:
WtFilterServ

Service name:
wtflserv

Description:
{47F7E63E-262B-4533-8D97-5638988E0364}

Type:
Win32OwnProcess


Remove fltw.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.