Versions

3.1.0.0	12.50%
3.1.0.0	12.50%
2.0.0.0	62.50%
2.0.0.0	12.50%

There are 4 versions of toolwizcares.exe in the wild, the latest version being 3.1.0.0. toolwizcares.exe is run as a standard windows process with the logged in user's account privileges. By adding a startup entry to the run registry key, the file will be executed when the user logs into Windows. In addition the the run registry key, it also creates a scheduled job to be executed by the Windows Task Scheduler up user login, this is typically done in order to bypass a User Account Control (UAC) prompt. The average file size is about 5.04 MB. The file is a digitally signed and issued to XII CNC Inc. by VeriSign. Some variations of the file have been seen to be installed with the program Toolwiz Care from ToolWiz. During the process's lifecycle, the typical CPU resource utilization is about 0.0022% including both foreground and background operations, the average private memory consumption is about 34.86 MB. Addionally, typically read and write I/O disk operations is about 452.92 KB per minute for reads and 60.05 KB per minute for writes.