Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'MsTcsPt' = 'Cmd.exe /c Start Rundll32.exe "%CommonProgramFiles%\System\MsTcaPt.dll",RunForRundll32'
- '<SYSTEM32>\rundll32.exe' "%CommonProgramFiles%\System\MsTcaPt.dll",RunForRundll32
- %CommonProgramFiles%\System\MsTcaPt.dll
- <SYSTEM32>\PerfStringBackup.TMP