CreateRestorePoint:
HKLM\...\Run: [] => [X]
EmptyTemp: