HKLM\...\RunOnce: [*EmptyTemp] => cmd /c rd /q/s C:\FRST\Temp
HKU\S-1-5-21-398714757-4205386782-3194616843-1001\...\RunOnce: [Report] => \AdwCleaner\AdwCleaner[C1].txt