CreateRestorePoint:
CloseProcesses:
Reg: REG QUERY "HKEY_USERS\S-1-5-21-3110098909-1101332020-947144772-1004\SOFTWARE\Policies\Microsoft\Windows\System" 
Reg: REG QUERY "HKEY_USERS\S-1-5-21-3110098909-1101332020-947144772-1004\SOFTWARE\Policies\Microsoft\Windows\Explorer"
Reg: REG QUERY "HKEY_USERS\S-1-5-21-3110098909-1101332020-947144772-1001\SOFTWARE\Policies\Microsoft\Windows\System" 
Reg: REG QUERY "HKEY_USERS\S-1-5-21-3110098909-1101332020-947144772-1001\SOFTWARE\Policies\Microsoft\Windows\Explorer" 
EmptyTemp: