CloseProcesses:
CreateRestorePoint:
EmptyTemp:
HKU\S-1-5-21-1697106687-4009945627-1652632994-1000\...\MountPoints2: {c73ca615-695e-11e7-a470-001fd005f414} - F:\SISetup.exe
HKU\S-1-5-21-1697106687-4009945627-1652632994-1000\...\MountPoints2: {eeefad48-c6ad-11e7-8f91-001fd005f414} - F:\Setup.exe