As far as I know CCE detects all RunOnce registry entries as malware.
If you just recently installed a new program or updated a program that requires a system reboot, then RunOnce registry entries will be created.
If you delete these RunOnce registry entries it will corrupt the program.
Also applies to Windows Updates and driver updates.
CCE also detected WinPatrol and Sandboxie after I updated them because of the RunOnce registry entries.
CCE has far too many false positives even though all security scanners have the occasional false positive.
Good day.