Conti can use "CreateIoCompletionPort()", "PostQueuedCompletionStatus()", and "GetQueuedCompletionPort()" to rapidly encrypt files, excluding those with the extensions of .exe, .dll, and .lnk. It has used a different AES-256 encryption key per file with a bundled RAS-4096 public encryption key that is unique for each victim. Conti can use “Windows Restart Manager” to ensure files are unlocked and open for encryption.