When each file is encrypted, registry keys are created under HKU\{SID}\Software\Microsoft\ RestartManager \ which are used to track metadata pertaining to the file being encrypted, such as owner, sequence, session and file hash