When each file is encrypted, registry keys are created under HKU\{SID}\Software\Microsoft\ RestartManager \ which are used to track metadata pertaining to the file being encrypted, such as owner, sequence, session and file hash
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: When each file is encrypted, registry keys are created under HKU\{SID}\Software\Microsoft\ RestartManager \ which are used to track metadata pertaining to the file being encrypted, such as owner, sequence, session and file hash ### Response: T1547.001.