Assertion: ransom's file | /r/HasProperty | a registry key
Facets:
Source sentences:
text: Each time LockerGoga encrypts a file, a registry key (HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session00{01-20}) is modified.