HKCU\Software\Microsoft\Windows NT\CurrentVersion\EFS\* [*] %CSIDL_LOCAL_APPDATA%\Microsoft\EDP\*[*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EFS\* [*]