TrendLabs: Viro Botnet Ransomware Breaks Through

Figure 1. Virobot queries the machine to see if contains the registry keys needed for encryption.

REF: https://blog.trendmicro.com/trendlabs-security-intelligence/virobot-ransomware-with-botnet-capability-breaks-through/