PoliceRecords Ransomware Detection

This Yara rule detects the PoliceRecords ransomware. It identifies specific byte sequences related to file encryption, file discovery, desktop manipulation (likely for displaying a ransom note or changing wallpaper), and the dropping of a ransom note. The rule looks for these distinct patterns within executable files (identified by the 'MZ' header).