GPGQwerty Ransomware Detection

This YARA rule detects the GPGQwerty ransomware by identifying specific byte patterns associated with its file finding and encryption routines. The rule looks for two distinct sets of byte sequences related to file enumeration (find_files_p1 and find_files_p2) and a third set related to file encryption (encrypt_files). All identified patterns must be present in a file that starts with the 'MZ' header (uint16(0) == 0x5A4D) to trigger a detection.