Win64 AwesomeScott Ransomware Detection

This YARA rule detects the AwesomeScott ransomware by identifying specific byte patterns associated with its file encryption and file finding routines. The rule looks for a combination of three distinct byte sequences related to file encryption ($encrypt_files_p1, $encrypt_files_p2, $encrypt_files_p3) and one byte sequence related to file discovery ($find_files). All identified patterns must be present for a match, along with the standard Windows executable MZ header (uint16(0) == 0x5A4D).