Win64 HotCoffee Ransomware Detection

This YARA rule detects the HotCoffee ransomware. It identifies specific byte patterns related to the ransomware's functionality, including enumerating drives, finding files, encrypting files, and dropping a ransom note. The rule looks for a combination of these patterns to ensure high confidence in detection.