Ransomware Research Reveals Millions Spent Despite Do Not Pay Policies