Add in FP negation & new sig to ransomware filemodifications

[kevross33]

Only ever really saw this FP of overwriting files on office and generally rare and more seen in exploits like MD5 ae6b65ca7cbd4ca0ba86c6278c834547.

FP on exploit file:

[kevross33]

Found sample doing mass file deletion; CryptoShield ransomware MD5 e4d7596676b884563d9af2eef3642b1f

[jbremer]

Merged, thanks! Checking hashes later.