some time ago i was doing same thing in VMware, i had external hdd conected to WMware, and everything seem normal, run couple of malwares, some of them was detected by antivirus product, some of them was not, i was not paying much attention to that, and when i was done i shut WM off.. later i saw that, half of my external HDD was encrypted by "RSA_(cryptosystem)" and files were renamed to "_RECoVERY_+asljn" i was so angry at myself for not being aware that could happen