#RagnarLocker deploying an old VirtualBox and a Windows XP image (totalling more than 400 MB), then mounting the drives to encrypt the files on the host from the VM. This is *really* dirty... and pretty smart when you think about AV evasion.