Egregor will only begin encrypting files once a command is sent by it's operators, presumably when they are satisfied with the information it has extracted. All non-system files are then encrypted using a hybrid AES-RSA implementation, before a ransom note is dropped on the desktop. Some Egregor variants will also attempt to display the ransom note on connected peripherals such as screens or printers