Egregor masquerades svchost.exe process to launch an RClone client in order to exfiltrate data. Based on investigations and OSINT, we know that Egregor used at least three different configurations to exfiltrate data