Once delivered, Egregor will perform a sequence of language checks in a similar manner to both Maze and Sekhmet, before attempting to enumerate all connected drives. If successful, it connects to a command and control (C2) server to grab a list of directories present on the enumerated drives to search. Any files in these directories are then extracted and sent back to the C2 server