Once Tghz virus infects a system, it starts encrypting files, making them inaccessible to the user. It renames the files using a specific pattern, such as changing “1.jpg” to “1.jpg.tghz” and “2.png” to “2.png.tghz.” After the encryption process, it leaves a ransom note named “_readme.txt” to notify the victim.