The screen capture utility appeared to be used for initial information gathering, as it was only used briefly at the beginning of each infection and not seen again. The information stealer was capable of stealing the contents of the clipboard, taking screenshots, recording keystrokes and stealing files and user credentials. After this initial activity, the attackers usually downloaded more of their tools to the computer using a PowerShell downloader and began moving across the victim’s network