Upon execution, the Micropsia malware takes screenshots every 90 seconds by calling to Gdi32.BitBlt API. Screenshots are saved as unencrypted files in JPEG format with a specific file name that contains the current timestamp (yyyy-mm-dd hh-nn-ss) with the hardcoded extension .his