Generate a particularly timed beacon that communicates over HTTP - Drop the command line Chinese language version of winrar on the target - Replace sticky keys with cmd.exe for persistence and access via RDP - Turn on RDP if it's not already enabled - Index and archive all office documents, compress and encrypt them with RAR and a specific password and store them in the recycle bin - Enable the support_388945a0 account and add it to the local admin group - Exfiltrate the data encoded over port 443 (but not SSL) - Setup an insecure service for persistence / privilege escalation