User Activity Checking Once Chopper successfully infects a system, the malicious actor will issue a query user (quser) command in an attempt to identify the primary user or those who are currently logged in as users in the system.