In all of the DropIt samples we collected, the dropper will then save the executable to the user’s %TEMP% folder and execute the file, specifically to one of the following filenames:  %TEMP%\spp.exe %TEMP%\sloo.exe %TEMP%\spoo.exe %TEMP%\vschos.exe  We have also seen Magic Hound using DropIt like a binder Trojan, specifically dropping a legitimate decoy executable along with the malicious executable as a payload