The malware beacons to this directory using the hardcoded API token and attempts to download these files (which are deleted from the Dropbox account after the download):  upload.bat, a batch script that the compromised machine will execute upload.rar, a RAR archive that contains at least two files: a batch script to execute, and often an executable (sometimes named rar.exe)  which the batch script will run and almost always uploads the results of download.rar to the cloud storage account silent.txt and period.txt,  small files sizes of 0-4 bytes that dictate the frequency to check in with the CnC  The threat actor will then download the results and then delete the files from the cloud storage account