I'm still guessing it's the support email platform they are using...


Btw what the file does is download something from dropbox that will send your wallet.dat somewhere and delete yours. This can easily be prevented by not having it at the default location.