Somebody with chinese username (hacker?) writes files into folder "users", what's going on?
I finally found the answer by myself and can reproduce the above scenario: The official wallet software of the cryptocurrency Bytecoin is creating this user and these files.

Not sure if this is legit or part of a scam :/