TrendLabs: The New Face of Necurs: Noteworthy Changes to Necurs’ Behaviors

Figure 3. Example: the directory storing credentials with a string in email format as part of the filename

REF: https://blog.trendmicro.com/trendlabs-security-intelligence/the-new-face-of-necurs-noteworthy-changes-to-necurs-behaviors/