Notes

Sus Users

• sudoadmin

Sus service

• thuglyfe
• Points to: /var/tmp/SecurityUpdate/svchost

Sus scheduled task (crontab)

• sudo crontab -l

Bunch of sus files in /var/tmp

Somewhere asefa?