Cryptominer Triage: Document the IOCs

High CPU was reported on this host and a cryptominer is suspected. Before anyone eradicates anything, do the triage: find the miner and DOCUMENT your indicators of compromise. Investigate the box (processes, binaries, and the usual persistence spots), then write a findings report to /root/case/findings.txt that records two concrete IOCs: the full path of the malicious binary, and the full path of the persistence file that relaunches it. Grading reads /root/case/findings.txt and checks it names both. (Do not delete anything — this is the documentation phase.)