TL;DR - It's mining Monero (XMR), hidden under the guise of the McAfee app. Remove it (who wants McAfee anyways?).
After a reboot, logging in over SSH and checking for active screen sessions revealed this:
[~] # screen -ls
(hopefully) instructions for taking OTA updates when TWRP recovery is installed
Will update, reflash TWRP, regain root, and (optionally) reinstall custom kernel
| alias flatten='if dlist=`ls -d */`; then for d in $dlist; do mv -n $d/* ./; done && rmdir $dlist || echo "Error removing directories. There are probably conflicting files." ; else echo "No directories to flatten"; fi' |
| # Make the images | |
| # (used parallel to speed it up with multiple jobs, but this may not be necessary; haven't tested it) | |
| # fps=1/60 is 1 frame per minute (1/60th frame per second) | |
| parallel 'ffmpeg -i {} -vf fps=1/60 imgs/{.}_%03d.jpg' ::: vidfiles*.avi | |
| # Recombine them | |
| ffmpeg -r <fps> -pattern_type glob -i 'vidimages*.jpg' -c:v libx264 timelapse.avi |
| #!/usr/bin/python | |
| import sys | |
| import os, traceback | |
| try: | |
| pass # put code that may fail here | |
| except: | |
| print traceback.format_exc() # print the exception | |
| os.environ['PYTHONINSPECT'] = 'Y' # start interactive/inspect mode (like using the -i option) |