Thx Igor,
I've used strace ... It seems to be a crypto-locker .... :(
gettimeofday({1513324654, 728614}, NULL) = 0
timerfd_settime(6, 0, {it_interval={0, 0}, it_value={0, 267775000}}, {it_interval={0, 0}, it_value={0, 0}}) = 0
gettimeofday({1513324654, 728675}, NULL) = 0
write(1, "Monero...