Captured with Lightshot

I noticed that my crontab job wasn't running so I went looking and I saw my crontab had been overwritten by

* * */2 * * /home/media/.ttp/a/upd>/dev/null 2>&1
@reboot /home/media/.ttp/a/upd>/dev/null 2>&1
5 8 * * 0 /home/media/.ttp/b/sync>/dev/null 2>&1
@reboot /home/media/.ttp/b/sync>/dev/null 2>&1
5 1 * * * /tmp/.ssh/.rsync/c/aptitude>/dev/null 2>&1

These seem to be pointing to some crypto mining daemon stuff installed under my home directory. I removed the files and updated my