not looking suspicious in ps aux maybe ? at the very least if you hacked into VM hypervisor