It depends on how much trouble the program goes to to hide where it is run from. If it is not too much then
- Start with the process ID,
12583 in the screenshot
ls -l /proc/12583/exe and it should give you a symbolic link to an absolute pathname, which may be annotated with
- examine the file at the pathname if it has not been deleted. Note in particular if the link count is 1. If it isn't then you will need to find the other names for the file.
Since you describe this as a test server, you are probably better off by saving any data and reinstalling. The fact that the program is running as root means you really can't trust the machine now.
update: We now know the file is in /tmp. Since this is a binary, there are a couple of choices, the file is being compiled on the system or it is being compiled on another system. A look at the last use time of the compiler driver
ls -lu /usr/bin/gcc might give you a clue.
As a stopgap, if the file has a constant name, you could create a file with this name but is write protected. I would suggest a small shell script which logs all the current processes and then sleeps for a long time just in case whatever is running the command respawns the job. I would use
chattr +i /tmp/Carbon if your filesystem allows it as few scripts will know how to deal with immutable files.