file_events is helpful, I found the Miner Loader process will download a temp file into /tmp folder, and execute it then delete it, but there is no pid info in file_events, aha