Found processes trough Apache RCE:

/usr/lib/systemd/systemd�--system�--deserialize�25�

/usr/local/directadmin/directadmin�
/usr/local/directadmin/directadmin�
dovecot/pop3-login�


dovecot/imap-login�
dovecot/imap-login�





/usr/sbin/sshd�-d�













dovecot/lmtp�-l�



/usr/lib/systemd/systemd-logind�
/usr/sbin/pure-certd�-r�/usr/local/bin/pureftpd_sni.sh�-s�/var/run/pure-certd.sock�
dovecot/lmtp�-l�
/usr/bin/dbus-daemon�--system�--address=systemd:�--nofork�--nopidfile�--systemd-activation�
/usr/sbin/networkmanager�--no-daemon�
dovecot/lmtp�-l�
/usr/sbin/atd�-f�
/sbin/agetty�--noclear�tty1�linux�

dovecot/imap-login�

dovecot/pop3-login�

dovecot/lmtp�-l�
dovecot/imap-login�
dovecot/lmtp�-l�
dovecot/pop3-login�
/bin/sh�/usr/bin/mysqld_safe�--basedir=/usr�
dovecot/imap-login�
dovecot/pop3-login�
dovecot/imap-login [83.162.252.82 tls proxy]
dovecot/imap-login�

dovecot/lmtp�-l�
dovecot/lmtp�-l�


lfd - sleeping
dovecot/pop3-login�
/usr/sbin/httpd�-dforeground�
dovecot/imap [info@versloot-steenkunst.nl 83.162.252.82 idle]
dovecot/imap-login [83.162.252.82 tls proxy]
dovecot/imap [info@versloot-steenkunst.nl 83.162.252.82 idle]


/usr/sbin/crond�-n�
/usr/sbin/lvmetad�-f�

/usr/bin/vgauthservice�-s�
/usr/bin/vmtoolsd�
/usr/sbin/httpd�-dforeground�
/usr/sbin/httpd�-dforeground�


dovecot/imap [info@versloot-steenkunst.nl 83.162.252.82]
dovecot/lmtp�-l�
/usr/local/patchman/patchmand�
dovecot/pop3-login�
/usr/sbin/dovecot�-f�
/usr/sbin/pure-ftpd�/etc/pure-ftpd.conf�
dovecot/anvil [36 connections]
/usr/sbin/exim�-bd�-q1h�

/usr/sbin/httpd�-dforeground�
dovecot/imap-login�
dovecot/imap-login�


/usr/sbin/httpd�-dforeground�
/usr/local/directadmin/directadmin�
/usr/lib/polkit-1/polkitd�--no-debug�
dovecot/imap-login�
dovecot/imap-login�
/usr/sbin/httpd�-dforeground�

/usr/sbin/httpd�-dforeground�
/usr/sbin/httpd�-dforeground�

php-fpm: pool hestonre�������������������������������������������������
dovecot/imap-login�

/usr/sbin/httpd�-dforeground�


dovecot/pop3-login�
/usr/sbin/httpd�-dforeground�
php-fpm: pool wetering�������������������������������������������������
/usr/sbin/httpd�-dforeground�
/usr/lib/systemd/systemd-udevd�
/usr/sbin/irqbalance�--foreground�
/bin/sh�
/bin/sh�


dovecot/pop3-login�

dovecot/imap-login�

dovecot/lmtp�-l�
dovecot/imap-login�
/usr/bin/python2�-es�/usr/sbin/tuned�-l�-p�
/usr/local/directadmin/directadmin�
/usr/local/directadmin/directadmin�


dovecot/pop3-login�
/usr/local/directadmin/directadmin�
/usr/local/directadmin/directadmin�
/usr/sbin/nagent�-f�/home/nagent/nagent.conf�

dovecot/imap-login�
dovecot/imap-login�
php-fpm: master process (/usr/local/php56/etc/php-fpm.conf)������������
php-fpm: master process (/usr/local/php73/etc/php-fpm.conf)������������
php-fpm: master process (/usr/local/php74/etc/php-fpm.conf)������������
/usr/sbin/httpd�-dforeground�
dovecot/pop3-login�

dovecot/pop3-login�
dovecot/lmtp�-l�
/usr/sbin/named�-u�named�

dovecot/lmtp�-l�
dovecot/pop3-login�


tmux�
-bash�
-bash�
-bash�
-bash�
/opt/puppetlabs/puppet/bin/ruby�/opt/puppetlabs/puppet/bin/puppet�agent�--no-daemonize�

top�
dovecot/pop3-login�



dovecot/lmtp�-l�

dovecot/lmtp�-l�

/usr/sbin/rsyslogd�-n�


/usr/local/bin/freshclam�-d�


/usr/local/sbin/clamd�--foreground=yes�






dovecot/log�

dovecot/config�
dovecot/stats [55 connections]
dovecot/auth [0 wait, 0 passdb, 0 userdb]



dovecot/lmtp�-l�

dovecot/pop3-login�
dovecot/pop3-login�













/usr/local/directadmin/directadmin�
/usr/local/directadmin/directadmin�
/usr/local/directadmin/directadmin�
/usr/local/directadmin/directadmin�
/usr/local/directadmin/directadmin�



dovecot/lmtp�-l�


















dovecot/imap-login [83.162.252.82 tls proxy]
dovecot/imap-login�


/usr/lib/systemd/systemd-journald�
dovecot/lmtp�-l�

dovecot/pop3-login�





/usr/sbin/mysqld�--basedir=/usr�--datadir=/var/lib/mysql�--plugin-dir=/usr/lib64/mysql/plugin�--log-error=/var/lib/mysql/ws1.damecon.com.err�--pid-file=ws1.damecon.com.pid�
/usr/local/directadmin/da-popb4smtp�


cat�/proc/self/cmdline�