Answer by Kamil Maciorowski for In Linux, how can I find which running programs have their executable file deleted?

If your find supports -ls and there is some deleted exectutable running, then this command

sudo find /proc -name exe ! -path "*/task/*" -ls 2>/dev/null | grep ' (deleted)$'

will probably generate a line that ends like this example:

… /proc/9956/exe -> /path/to/executable\ (deleted)

This means the process with PID 9956 is executing /path/to/executable which is now deleted.

Notes:

• -ls is not required by POSIX. Your find may or may not support it, or it may support it but generate output in a different format.
• An existing running executable named anything (deleted) will generate a false positive.