Has anyone ever seen "/USR/SBIN/CRON" in all-upper-case in their process list on a Debian box?
# ps -efly
S www-data 32137 29650 0 80 0 26084 159360 - 16:49 ? 00:00:00 /usr/sbin/apache2 -k start
S www-data 32171 29650 0 80 0 24764 159288 - 16:49 ? 00:00:00 /usr/sbin/apache2 -k start
S root 32186 3309 0 80 0 1140 8297 - 16:50 ? 00:00:00 /USR/SBIN/CRON
S root 32187 32186 0 80 0 584 1046 - 16:50 ? 00:00:00 /bin/sh -c /etc/webmin/status/monitor.pl
S root 32274 32272 0 80 0 588 1046 - 16:50 ? 00:00:00 /bin/sh /usr/sbin/apache2ctl -M
R root 32278 32274 0 80 0 8580 51289 - 16:50 ? 00:00:00 /usr/sbin/apache2 -M
R root 32280 32279 0 80 0 1192 3863 - 16:50 pts/0 00:00:00 ps -efly --sort=pcpu
S root 32281 32279 0 80 0 328 1033 - 16:50 pts/0 00:00:00 tail -20
S root 3019 1 0 80 0 5028 70104 - 06:16 ? 00:01:09 /usr/bin/python /usr/bin/fail2ban-server ...
S root 32132 3370 0 80 0 40276 16160 - 16:49 ? 00:00:00 dovecot/config
S dovenull 32159 3370 0 80 0 3040 6074 - 16:49 ? 00:00:00 dovecot/imap-login
S root 32179 3370 0 80 0 4364 23333 - 16:49 ? 00:00:00 dovecot/auth -w
S mysql 3004 2577 1 80 0 97640 155455 - 06:16 ? 00:11:19 /usr/sbin/mysqld ...
S root 32189 32187 29 80 0 22416 12148 - 16:50 ? 00:00:00 /usr/bin/perl /usr/share/webmin/status/monitor.pl