Suspicious process running

Post Reply
seobegood
Junior Member
Posts: 1
Joined: 22 Nov 2023, 17:49

Suspicious process running

Post by seobegood »

Hi,
I have already looked around this form , but did not come to a positive conclusion in the end.
I have been working for years with csf (and now also with cxs ). Now I am getting 'weird' messages on /opt/cpanel/ea php81/root/usr/sbin/php-fpm. Especially since multiple files are being opened/transferred.

I have investigated the ip's and they are from cloudflare and google (even 1 from microsoft?).

So my question is , is this normal?
I hope you guys can help me with this.

Executable:

/opt/cpanel/ea-php81/root/usr/sbin/php-fpm


Command Line (often faked in exploits):

php-fpm: pool quieroalgodiferente_com


Network connections by the process (if any):

tcp: ************:59776 -> 142.251.36.42:443 (Also this IP'S: 188.114.97.3)


Files open by the process (if any):

/dev/null
/opt/imunify360/proactive/dangerlist
/usr/share/i360-php-opts/.rules.v2
/usr/share/i360-php-opts/pd_v1.hdb
/usr/share/i360-php-opts/pd-combined-compiled
/home/******/public_html/index.php
/home/*****/public_html/wordfence-waf.php
/home/******/public_html/wp-content/wflogs/ips.php
/home/******/public_html/wp-content/wflogs/config.php
/home/******/public_html/wp-content/wflogs/attack-data.php
/home/******/public_html/wp-content/wflogs/config-synced.php (deleted)
/home/******/public_html/wp-content/wflogs/config-livewaf.php
/home/******/public_html/wp-content/wflogs/config-transient.php


Memory maps by the process (if any):

00400000-0088c000 r-xp 00000000 08:03 1574846 /opt/cpanel/ea-php81/root/usr/sbin/php-fpm
00b76000-00be0000 r--p 00576000 08:03 1574846 /opt/cpanel/ea-php81/root/usr/sbin/php-fpm
00be0000-00be2000 rw-p 005e0000 08:03 1574846 /opt/cpanel/ea-php81/root/usr/sbin/php-fpm
00be2000-00c00000 r--p 005e2000 08:03 1574846 /opt/cpanel/ea-php81/root/usr/sbin/php-fpm
00c00000-00c04000 rw-p 00600000 08:03 1574846 /opt/cpanel/ea-php81/root/usr/sbin/php-fpm
00c04000-00c23000 rw-p 00000000 00:00 0
01846000-01ae0000 rw-p 00000000 00:00 0 [heap]
01ae0000-01e6e000 rw-p 00000000 00:00 0 [heap]
7fb472000000-7fb472500000 rw-p 00000000 00:00 0
7fb472600000-7fb473a00000 rw-p 00000000 00:00 0
7fb473e00000-7fb474000000 rw-p 00000000 00:00 0
7fb474000000-7fb474021000 rw-p 00000000 00:00 0
7fb474021000-7fb478000000 ---p 00000000 00:00 0
7fb4781ff000-7fb478200000 ---p 00000000 00:00 0
7fb478200000-7fb478a00000 rw-p 00000000 00:00 0
7fb479000000-7fb479200000 rw-p 00000000 00:00 0
7fb479400000-7fb479600000 rw-p 00000000 00:00 0
7fb479a00000-7fb479c00000 rw-p 00000000 00:00 0
7fb479e00000-7fb47a600000 rw-p 00000000 00:00 0
7fb47a800000-7fb47ac00000 rw-p 00000000 00:00 0
7fb47ac00000-7fb47ae00000 rw-p 00000000 00:00 0
7fb47af20000-7fb47b000000 rwxp 00000000 00:00 0
7fb47b000000-7fb47c000000 rw-p 00000000 00:00 0
7fb47c200000-7fb47d400000 rw-p 00000000 00:00 0
7fb47d400000-7fb47d600000 rw-p 00000000 00:00 0
7fb47d790000-7fb47d800000 rwxp 00000000 00:00 0
7fb47d800000-7fb47de00000 rw-p 00000000 00:00 0
7fb47df2f000-7fb47dfb0000 rw-p 00000000 00:00 0
7fb47dfb0000-7fb47e000000 rwxp 00000000 00:00 0
7fb47e000000-7fb47ee51000 rw-p 00000000 00:00 0
7fb47ee51000-7fb47ef11000 rwxp 00000000 00:00 0
7fb47ef11000-7fb47f137000 r--p 00000000 08:03 5117396 /usr/share/i360-php-opts/.rules.v2
7fb47f137000-7fb47f144000 r-xp 00000000 08:03 4466905 /usr/lib64/libunwind.so.8.0.1
7fb47f144000-7fb47f343000 ---p 0000d000 08:03 4466905 /usr/lib64/libunwind.so.8.0.1
7fb47f343000-7fb47f344000 r--p 0000c000 08:03 4466905 /usr/lib64/libunwind.so.8.0.1
7fb47f344000-7fb47f345000 rw-p 0000d000 08:03 4466905 /usr/lib64/libunwind.so.8.0.1
7fb47f345000-7fb47f34f000 rw-p 00000000 00:00 0
7fb47f34f000-7fb47f6ff000 r-xp 00000000 08:03 1836883 /opt/alt/hyperscan54/lib64/libhs_runtime.so.5.4.0
7fb47f6ff000-7fb47f8ff000 ---p 003b0000 08:03 1836883 /opt/alt/hyperscan54/lib64/libhs_runtime.so.5.4.0
7fb47f8ff000-7fb47f900000 r--p 003b0000 08:03 1836883 /opt/alt/hyperscan54/lib64/libhs_runtime.so.5.4.0
7fb47f900000-7fb47f901000 rw-p 003b1000 08:03 1836883 /opt/alt/hyperscan54/lib64/libhs_runtime.so.5.4.0
7fb47f901000-7fb47f907000 r-xp 00000000 08:03 4466922 /usr/lib64/libatomic.so.1.2.0
7fb47f907000-7fb47fb06000 ---p 00006000 08:03 4466922 /usr/lib64/libatomic.so.1.2.0
7fb47fb06000-7fb47fb07000 r--p 00005000 08:03 4466922 /usr/lib64/libatomic.so.1.2.0
7fb47fb07000-7fb47fb09000 rw-p 00000000 00:00 0
7fb47fb09000-7fb47fb27000 r-xp 00000000 08:03 4462536 /usr/lib64/libyaml-0.so.2.0.5
7fb47fb27000-7fb47fd27000 ---p 0001e000 08:03 4462536 /usr/lib64/libyaml-0.so.2.0.5
7fb47fd27000-7fb47fd28000 r--p 0001e000 08:03 4462536 /usr/lib64/libyaml-0.so.2.0.5
7fb47fd28000-7fb47fd29000 rw-p 00000000 00:00 0
7fb47fd29000-7fb47fd31000 r-xp 00000000 08:03 4465490 /usr/lib64/libprotobuf-c.so.1.0.0
7fb47fd31000-7fb47ff30000 ---p 00008000 08:03 4465490 /usr/lib64/libprotobuf-c.so.1.0.0
7fb47ff30000-7fb47ff31000 r--p 00007000 08:03 4465490 /usr/lib64/libprotobuf-c.so.1.0.0
7fb47ff31000-7fb47ff32000 rw-p 00008000 08:03 4465490 /usr/lib64/libprotobuf-c.so.1.0.0
7fb47ff32000-7fb480005000 r-xp 00000000 08:03 1581743 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/i360.so
7fb480005000-7fb480205000 ---p 000d3000 08:03 1581743 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/i360.so
7fb480205000-7fb48020d000 r--p 000d3000 08:03 1581743 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/i360.so
7fb48020d000-7fb480211000 rw-p 000db000 08:03 1581743 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/i360.so
7fb480211000-7fb4802e0000 rw-p 00000000 00:00 0
7fb4802e0000-7fb4802e8000 r-xp 00000000 08:03 1581791 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/xmlreader.so
7fb4802e8000-7fb4804e8000 ---p 00008000 08:03 1581791 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/xmlreader.so
7fb4804e8000-7fb4804e9000 r--p 00008000 08:03 1581791 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/xmlreader.so
7fb4804e9000-7fb4804ea000 rw-p 00009000 08:03 1581791 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/xmlreader.so
7fb4804ea000-7fb4804f1000 r-xp 00000000 08:03 1581785 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/pdo_sqlite.so
7fb4804f1000-7fb4806f1000 ---p 00007000 08:03 1581785 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/pdo_sqlite.so
7fb4806f1000-7fb4806f2000 r--p 00007000 08:03 1581785 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/pdo_sqlite.so
7fb4806f2000-7fb4806f3000 rw-p 00008000 08:03 1581785 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/pdo_sqlite.so
7fb4806f3000-7fb4806fa000 r-xp 00000000 08:03 1581801 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/pdo_mysql.so
7fb4806fa000-7fb4808f9000 ---p 00007000 08:03 1581801 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/pdo_mysql.so
7fb4808f9000-7fb4808fa000 r--p 00006000 08:03 1581801 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/pdo_mysql.so
7fb4808fa000-7fb4808fb000 rw-p 00007000 08:03 1581801 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/pdo_mysql.so
7fb4808fb000-7fb48091c000 r-xp 00000000 08:03 1574896 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/mysqli.so
7fb48091c000-7fb480b1c000 ---p 00021000 08:03 1574896 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/mysqli.so
7fb480b1c000-7fb480b21000 r--p 00021000 08:03 1574896 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/mysqli.so
7fb480b21000-7fb480b22000 rw-p 00026000 08:03 1574896 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/mysqli.so
7fb480b22000-7fb480b44000 r-xp 00000000 08:03 1573167 /opt/cpanel/ea-libzip/lib64/libzip.so.5.5
7fb480b44000-7fb480d44000 ---p 00022000 08:03 1573167 /opt/cpanel/ea-libzip/lib64/libzip.so.5.5
7fb480d44000-7fb480d45000 r--p 00022000 08:03 1573167 /opt/cpanel/ea-libzip/lib64/libzip.so.5.5
7fb480d45000-7fb480d46000 rw-p 00023000 08:03 1573167 /opt/cpanel/ea-libzip/lib64/libzip.so.5.5
7fb480d46000-7fb480d57000 r-xp 00000000 08:03 1574908 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/zip.so
7fb480d57000-7fb480f57000 ---p 00011000 08:03 1574908 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/zip.so
7fb480f57000-7fb480f59000 r--p 00011000 08:03 1574908 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/zip.so
7fb480f59000-7fb480f5a000 rw-p 00013000 08:03 1574908 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/zip.so
7fb480f5a000-7fb480f99000 r-xp 00000000 08:03 4465843 /usr/lib64/libxslt.so.1.1.32
7fb480f99000-7fb481198000 ---p 0003f000 08:03 4465843 /usr/lib64/libxslt.so.1.1.32
7fb481198000-7fb48119a000 r--p 0003e000 08:03 4465843 /usr/lib64/libxslt.so.1.1.32
7fb48119a000-7fb48119b000 rw-p 00040000 08:03 4465843 /usr/lib64/libxslt.so.1.1.32
7fb48119b000-7fb4811b0000 r-xp 00000000 08:03 4465841 /usr/lib64/libexslt.so.0.8.20
7fb4811b0000-7fb4813b0000 ---p 00015000 08:03 4465841 /usr/lib64/libexslt.so.0.8.20
7fb4813b0000-7fb4813b1000 r--p 00015000 08:03 4465841 /usr/lib64/libexslt.so.0.8.20
7fb4813b1000-7fb4813b2000 rw-p 00016000 08:03 4465841 /usr/lib64/libexslt.so.0.8.20
7fb4813b2000-7fb4813b9000 r-xp 00000000 08:03 1581793 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/xsl.so
7fb4813b9000-7fb4815b9000 ---p 00007000 08:03 1581793 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/xsl.so
7fb4815b9000-7fb4815ba000 r--p 00007000 08:03 1581793 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/xsl.so
7fb4815ba000-7fb4815bb000 rw-p 00008000 08:03 1581793 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/xsl.so
7fb4815bb000-7fb4815c4000 r-xp 00000000 08:03 1581792 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/xmlwriter.so
7fb4815c4000-7fb4817c3000 ---p 00009000 08:03 1581792 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/xmlwriter.so
7fb4817c3000-7fb4817c6000 r--p 00008000 08:03 1581792 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/xmlwriter.so
7fb4817c6000-7fb4817c7000 rw-p 0000b000 08:03 1581792 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/xmlwriter.so
7fb4817c7000-7fb4817d2000 r-xp 00000000 08:03 1581790 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/xml.so
7fb4817d2000-7fb4819d2000 ---p 0000b000 08:03 1581790 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/xml.so
7fb4819d2000-7fb4819d3000 r--p 0000b000 08:03 1581790 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/xml.so
7fb4819d3000-7fb4819d4000 rw-p 0000c000 08:03 1581790 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/xml.so
7fb4819d4000-7fb4819db000 r-xp 00000000 08:03 1581780 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/tokenizer.so
7fb4819db000-7fb481bda000 ---p 00007000 08:03 1581780 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/tokenizer.so
7fb481bda000-7fb481bdb000 r--p 00006000 08:03 1581780 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/tokenizer.so
7fb481bdb000-7fb481bdc000 rw-p 00007000 08:03 1581780 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/tokenizer.so
7fb481bdc000-7fb481cea000 r-xp 00000000 08:03 4461618 /usr/lib64/libsqlite3.so.0.8.6
7fb481cea000-7fb481ee9000 ---p 0010e000 08:03 4461618 /usr/lib64/libsqlite3.so.0.8.6
7fb481ee9000-7fb481eed000 r--p 0010d000 08:03 4461618 /usr/lib64/libsqlite3.so.0.8.6
7fb481eed000-7fb481ef0000 rw-p 00111000 08:03 4461618 /usr/lib64/libsqlite3.so.0.8.6
7fb481ef0000-7fb481efe000 r-xp 00000000 08:03 1581786 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/sqlite3.so
7fb481efe000-7fb4820fd000 ---p 0000e000 08:03 1581786 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/sqlite3.so
7fb4820fd000-7fb4820ff000 r--p 0000d000 08:03 1581786 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/sqlite3.so
7fb4820ff000-7fb482100000 rw-p 0000f000 08:03 1581786 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/sqlite3.so
7fb482100000-7fb482116000 r-xp 00000000 08:03 1581809 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/sockets.so
7fb482116000-7fb482316000 ---p 00016000 08:03 1581809 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/sockets.so
7fb482316000-7fb482318000 r--p 00016000 08:03 1581809 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/sockets.so
7fb482318000-7fb482319000 rw-p 00018000 08:03 1581809 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/sockets.so
7fb482319000-7fb482326000 r-xp 00000000 08:03 1581789 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/simplexml.so
7fb482326000-7fb482526000 ---p 0000d000 08:03 1581789 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/simplexml.so
7fb482526000-7fb482527000 r--p 0000d000 08:03 1581789 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/simplexml.so
7fb482527000-7fb482528000 rw-p 0000e000 08:03 1581789 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/simplexml.so
7fb482528000-7fb482530000 r-xp 00000000 08:03 1581787 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/posix.so
7fb482530000-7fb482730000 ---p 00008000 08:03 1581787 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/posix.so
7fb482730000-7fb482731000 r--p 00008000 08:03 1581787 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/posix.so
7fb482731000-7fb482732000 rw-p 00009000 08:03 1581787 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/posix.so
7fb482732000-7fb482774000 r-xp 00000000 08:03 1581779 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/phar.so
7fb482774000-7fb482973000 ---p 00042000 08:03 1581779 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/phar.so
7fb482973000-7fb482976000 r--p 00041000 08:03 1581779 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/phar.so
7fb482976000-7fb482977000 rw-p 00044000 08:03 1581779 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/phar.so
7fb482977000-7fb482993000 r-xp 00000000 08:03 1581784 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/pdo.so
7fb482993000-7fb482b92000 ---p 0001c000 08:03 1581784 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/pdo.so
7fb482b92000-7fb482b95000 r--p 0001b000 08:03 1581784 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/pdo.so
7fb482b95000-7fb482b96000 rw-p 0001e000 08:03 1581784 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/pdo.so
7fb482b96000-7fb482bc9000 r-xp 00000000 08:03 1581800 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/mysqlnd.so
7fb482bc9000-7fb482dc9000 ---p 00033000 08:03 1581800 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/mysqlnd.so
7fb482dc9000-7fb482dce000 r--p 00033000 08:03 1581800 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/mysqlnd.so
7fb482dce000-7fb482dd0000 rw-p 00038000 08:03 1581800 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/mysqlnd.so
7fb482dd0000-7fb482dd1000 rw-p 00000000 00:00 0
7fb482dd1000-7fb482e5d000 r-xp 00000000 08:03 1574814 /opt/cpanel/ea-oniguruma/lib64/libonig.so.5.4.0
7fb482e5d000-7fb48305c000 ---p 0008c000 08:03 1574814 /opt/cpanel/ea-oniguruma/lib64/libonig.so.5.4.0
7fb48305c000-7fb48305e000 r--p 0008b000 08:03 1574814 /opt/cpanel/ea-oniguruma/lib64/libonig.so.5.4.0
7fb48305e000-7fb483065000 rw-p 0008d000 08:03 1574814 /opt/cpanel/ea-oniguruma/lib64/libonig.so.5.4.0
7fb483065000-7fb483163000 r-xp 00000000 08:03 1574888 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/mbstring.so
7fb483163000-7fb483363000 ---p 000fe000 08:03 1574888 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/mbstring.so
7fb483363000-7fb48336b000 r--p 000fe000 08:03 1574888 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/mbstring.so
7fb48336b000-7fb48336d000 rw-p 00106000 08:03 1574888 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/mbstring.so
7fb48336d000-7fb483372000 r-xp 00000000 08:03 4461792 /usr/lib64/libcap-ng.so.0.0.0
7fb483372000-7fb483571000 ---p 00005000 08:03 4461792 /usr/lib64/libcap-ng.so.0.0.0
7fb483571000-7fb483572000 r--p 00004000 08:03 4461792 /usr/lib64/libcap-ng.so.0.0.0
7fb483572000-7fb483573000 rw-p 00000000 00:00 0
7fb483573000-7fb483592000 r-xp 00000000 08:03 4461793 /usr/lib64/libaudit.so.1.0.0
7fb483592000-7fb483792000 ---p 0001f000 08:03 4461793 /usr/lib64/libaudit.so.1.0.0
7fb483792000-7fb483793000 r--p 0001f000 08:03 4461793 /usr/lib64/libaudit.so.1.0.0
7fb483793000-7fb483794000 rw-p 00020000 08:03 4461793 /usr/lib64/libaudit.so.1.0.0
7fb483794000-7fb4837a4000 rw-p 00000000 00:00 0
7fb4837a4000-7fb4837b2000 r-xp 00000000 08:03 4463460 /usr/lib64/libpam.so.0.84.2
7fb4837b2000-7fb4839b2000 ---p 0000e000 08:03 4463460 /usr/lib64/libpam.so.0.84.2
7fb4839b2000-7fb4839b3000 r--p 0000e000 08:03 4463460 /usr/lib64/libpam.so.0.84.2
7fb4839b3000-7fb4839b4000 rw-p 0000f000 08:03 4463460 /usr/lib64/libpam.so.0.84.2
7fb4839b4000-7fb483ac3000 r-xp 00000000 08:03 1581808 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/imap.so
7fb483ac3000-7fb483cc2000 ---p 0010f000 08:03 1581808 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/imap.so
7fb483cc2000-7fb483cc6000 r--p 0010e000 08:03 1581808 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/imap.so
7fb483cc6000-7fb483cce000 rw-p 00112000 08:03 1581808 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/imap.so
7fb483cce000-7fb483cd0000 rw-p 00000000 00:00 0
7fb483cd0000-7fb483cda000 r-xp 00000000 08:03 1581807 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/iconv.so
7fb483cda000-7fb483eda000 ---p 0000a000 08:03 1581807 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/iconv.so
7fb483eda000-7fb483edb000 r--p 0000a000 08:03 1581807 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/iconv.so
7fb483edb000-7fb483edc000 rw-p 0000b000 08:03 1581807 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/iconv.so
7fb483edc000-7fb483edf000 r-xp 00000000 08:03 4465553 /usr/lib64/libXau.so.6.0.0
7fb483edf000-7fb4840de000 ---p 00003000 08:03 4465553 /usr/lib64/libXau.so.6.0.0
7fb4840de000-7fb4840df000 r--p 00002000 08:03 4465553 /usr/lib64/libXau.so.6.0.0
7fb4840df000-7fb4840e0000 rw-p 00000000 00:00 0
7fb4840e0000-7fb4840f0000 r-xp 00000000 08:03 4461545 /usr/lib64/libbz2.so.1.0.6
7fb4840f0000-7fb4842ef000 ---p 00010000 08:03 4461545 /usr/lib64/libbz2.so.1.0.6
7fb4842ef000-7fb4842f0000 r--p 0000f000 08:03 4461545 /usr/lib64/libbz2.so.1.0.6
7fb4842f0000-7fb4842f1000 rw-p 00010000 08:03 4461545 /usr/lib64/libbz2.so.1.0.6
7fb4842f1000-7fb484319000 r-xp 00000000 08:03 4465605 /usr/lib64/libxcb.so.1.1.0
7fb484319000-7fb484518000 ---p 00028000 08:03 4465605 /usr/lib64/libxcb.so.1.1.0
7fb484518000-7fb484519000 r--p 00027000 08:03 4465605 /usr/lib64/libxcb.so.1.1.0
7fb484519000-7fb48451a000 rw-p 00028000 08:03 4465605 /usr/lib64/libxcb.so.1.1.0
7fb48451a000-7fb4845cf000 r-xp 00000000 08:03 4462423 /usr/lib64/libfreetype.so.6.16.1
7fb4845cf000-7fb4847ce000 ---p 000b5000 08:03 4462423 /usr/lib64/libfreetype.so.6.16.1
7fb4847ce000-7fb4847d5000 r--p 000b4000 08:03 4462423 /usr/lib64/libfreetype.so.6.16.1
7fb4847d5000-7fb4847d6000 rw-p 00000000 00:00 0
7fb4847d6000-7fb484913000 r-xp 00000000 08:03 4465607 /usr/lib64/libX11.so.6.3.0
7fb484913000-7fb484b13000 ---p 0013d000 08:03 4465607 /usr/lib64/libX11.so.6.3.0
7fb484b13000-7fb484b16000 r--p 0013d000 08:03 4465607 /usr/lib64/libX11.so.6.3.0
7fb484b16000-7fb484b1a000 rw-p 00140000 08:03 4465607 /usr/lib64/libX11.so.6.3.0
7fb484b1a000-7fb484b2c000 r-xp 00000000 08:03 4465610 /usr/lib64/libXpm.so.4.11.0
7fb484b2c000-7fb484d2b000 ---p 00012000 08:03 4465610 /usr/lib64/libXpm.so.4.11.0
7fb484d2b000-7fb484d2c000 r--p 00011000 08:03 4465610 /usr/lib64/libXpm.so.4.11.0
7fb484d2c000-7fb484d2d000 rw-p 00012000 08:03 4465610 /usr/lib64/libXpm.so.4.11.0
7fb484d2d000-7fb484d94000 r-xp 00000000 08:03 4465513 /usr/lib64/libjpeg.so.62.2.0
7fb484d94000-7fb484f94000 ---p 00067000 08:03 4465513 /usr/lib64/libjpeg.so.62.2.0
7fb484f94000-7fb484f95000 r--p 00067000 08:03 4465513 /usr/lib64/libjpeg.so.62.2.0
7fb484f95000-7fb484f96000 rw-p 00068000 08:03 4465513 /usr/lib64/libjpeg.so.62.2.0
7fb484f96000-7fb485001000 r-xp 00000000 08:03 4465544 /usr/lib64/libwebp.so.7.0.2
7fb485001000-7fb485200000 ---p 0006b000 08:03 4465544 /usr/lib64/libwebp.so.7.0.2
7fb485200000-7fb485201000 r--p 0006a000 08:03 4465544 /usr/lib64/libwebp.so.7.0.2
7fb485201000-7fb485202000 rw-p 0006b000 08:03 4465544 /usr/lib64/libwebp.so.7.0.2
7fb485202000-7fb485204000 rw-p 00000000 00:00 0
7fb485204000-7fb485237000 r-xp 00000000 08:03 4462421 /usr/lib64/libpng16.so.16.34.0
7fb485237000-7fb485437000 ---p 00033000 08:03 4462421 /usr/lib64/libpng16.so.16.34.0
7fb485437000-7fb485438000 r--p 00033000 08:03 4462421 /usr/lib64/libpng16.so.16.34.0
7fb485438000-7fb485439000 rw-p 00000000 00:00 0
7fb485439000-7fb485495000 r-xp 00000000 08:03 1581806 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/gd.so
7fb485495000-7fb485694000 ---p 0005c000 08:03 1581806 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/gd.so
7fb485694000-7fb485698000 r--p 0005b000 08:03 1581806 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/gd.so
7fb485698000-7fb485699000 rw-p 0005f000 08:03 1581806 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/gd.so
7fb485699000-7fb48569d000 rw-p 00000000 00:00 0
7fb48569d000-7fb4856ab000 r-xp 00000000 08:03 1574549 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/ftp.so
7fb4856ab000-7fb4858ab000 ---p 0000e000 08:03 1574549 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/ftp.so
7fb4858ab000-7fb4858ad000 r--p 0000e000 08:03 1574549 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/ftp.so
7fb4858ad000-7fb4858ae000 rw-p 00010000 08:03 1574549 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/ftp.so
7fb4858ae000-7fb4858d9000 r-xp 00000000 08:03 1581788 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/dom.so
7fb4858d9000-7fb485ad8000 ---p 0002b000 08:03 1581788 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/dom.so
7fb485ad8000-7fb485adc000 r--p 0002a000 08:03 1581788 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/dom.so
7fb485adc000-7fb485add000 rw-p 0002e000 08:03 1581788 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/dom.so
7fb485add000-7fb485ade000 rw-p 00000000 00:00 0
7fb485ade000-7fb485afd000 r-xp 00000000 08:03 4462449 /usr/lib64/libbrotlicommon.so.1.0.6
7fb485afd000-7fb485cfd000 ---p 0001f000 08:03 4462449 /usr/lib64/libbrotlicommon.so.1.0.6
7fb485cfd000-7fb485cfe000 r--p 0001f000 08:03 4462449 /usr/lib64/libbrotlicommon.so.1.0.6
7fb485cfe000-7fb485cff000 rw-p 00020000 08:03 4462449 /usr/lib64/libbrotlicommon.so.1.0.6
7fb485cff000-7fb485d1b000 r-xp 00000000 08:03 4462636 /usr/lib64/libsasl2.so.3.0.0
7fb485d1b000-7fb485f1b000 ---p 0001c000 08:03 4462636 /usr/lib64/libsasl2.so.3.0.0
7fb485f1b000-7fb485f1c000 r--p 0001c000 08:03 4462636 /usr/lib64/libsasl2.so.3.0.0
7fb485f1c000-7fb485f1d000 rw-p 0001d000 08:03 4462636 /usr/lib64/libsasl2.so.3.0.0
7fb485f1d000-7fb485f20000 r-xp 00000000 08:03 4461744 /usr/lib64/libkeyutils.so.1.6
7fb485f20000-7fb48611f000 ---p 00003000 08:03 4461744 /usr/lib64/libkeyutils.so.1.6
7fb48611f000-7fb486120000 r--p 00002000 08:03 4461744 /usr/lib64/libkeyutils.so.1.6
7fb486120000-7fb486121000 rw-p 00000000 00:00 0
7fb486121000-7fb486130000 r-xp 00000000 08:03 4463051 /usr/lib64/libkrb5support.so.0.1
7fb486130000-7fb486330000 ---p 0000f000 08:03 4463051 /usr/lib64/libkrb5support.so.0.1
7fb486330000-7fb486331000 r--p 0000f000 08:03 4463051 /usr/lib64/libkrb5support.so.0.1
7fb486331000-7fb486332000 rw-p 00010000 08:03 4463051 /usr/lib64/libkrb5support.so.0.1
7fb486332000-7fb4864af000 r-xp 00000000 08:03 4461678 /usr/lib64/libunistring.so.2.1.0
7fb4864af000-7fb4866ae000 ---p 0017d000 08:03 4461678 /usr/lib64/libunistring.so.2.1.0
7fb4866ae000-7fb4866b2000 r--p 0017c000 08:03 4461678 /usr/lib64/libunistring.so.2.1.0
7fb4866b2000-7fb4866b3000 rw-p 00180000 08:03 4461678 /usr/lib64/libunistring.so.2.1.0
7fb4866b3000-7fb4866be000 r-xp 00000000 08:03 4462451 /usr/lib64/libbrotlidec.so.1.0.6
7fb4866be000-7fb4868be000 ---p 0000b000 08:03 4462451 /usr/lib64/libbrotlidec.so.1.0.6
7fb4868be000-7fb4868bf000 r--p 0000b000 08:03 4462451 /usr/lib64/libbrotlidec.so.1.0.6
7fb4868bf000-7fb4868c0000 rw-p 00000000 00:00 0
7fb4868c0000-7fb4868ce000 r-xp 00000000 08:03 4462895 /usr/lib64/liblber-2.4.so.2.10.9
7fb4868ce000-7fb486ace000 ---p 0000e000 08:03 4462895 /usr/lib64/liblber-2.4.so.2.10.9
7fb486ace000-7fb486acf000 r--p 0000e000 08:03 4462895 /usr/lib64/liblber-2.4.so.2.10.9
7fb486acf000-7fb486ad0000 rw-p 0000f000 08:03 4462895 /usr/lib64/liblber-2.4.so.2.10.9
7fb486ad0000-7fb486b1d000 r-xp 00000000 08:03 4462897 /usr/lib64/libldap-2.4.so.2.10.9
7fb486b1d000-7fb486d1c000 ---p 0004d000 08:03 4462897 /usr/lib64/libldap-2.4.so.2.10.9
7fb486d1c000-7fb486d1e000 r--p 0004c000 08:03 4462897 /usr/lib64/libldap-2.4.so.2.10.9
7fb486d1e000-7fb486d1f000 rw-p 0004e000 08:03 4462897 /usr/lib64/libldap-2.4.so.2.10.9
7fb486d1f000-7fb486d22000 r-xp 00000000 08:03 4461543 /usr/lib64/libcom_err.so.2.1
7fb486d22000-7fb486f21000 ---p 00003000 08:03 4461543 /usr/lib64/libcom_err.so.2.1
7fb486f21000-7fb486f22000 r--p 00002000 08:03 4461543 /usr/lib64/libcom_err.so.2.1
7fb486f22000-7fb486f23000 rw-p 00003000 08:03 4461543 /usr/lib64/libcom_err.so.2.1
7fb486f23000-7fb486f38000 r-xp 00000000 08:03 4463043 /usr/lib64/libk5crypto.so.3.1
7fb486f38000-7fb487137000 ---p 00015000 08:03 4463043 /usr/lib64/libk5crypto.so.3.1
7fb487137000-7fb487139000 r--p 00014000 08:03 4463043 /usr/lib64/libk5crypto.so.3.1
7fb487139000-7fb48713a000 rw-p 00016000 08:03 4463043 /usr/lib64/libk5crypto.so.3.1
7fb48713a000-7fb487214000 r-xp 00000000 08:03 4463049 /usr/lib64/libkrb5.so.3.3
7fb487214000-7fb487414000 ---p 000da000 08:03 4463049 /usr/lib64/libkrb5.so.3.3
7fb487414000-7fb487423000 r--p 000da000 08:03 4463049 /usr/lib64/libkrb5.so.3.3
7fb487423000-7fb487425000 rw-p 000e9000 08:03 4463049 /usr/lib64/libkrb5.so.3.3
7fb487425000-7fb487477000 r-xp 00000000 08:03 4463039 /usr/lib64/libgssapi_krb5.so.2.2
7fb487477000-7fb487677000 ---p 00052000 08:03 4463039 /usr/lib64/libgssapi_krb5.so.2.2
7fb487677000-7fb487679000 r--p 00052000 08:03 4463039 /usr/lib64/libgssapi_krb5.so.2.2
7fb487679000-7fb48767a000 rw-p 00054000 08:03 4463039 /usr/lib64/libgssapi_krb5.so.2.2
7fb48767a000-7fb48768a000 r-xp 00000000 08:03 4462047 /usr/lib64/libpsl.so.5.3.1
7fb48768a000-7fb487889000 ---p 00010000 08:03 4462047 /usr/lib64/libpsl.so.5.3.1
7fb487889000-7fb48788a000 r--p 0000f000 08:03 4462047 /usr/lib64/libpsl.so.5.3.1
7fb48788a000-7fb48788b000 rw-p 00000000 00:00 0
7fb48788b000-7fb4878f7000 r-xp 00000000 08:03 4462890 /usr/lib64/libssh.so.4.8.7
7fb4878f7000-7fb487af7000 ---p 0006c000 08:03 4462890 /usr/lib64/libssh.so.4.8.7
7fb487af7000-7fb487af9000 r--p 0006c000 08:03 4462890 /usr/lib64/libssh.so.4.8.7
7fb487af9000-7fb487afb000 rw-p 0006e000 08:03 4462890 /usr/lib64/libssh.so.4.8.7
7fb487afb000-7fb487b17000 r-xp 00000000 08:03 4461682 /usr/lib64/libidn2.so.0.3.6
7fb487b17000-7fb487d17000 ---p 0001c000 08:03 4461682 /usr/lib64/libidn2.so.0.3.6
7fb487d17000-7fb487d18000 r--p 0001c000 08:03 4461682 /usr/lib64/libidn2.so.0.3.6
7fb487d18000-7fb487d19000 rw-p 00000000 00:00 0
7fb487d19000-7fb487d3e000 r-xp 00000000 08:03 4462467 /usr/lib64/libnghttp2.so.14.17.0
7fb487d3e000-7fb487f3d000 ---p 00025000 08:03 4462467 /usr/lib64/libnghttp2.so.14.17.0
7fb487f3d000-7fb487f3e000 r--p 00024000 08:03 4462467 /usr/lib64/libnghttp2.so.14.17.0
7fb487f3e000-7fb487f40000 rw-p 00025000 08:03 4462467 /usr/lib64/libnghttp2.so.14.17.0
7fb487f40000-7fb487fcb000 r-xp 00000000 08:03 4462928 /usr/lib64/libcurl.so.4.5.0
7fb487fcb000-7fb4881cb000 ---p 0008b000 08:03 4462928 /usr/lib64/libcurl.so.4.5.0
7fb4881cb000-7fb4881ce000 r--p 0008b000 08:03 4462928 /usr/lib64/libcurl.so.4.5.0
7fb4881ce000-7fb4881cf000 rw-p 0008e000 08:03 4462928 /usr/lib64/libcurl.so.4.5.0
7fb4881cf000-7fb4881e9000 r-xp 00000000 08:03 1581805 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/curl.so
7fb4881e9000-7fb4883e8000 ---p 0001a000 08:03 1581805 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/curl.so
7fb4883e8000-7fb4883ea000 r--p 00019000 08:03 1581805 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/curl.so
7fb4883ea000-7fb4883eb000 rw-p 0001b000 08:03 1581805 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/curl.so
7fb4883eb000-7fb4883ee000 r-xp 00000000 08:03 1573307 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/ctype.so
7fb4883ee000-7fb4885ed000 ---p 00003000 08:03 1573307 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/ctype.so
7fb4885ed000-7fb4885ee000 r--p 00002000 08:03 1573307 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/ctype.so
7fb4885ee000-7fb4885ef000 rw-p 00003000 08:03 1573307 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/ctype.so
7fb4885ef000-7fb4885f6000 r-xp 00000000 08:03 1574930 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/calendar.so
7fb4885f6000-7fb4887f5000 ---p 00007000 08:03 1574930 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/calendar.so
7fb4887f5000-7fb4887f6000 r--p 00006000 08:03 1574930 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/calendar.so
7fb4887f6000-7fb4887f7000 rw-p 00007000 08:03 1574930 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/calendar.so
7fb4887f7000-7fb4887ff000 r-xp 00000000 08:03 1574924 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/bcmath.so
7fb4887ff000-7fb4889fe000 ---p 00008000 08:03 1574924 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/bcmath.so
7fb4889fe000-7fb4889ff000 r--p 00007000 08:03 1574924 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/bcmath.so
7fb4889ff000-7fb488a00000 rw-p 00008000 08:03 1574924 /opt/cpanel/ea-php81/root/usr/lib64/php/modules/bcmath.so
7fb488a00000-7fb488c00000 rw-p 00000000 00:00 0
7fb488c06000-7fb488c56000 rwxp 00000000 00:00 0
7fb488c97000-7fb488d1a000 r-xp 00000000 08:03 4461351 /usr/lib64/libpcre2-8.so.0.7.1
7fb488d1a000-7fb488f19000 ---p 00083000 08:03 4461351 /usr/lib64/libpcre2-8.so.0.7.1
7fb488f19000-7fb488f1a000 r--p 00082000 08:03 4461351 /usr/lib64/libpcre2-8.so.0.7.1
7fb488f1a000-7fb488f1b000 rw-p 00083000 08:03 4461351 /usr/lib64/libpcre2-8.so.0.7.1
7fb488f1b000-7fb488f3a000 r-xp 00000000 08:03 4461592 /usr/lib64/libgpg-error.so.0.24.2
7fb488f3a000-7fb48913a000 ---p 0001f000 08:03 4461592 /usr/lib64/libgpg-error.so.0.24.2
7fb48913a000-7fb48913b000 r--p 0001f000 08:03 4461592 /usr/lib64/libgpg-error.so.0.24.2
7fb48913b000-7fb48913c000 rw-p 00020000 08:03 4461592 /usr/lib64/libgpg-error.so.0.24.2
7fb48913c000-7fb489163000 r-xp 00000000 08:03 4461361 /usr/lib64/libselinux.so.1
7fb489163000-7fb489363000 ---p 00027000 08:03 4461361 /usr/lib64/libselinux.so.1
7fb489363000-7fb489364000 r--p 00027000 08:03 4461361 /usr/lib64/libselinux.so.1
7fb489364000-7fb489365000 rw-p 00028000 08:03 4461361 /usr/lib64/libselinux.so.1
7fb489365000-7fb489367000 rw-p 00000000 00:00 0
7fb489367000-7fb48936e000 r-xp 00000000 08:03 4461619 /usr/lib64/libuuid.so.1.3.0
7fb48936e000-7fb48956d000 ---p 00007000 08:03 4461619 /usr/lib64/libuuid.so.1.3.0
7fb48956d000-7fb48956e000 r--p 00006000 08:03 4461619 /usr/lib64/libuuid.so.1.3.0
7fb48956e000-7fb48956f000 rw-p 00000000 00:00 0
7fb48956f000-7fb4895bc000 r-xp 00000000 08:03 4463308 /usr/lib64/libblkid.so.1.1.0
7fb4895bc000-7fb4897bb000 ---p 0004d000 08:03 4463308 /usr/lib64/libblkid.so.1.1.0
7fb4897bb000-7fb4897c0000 r--p 0004c000 08:03 4463308 /usr/lib64/libblkid.so.1.1.0
7fb4897c0000-7fb4897c1000 rw-p 00051000 08:03 4463308 /usr/lib64/libblkid.so.1.1.0
7fb4897c1000-7fb4897c2000 rw-p 00000000 00:00 0
7fb4897c2000-7fb4897d9000 r-xp 00000000 08:03 4461471 /usr/lib64/libgcc_s-8-20210514.so.1
7fb4897d9000-7fb4899d8000 ---p 00017000 08:03 4461471 /usr/lib64/libgcc_s-8-20210514.so.1
7fb4899d8000-7fb4899d9000 r--p 00016000 08:03 4461471 /usr/lib64/libgcc_s-8-20210514.so.1
7fb4899d9000-7fb4899da000 rw-p 00017000 08:03 4461471 /usr/lib64/libgcc_s-8-20210514.so.1
7fb4899da000-7fb489af2000 r-xp 00000000 08:03 4461762 /usr/lib64/libgcrypt.so.20.2.5
7fb489af2000-7fb489cf1000 ---p 00118000 08:03 4461762 /usr/lib64/libgcrypt.so.20.2.5
7fb489cf1000-7fb489cf3000 r--p 00117000 08:03 4461762 /usr/lib64/libgcrypt.so.20.2.5
7fb489cf3000-7fb489cf8000 rw-p 00119000 08:03 4461762 /usr/lib64/libgcrypt.so.20.2.5
7fb489cf8000-7fb489d4e000 r-xp 00000000 08:03 4463124 /usr/lib64/libmount.so.1.1.0
7fb489d4e000-7fb489f4d000 ---p 00056000 08:03 4463124 /usr/lib64/libmount.so.1.1.0
7fb489f4d000-7fb489f50000 r--p 00055000 08:03 4463124 /usr/lib64/libmount.so.1.1.0
7fb489f50000-7fb489f51000 rw-p 00058000 08:03 4463124 /usr/lib64/libmount.so.1.1.0
7fb489f51000-7fb489f52000 rw-p 00000000 00:00 0
7fb489f52000-7fb489f59000 r-xp 00000000 08:03 4461547 /usr/lib64/libcap.so.2.48
7fb489f59000-7fb48a158000 ---p 00007000 08:03 4461547 /usr/lib64/libcap.so.2.48
7fb48a158000-7fb48a159000 r--p 00006000 08:03 4461547 /usr/lib64/libcap.so.2.48
7fb48a159000-7fb48a15a000 rw-p 00007000 08:03 4461547 /usr/lib64/libcap.so.2.48
7fb48a15a000-7fb48a176000 r-xp 00000000 08:03 4461900 /usr/lib64/liblz4.so.1.8.3
7fb48a176000-7fb48a375000 ---p 0001c000 08:03 4461900 /usr/lib64/liblz4.so.1.8.3
7fb48a375000-7fb48a376000 r--p 0001b000 08:03 4461900 /usr/lib64/liblz4.so.1.8.3
7fb48a376000-7fb48a377000 rw-p 00000000 00:00 0
7fb48a377000-7fb48a39c000 r-xp 00000000 08:03 4461541 /usr/lib64/liblzma.so.5.2.4
7fb48a39c000-7fb48a59c000 ---p 00025000 08:03 4461541 /usr/lib64/liblzma.so.5.2.4
7fb48a59c000-7fb48a59d000 r--p 00025000 08:03 4461541 /usr/lib64/liblzma.so.5.2.4
7fb48a59d000-7fb48a59e000 rw-p 00000000 00:00 0
7fb48a59e000-7fb48a5b9000 r-xp 00000000 08:03 4461449 /usr/lib64/libpthread-2.28.so
7fb48a5b9000-7fb48a7b8000 ---p 0001b000 08:03 4461449 /usr/lib64/libpthread-2.28.so
7fb48a7b8000-7fb48a7b9000 r--p 0001a000 08:03 4461449 /usr/lib64/libpthread-2.28.so
7fb48a7b9000-7fb48a7ba000 rw-p 0001b000 08:03 4461449 /usr/lib64/libpthread-2.28.so
7fb48a7ba000-7fb48a7be000 rw-p 00000000 00:00 0
7fb48a7be000-7fb48a97a000 r-xp 00000000 08:03 4461435 /usr/lib64/libc-2.28.so
7fb48a97a000-7fb48ab79000 ---p 001bc000 08:03 4461435 /usr/lib64/libc-2.28.so
7fb48ab79000-7fb48ab7d000 r--p 001bb000 08:03 4461435 /usr/lib64/libc-2.28.so
7fb48ab7d000-7fb48ab7f000 rw-p 001bf000 08:03 4461435 /usr/lib64/libc-2.28.so
7fb48ab7f000-7fb48ab83000 rw-p 00000000 00:00 0
7fb48ab83000-7fb48ab99000 r-xp 00000000 08:03 4461532 /usr/lib64/libz.so.1.2.11
7fb48ab99000-7fb48ad99000 ---p 00016000 08:03 4461532 /usr/lib64/libz.so.1.2.11
7fb48ad99000-7fb48ad9a000 r--p 00016000 08:03 4461532 /usr/lib64/libz.so.1.2.11
7fb48ad9a000-7fb48ad9b000 rw-p 00000000 00:00 0
7fb48ad9b000-7fb48b051000 r-xp 00000000 08:03 4463322 /usr/lib64/libcrypto.so.1.1.1k
7fb48b051000-7fb48b250000 ---p 002b6000 08:03 4463322 /usr/lib64/libcrypto.so.1.1.1k
7fb48b250000-7fb48b27c000 r--p 002b5000 08:03 4463322 /usr/lib64/libcrypto.so.1.1.1k
7fb48b27c000-7fb48b280000 rw-p 002e1000 08:03 4463322 /usr/lib64/libcrypto.so.1.1.1k
7fb48b280000-7fb48b285000 rw-p 00000000 00:00 0
7fb48b285000-7fb48b30c000 r-xp 00000000 08:03 4463324 /usr/lib64/libssl.so.1.1.1k
7fb48b30c000-7fb48b50b000 ---p 00087000 08:03 4463324 /usr/lib64/libssl.so.1.1.1k
7fb48b50b000-7fb48b514000 r--p 00086000 08:03 4463324 /usr/lib64/libssl.so.1.1.1k
7fb48b514000-7fb48b518000 rw-p 0008f000 08:03 4463324 /usr/lib64/libssl.so.1.1.1k
7fb48b518000-7fb48b519000 rw-p 00000000 00:00 0
7fb48b519000-7fb48b676000 r-xp 00000000 08:03 4461631 /usr/lib64/libxml2.so.2.9.7
7fb48b676000-7fb48b875000 ---p 0015d000 08:03 4461631 /usr/lib64/libxml2.so.2.9.7
7fb48b875000-7fb48b87e000 r--p 0015c000 08:03 4461631 /usr/lib64/libxml2.so.2.9.7
7fb48b87e000-7fb48b87f000 rw-p 00165000 08:03 4461631 /usr/lib64/libxml2.so.2.9.7
7fb48b87f000-7fb48b881000 rw-p 00000000 00:00 0
7fb48b881000-7fb48b9c4000 r-xp 00000000 08:03 4463247 /usr/lib64/libsystemd.so.0.23.0
7fb48b9c4000-7fb48bbc3000 ---p 00143000 08:03 4463247 /usr/lib64/libsystemd.so.0.23.0
7fb48bbc3000-7fb48bbcb000 r--p 00142000 08:03 4463247 /usr/lib64/libsystemd.so.0.23.0
7fb48bbcb000-7fb48bbcc000 rw-p 0014a000 08:03 4463247 /usr/lib64/libsystemd.so.0.23.0
7fb48bbcc000-7fb48bbcd000 rw-p 00000000 00:00 0
7fb48bbcd000-7fb48bbd0000 r-xp 00000000 08:03 4461437 /usr/lib64/libdl-2.28.so
7fb48bbd0000-7fb48bdcf000 ---p 00003000 08:03 4461437 /usr/lib64/libdl-2.28.so
7fb48bdcf000-7fb48bdd0000 r--p 00002000 08:03 4461437 /usr/lib64/libdl-2.28.so
7fb48bdd0000-7fb48bdd1000 rw-p 00003000 08:03 4461437 /usr/lib64/libdl-2.28.so
7fb48bdd1000-7fb48bf51000 r-xp 00000000 08:03 4461439 /usr/lib64/libm-2.28.so
7fb48bf51000-7fb48c151000 ---p 00180000 08:03 4461439 /usr/lib64/libm-2.28.so
7fb48c151000-7fb48c152000 r--p 00180000 08:03 4461439 /usr/lib64/libm-2.28.so
7fb48c152000-7fb48c153000 rw-p 00181000 08:03 4461439 /usr/lib64/libm-2.28.so
7fb48c153000-7fb48c15a000 r-xp 00000000 08:03 4461453 /usr/lib64/librt-2.28.so
7fb48c15a000-7fb48c359000 ---p 00007000 08:03 4461453 /usr/lib64/librt-2.28.so
7fb48c359000-7fb48c35a000 r--p 00006000 08:03 4461453 /usr/lib64/librt-2.28.so
7fb48c35a000-7fb48c35b000 rw-p 00007000 08:03 4461453 /usr/lib64/librt-2.28.so
7fb48c35b000-7fb48c35d000 r-xp 00000000 08:03 4461457 /usr/lib64/libutil-2.28.so
7fb48c35d000-7fb48c55d000 ---p 00002000 08:03 4461457 /usr/lib64/libutil-2.28.so
7fb48c55d000-7fb48c55e000 r--p 00002000 08:03 4461457 /usr/lib64/libutil-2.28.so
7fb48c55e000-7fb48c55f000 rw-p 00003000 08:03 4461457 /usr/lib64/libutil-2.28.so
7fb48c55f000-7fb48c573000 r-xp 00000000 08:03 4461451 /usr/lib64/libresolv-2.28.so
7fb48c573000-7fb48c773000 ---p 00014000 08:03 4461451 /usr/lib64/libresolv-2.28.so
7fb48c773000-7fb48c774000 r--p 00014000 08:03 4461451 /usr/lib64/libresolv-2.28.so
7fb48c774000-7fb48c775000 rw-p 00015000 08:03 4461451 /usr/lib64/libresolv-2.28.so
7fb48c775000-7fb48c777000 rw-p 00000000 00:00 0
7fb48c777000-7fb48c797000 r-xp 00000000 08:03 4461616 /usr/lib64/libcrypt.so.1.1.0
7fb48c797000-7fb48c996000 ---p 00020000 08:03 4461616 /usr/lib64/libcrypt.so.1.1.0
7fb48c996000-7fb48c997000 r--p 0001f000 08:03 4461616 /usr/lib64/libcrypt.so.1.1.0
7fb48c997000-7fb48c9a0000 rw-p 00000000 00:00 0
7fb48c9a0000-7fb48c9a7000 r-xp 00000000 08:03 1581775 /opt/cpanel/libargon2/lib64/libargon2.so.0
7fb48c9a7000-7fb48cba6000 ---p 00007000 08:03 1581775 /opt/cpanel/libargon2/lib64/libargon2.so.0
7fb48cba6000-7fb48cba7000 r--p 00006000 08:03 1581775 /opt/cpanel/libargon2/lib64/libargon2.so.0
7fb48cba7000-7fb48cba8000 rw-p 00007000 08:03 1581775 /opt/cpanel/libargon2/lib64/libargon2.so.0
7fb48cba8000-7fb48cbd6000 r-xp 00000000 08:03 4461408 /usr/lib64/ld-2.28.so
7fb48cbda000-7fb48cbfa000 rwxp 00000000 00:00 0
7fb48cbfa000-7fb48cc2f000 r--s 00000000 08:03 917554 /var/db/nscd/group
7fb48cc2f000-7fb48cc64000 r--s 00000000 08:03 917553 /var/db/nscd/passwd
7fb48cc64000-7fb48ccc4000 r--s 00000000 08:03 917555 /var/db/nscd/hosts
7fb48ccc4000-7fb48cd45000 rw-p 00000000 00:00 0
7fb48cd50000-7fb48cd68000 r--p 00000000 08:03 5117406 /usr/share/i360-php-opts/pd_v1.hdb
7fb48cd68000-7fb48cd6a000 rw-s 00000000 00:01 33770686 /dev/zero (deleted)
7fb48cd6e000-7fb48cd75000 r--s 00000000 08:03 4850107 /usr/lib64/gconv/gconv-modules.cache
7fb48cd75000-7fb48cdc8000 r--p 00000000 08:03 4981128 /usr/lib/locale/C.utf8/LC_CTYPE
7fb48cdc8000-7fb48cdd6000 rw-p 00000000 00:00 0
7fb48cdd6000-7fb48cdd7000 r--p 0002e000 08:03 4461408 /usr/lib64/ld-2.28.so
7fb48cdd7000-7fb48cdd9000 rw-p 0002f000 08:03 4461408 /usr/lib64/ld-2.28.so
7ffc339dc000-7ffc339fd000 rw-p 00000000 00:00 0 [stack]
7ffc33abf000-7ffc33ac3000 r--p 00000000 00:00 0 [vvar]
7ffc33ac3000-7ffc33ac5000 r-xp 00000000 00:00 0 [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]
Sergio
Junior Member
Posts: 1712
Joined: 12 Dec 2006, 14:56

Re: Suspicious process running

Post by Sergio »

First of all, you don't need to copy all the log lines, just a few ones are needed.

I recommend you to add one of the following lines in csf.pignore:

REGEX for any version of ea-php:

Code: Select all

 pexe:/opt/cpanel/ea\-php\d+/root/usr/sbin/php\-fpm
Rule just for ea-php81:

Code: Select all

 exe:/opt/cpanel/ea-php81/root/usr/sbin/php-fpm
Sergio
Post Reply