Page 1 of 1

Suspicious process running under user itrservices

Posted: 13 Feb 2022, 15:51
by lbnkrustev
Hello, I receive a lot of email alarm that looks like this:



Time: Sat Feb 12 20:13:41 2022 +0200
PID: 1934 (Parent PID:4804)
Account: cpanel
Uptime: 98 seconds


Executable:

/opt/cpanel/ea-php80/root/usr/sbin/php-fpm


Command Line (often faked in exploits):

php-fpm: pool cpanel_pool


Network connections by the process (if any):

tcp: CPANEL PUBLIC IP:47104 -> CPANEL PUBLIC IP:443


Files open by the process (if any):

/dev/null


Memory maps by the process (if any):

00400000-007dc000 r-xp 00000000 fd:00 73582290 /opt/cpanel/ea-php80/root/usr/sbin/php-fpm
00b7c000-00c00000 r--p 0057c000 fd:00 73582290 /opt/cpanel/ea-php80/root/usr/sbin/php-fpm
00c00000-00c04000 rw-p 00600000 fd:00 73582290 /opt/cpanel/ea-php80/root/usr/sbin/php-fpm
00c04000-00c22000 rw-p 00000000 00:00 0
02a16000-02c90000 rw-p 00000000 00:00 0 [heap]
02c90000-02d9b000 rw-p 00000000 00:00 0 [heap]
7f10d3400000-7f10d3c00000 rw-p 00000000 00:00 0
7f10d3e00000-7f10d4200000 rw-p 00000000 00:00 0
7f10d4200000-7f10d4400000 rw-p 00000000 00:00 0
7f10d45a9000-7f10d45b0000 r-xp 00000000 fd:00 136106641 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/xmlreader.so
7f10d45b0000-7f10d47af000 ---p 00007000 fd:00 136106641 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/xmlreader.so
7f10d47af000-7f10d47b0000 r--p 00006000 fd:00 136106641 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/xmlreader.so
7f10d47b0000-7f10d47b1000 rw-p 00007000 fd:00 136106641 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/xmlreader.so
7f10d47b1000-7f10d47b7000 r-xp 00000000 fd:00 136046297 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/pdo_sqlite.so
7f10d47b7000-7f10d49b7000 ---p 00006000 fd:00 136046297 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/pdo_sqlite.so
7f10d49b7000-7f10d49b8000 r--p 00006000 fd:00 136046297 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/pdo_sqlite.so
7f10d49b8000-7f10d49b9000 rw-p 00007000 fd:00 136046297 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/pdo_sqlite.so
7f10d49b9000-7f10d49bf000 r-xp 00000000 fd:00 134632405 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/pdo_mysql.so
7f10d49bf000-7f10d4bbf000 ---p 00006000 fd:00 134632405 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/pdo_mysql.so
7f10d4bbf000-7f10d4bc0000 r--p 00006000 fd:00 134632405 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/pdo_mysql.so
7f10d4bc0000-7f10d4bc1000 rw-p 00007000 fd:00 134632405 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/pdo_mysql.so
7f10d4bc1000-7f10d4bde000 r-xp 00000000 fd:00 134632403 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/mysqli.so
7f10d4bde000-7f10d4ddd000 ---p 0001d000 fd:00 134632403 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/mysqli.so
7f10d4ddd000-7f10d4de2000 r--p 0001c000 fd:00 134632403 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/mysqli.so
7f10d4de2000-7f10d4de3000 rw-p 00021000 fd:00 134632403 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/mysqli.so
7f10d4de3000-7f10d4e1f000 r-xp 00000000 fd:00 16761 /usr/lib64/libxslt.so.1.1.28
7f10d4e1f000-7f10d501f000 ---p 0003c000 fd:00 16761 /usr/lib64/libxslt.so.1.1.28
7f10d501f000-7f10d5020000 r--p 0003c000 fd:00 16761 /usr/lib64/libxslt.so.1.1.28
7f10d5020000-7f10d5021000 rw-p 0003d000 fd:00 16761 /usr/lib64/libxslt.so.1.1.28
7f10d5021000-7f10d5022000 rw-p 00000000 00:00 0
7f10d5022000-7f10d5036000 r-xp 00000000 fd:00 16759 /usr/lib64/libexslt.so.0.8.17
7f10d5036000-7f10d5235000 ---p 00014000 fd:00 16759 /usr/lib64/libexslt.so.0.8.17
7f10d5235000-7f10d5236000 r--p 00013000 fd:00 16759 /usr/lib64/libexslt.so.0.8.17
7f10d5236000-7f10d5237000 rw-p 00014000 fd:00 16759 /usr/lib64/libexslt.so.0.8.17
7f10d5237000-7f10d523e000 r-xp 00000000 fd:00 136106643 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/xsl.so
7f10d523e000-7f10d543d000 ---p 00007000 fd:00 136106643 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/xsl.so
7f10d543d000-7f10d543e000 r--p 00006000 fd:00 136106643 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/xsl.so
7f10d543e000-7f10d543f000 rw-p 00007000 fd:00 136106643 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/xsl.so
7f10d543f000-7f10d5447000 r-xp 00000000 fd:00 136106642 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/xmlwriter.so
7f10d5447000-7f10d5646000 ---p 00008000 fd:00 136106642 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/xmlwriter.so
7f10d5646000-7f10d5649000 r--p 00007000 fd:00 136106642 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/xmlwriter.so
7f10d5649000-7f10d564a000 rw-p 0000a000 fd:00 136106642 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/xmlwriter.so
7f10d564a000-7f10d5655000 r-xp 00000000 fd:00 136106640 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/xml.so
7f10d5655000-7f10d5855000 ---p 0000b000 fd:00 136106640 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/xml.so
7f10d5855000-7f10d5856000 r--p 0000b000 fd:00 136106640 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/xml.so
7f10d5856000-7f10d5857000 rw-p 0000c000 fd:00 136106640 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/xml.so
7f10d5857000-7f10d585d000 r-xp 00000000 fd:00 136046275 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/tokenizer.so
7f10d585d000-7f10d5a5c000 ---p 00006000 fd:00 136046275 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/tokenizer.so
7f10d5a5c000-7f10d5a5d000 r--p 00005000 fd:00 136046275 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/tokenizer.so
7f10d5a5d000-7f10d5a5e000 rw-p 00006000 fd:00 136046275 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/tokenizer.so
7f10d5a5e000-7f10d5b0f000 r-xp 00000000 fd:00 8995 /usr/lib64/libsqlite3.so.0.8.6
7f10d5b0f000-7f10d5d0e000 ---p 000b1000 fd:00 8995 /usr/lib64/libsqlite3.so.0.8.6
7f10d5d0e000-7f10d5d10000 r--p 000b0000 fd:00 8995 /usr/lib64/libsqlite3.so.0.8.6
7f10d5d10000-7f10d5d13000 rw-p 000b2000 fd:00 8995 /usr/lib64/libsqlite3.so.0.8.6
7f10d5d13000-7f10d5d1f000 r-xp 00000000 fd:00 136046298 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/sqlite3.so
7f10d5d1f000-7f10d5f1e000 ---p 0000c000 fd:00 136046298 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/sqlite3.so
7f10d5f1e000-7f10d5f20000 r--p 0000b000 fd:00 136046298 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/sqlite3.so
7f10d5f20000-7f10d5f21000 rw-p 0000d000 fd:00 136046298 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/sqlite3.so
7f10d5f21000-7f10d5f36000 r-xp 00000000 fd:00 134632409 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/sockets.so
7f10d5f36000-7f10d6135000 ---p 00015000 fd:00 134632409 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/sockets.so
7f10d6135000-7f10d6137000 r--p 00014000 fd:00 134632409 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/sockets.so
7f10d6137000-7f10d6138000 rw-p 00016000 fd:00 134632409 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/sockets.so
7f10d6138000-7f10d6144000 r-xp 00000000 fd:00 136106639 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/simplexml.so
7f10d6144000-7f10d6343000 ---p 0000c000 fd:00 136106639 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/simplexml.so
7f10d6343000-7f10d6344000 r--p 0000b000 fd:00 136106639 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/simplexml.so
7f10d6344000-7f10d6345000 rw-p 0000c000 fd:00 136106639 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/simplexml.so
7f10d6345000-7f10d634c000 r-xp 00000000 fd:00 136106645 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/posix.so
7f10d634c000-7f10d654c000 ---p 00007000 fd:00 136106645 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/posix.so
7f10d654c000-7f10d654d000 r--p 00007000 fd:00 136106645 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/posix.so
7f10d654d000-7f10d654e000 rw-p 00008000 fd:00 136106645 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/posix.so
7f10d654e000-7f10d658d000 r-xp 00000000 fd:00 136046274 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/phar.so
7f10d658d000-7f10d678c000 ---p 0003f000 fd:00 136046274 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/phar.so
7f10d678c000-7f10d678f000 r--p 0003e000 fd:00 136046274 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/phar.so
7f10d678f000-7f10d6790000 rw-p 00041000 fd:00 136046274 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/phar.so
7f10d6790000-7f10d67a9000 r-xp 00000000 fd:00 136046296 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/pdo.so
7f10d67a9000-7f10d69a8000 ---p 00019000 fd:00 136046296 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/pdo.so
7f10d69a8000-7f10d69ab000 r--p 00018000 fd:00 136046296 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/pdo.so
7f10d69ab000-7f10d69ac000 rw-p 0001b000 fd:00 136046296 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/pdo.so
7f10d69ac000-7f10d69e5000 r-xp 00000000 fd:00 134632404 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/mysqlnd.so
7f10d69e5000-7f10d6be4000 ---p 00039000 fd:00 134632404 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/mysqlnd.so
7f10d6be4000-7f10d6be9000 r--p 00038000 fd:00 134632404 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/mysqlnd.so
7f10d6be9000-7f10d6beb000 rw-p 0003d000 fd:00 134632404 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/mysqlnd.so
7f10d6beb000-7f10d6bec000 rw-p 00000000 00:00 0
7f10d6bec000-7f10d6c74000 r-xp 00000000 fd:00 134632399 /opt/cpanel/ea-oniguruma/lib64/libonig.so.5.2.0
7f10d6c74000-7f10d6e74000 ---p 00088000 fd:00 134632399 /opt/cpanel/ea-oniguruma/lib64/libonig.so.5.2.0
7f10d6e74000-7f10d6e76000 r--p 00088000 fd:00 134632399 /opt/cpanel/ea-oniguruma/lib64/libonig.so.5.2.0
7f10d6e76000-7f10d6e7d000 rw-p 0008a000 fd:00 134632399 /opt/cpanel/ea-oniguruma/lib64/libonig.so.5.2.0
7f10d6e7d000-7f10d6f6f000 r-xp 00000000 fd:00 134632402 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/mbstring.so
7f10d6f6f000-7f10d716e000 ---p 000f2000 fd:00 134632402 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/mbstring.so
7f10d716e000-7f10d7177000 r--p 000f1000 fd:00 134632402 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/mbstring.so
7f10d7177000-7f10d7179000 rw-p 000fa000 fd:00 134632402 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/mbstring.so
7f10d7179000-7f10d7262000 r-xp 00000000 fd:00 8810 /usr/lib64/libstdc++.so.6.0.19
7f10d7262000-7f10d7462000 ---p 000e9000 fd:00 8810 /usr/lib64/libstdc++.so.6.0.19
7f10d7462000-7f10d746a000 r--p 000e9000 fd:00 8810 /usr/lib64/libstdc++.so.6.0.19
7f10d746a000-7f10d746c000 rw-p 000f1000 fd:00 8810 /usr/lib64/libstdc++.so.6.0.19
7f10d746c000-7f10d7481000 rw-p 00000000 00:00 0
7f10d7481000-7f10d8fd8000 r--p 00000000 fd:00 134707058 /opt/cpanel/ea-libicu/lib/libicudata.so.69.1
7f10d8fd8000-7f10d91d7000 ---p 01b57000 fd:00 134707058 /opt/cpanel/ea-libicu/lib/libicudata.so.69.1
7f10d91d7000-7f10d91d8000 r--p 01b56000 fd:00 134707058 /opt/cpanel/ea-libicu/lib/libicudata.so.69.1
7f10d91d8000-7f10d93a1000 r-xp 00000000 fd:00 134810529 /opt/cpanel/ea-libicu/lib/libicuuc.so.69.1
7f10d93a1000-7f10d95a0000 ---p 001c9000 fd:00 134810529 /opt/cpanel/ea-libicu/lib/libicuuc.so.69.1
7f10d95a0000-7f10d95b3000 r--p 001c8000 fd:00 134810529 /opt/cpanel/ea-libicu/lib/libicuuc.so.69.1
7f10d95b3000-7f10d95b4000 rw-p 001db000 fd:00 134810529 /opt/cpanel/ea-libicu/lib/libicuuc.so.69.1
7f10d95b4000-7f10d95b6000 rw-p 00000000 00:00 0
7f10d95b6000-7f10d98a3000 r-xp 00000000 fd:00 134718271 /opt/cpanel/ea-libicu/lib/libicui18n.so.69.1
7f10d98a3000-7f10d9aa3000 ---p 002ed000 fd:00 134718271 /opt/cpanel/ea-libicu/lib/libicui18n.so.69.1
7f10d9aa3000-7f10d9ab2000 r--p 002ed000 fd:00 134718271 /opt/cpanel/ea-libicu/lib/libicui18n.so.69.1
7f10d9ab2000-7f10d9ab4000 rw-p 002fc000 fd:00 134718271 /opt/cpanel/ea-libicu/lib/libicui18n.so.69.1
7f10d9ab4000-7f10d9ab5000 rw-p 00000000 00:00 0
7f10d9ab5000-7f10d9ac1000 r-xp 00000000 fd:00 134752231 /opt/cpanel/ea-libicu/lib/libicuio.so.69.1
7f10d9ac1000-7f10d9cc0000 ---p 0000c000 fd:00 134752231 /opt/cpanel/ea-libicu/lib/libicuio.so.69.1
7f10d9cc0000-7f10d9cc2000 r--p 0000b000 fd:00 134752231 /opt/cpanel/ea-libicu/lib/libicuio.so.69.1
7f10d9cc2000-7f10d9cc3000 rw-p 0000d000 fd:00 134752231 /opt/cpanel/ea-libicu/lib/libicuio.so.69.1
7f10d9cc3000-7f10d9d25000 r-xp 00000000 fd:00 134810536 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/intl.so
7f10d9d25000-7f10d9f25000 ---p 00062000 fd:00 134810536 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/intl.so
7f10d9f25000-7f10d9f30000 r--p 00062000 fd:00 134810536 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/intl.so
7f10d9f30000-7f10d9f32000 rw-p 0006d000 fd:00 134810536 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/intl.so
7f10d9f32000-7f10d9f36000 r-xp 00000000 fd:00 8955 /usr/lib64/libcap-ng.so.0.0.0
7f10d9f36000-7f10da136000 ---p 00004000 fd:00 8955 /usr/lib64/libcap-ng.so.0.0.0
7f10da136000-7f10da137000 r--p 00004000 fd:00 8955 /usr/lib64/libcap-ng.so.0.0.0
7f10da137000-7f10da138000 rw-p 00005000 fd:00 8955 /usr/lib64/libcap-ng.so.0.0.0
7f10da138000-7f10da156000 r-xp 00000000 fd:00 8957 /usr/lib64/libaudit.so.1.0.0
7f10da156000-7f10da355000 ---p 0001e000 fd:00 8957 /usr/lib64/libaudit.so.1.0.0
7f10da355000-7f10da356000 r--p 0001d000 fd:00 8957 /usr/lib64/libaudit.so.1.0.0
7f10da356000-7f10da357000 rw-p 0001e000 fd:00 8957 /usr/lib64/libaudit.so.1.0.0
7f10da357000-7f10da361000 rw-p 00000000 00:00 0
7f10da361000-7f10da36e000 r-xp 00000000 fd:00 10557 /usr/lib64/libpam.so.0.83.1
7f10da36e000-7f10da56e000 ---p 0000d000 fd:00 10557 /usr/lib64/libpam.so.0.83.1
7f10da56e000-7f10da56f000 r--p 0000d000 fd:00 10557 /usr/lib64/libpam.so.0.83.1
7f10da56f000-7f10da570000 rw-p 0000e000 fd:00 10557 /usr/lib64/libpam.so.0.83.1
7f10da570000-7f10da678000 r-xp 00000000 fd:00 136046276 /opt/cpanel/ea-php80/root/usr/lib64/libc-client.so.2007
7f10da678000-7f10da878000 ---p 00108000 fd:00 136046276 /opt/cpanel/ea-php80/root/usr/lib64/libc-client.so.2007
7f10da878000-7f10da87a000 r--p 00108000 fd:00 136046276 /opt/cpanel/ea-php80/root/usr/lib64/libc-client.so.2007
7f10da87a000-7f10da883000 rw-p 0010a000 fd:00 136046276 /opt/cpanel/ea-php80/root/usr/lib64/libc-client.so.2007
7f10da883000-7f10da884000 rw-p 00000000 00:00 0
7f10da884000-7f10da898000 r-xp 00000000 fd:00 134632406 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/imap.so
7f10da898000-7f10daa97000 ---p 00014000 fd:00 134632406 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/imap.so
7f10daa97000-7f10daa9a000 r--p 00013000 fd:00 134632406 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/imap.so
7f10daa9a000-7f10daa9b000 rw-p 00016000 fd:00 134632406 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/imap.so
7f10daa9b000-7f10daaa4000 r-xp 00000000 fd:00 134632290 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/iconv.so
7f10daaa4000-7f10daca4000 ---p 00009000 fd:00 134632290 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/iconv.so
7f10daca4000-7f10daca5000 r--p 00009000 fd:00 134632290 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/iconv.so
7f10daca5000-7f10daca6000 rw-p 0000a000 fd:00 134632290 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/iconv.so
7f10daca6000-7f10daca8000 r-xp 00000000 fd:00 562740 /usr/lib64/libXau.so.6.0.0
7f10daca8000-7f10daea8000 ---p 00002000 fd:00 562740 /usr/lib64/libXau.so.6.0.0
7f10daea8000-7f10daea9000 r--p 00002000 fd:00 562740 /usr/lib64/libXau.so.6.0.0
7f10daea9000-7f10daeaa000 rw-p 00003000 fd:00 562740 /usr/lib64/libXau.so.6.0.0
7f10daeaa000-7f10daed1000 r-xp 00000000 fd:00 562796 /usr/lib64/libxcb.so.1.1.0
7f10daed1000-7f10db0d0000 ---p 00027000 fd:00 562796 /usr/lib64/libxcb.so.1.1.0
7f10db0d0000-7f10db0d1000 r--p 00026000 fd:00 562796 /usr/lib64/libxcb.so.1.1.0
7f10db0d1000-7f10db0d2000 rw-p 00027000 fd:00 562796 /usr/lib64/libxcb.so.1.1.0
7f10db0d2000-7f10db189000 r-xp 00000000 fd:00 9284 /usr/lib64/libfreetype.so.6.14.0
7f10db189000-7f10db389000 ---p 000b7000 fd:00 9284 /usr/lib64/libfreetype.so.6.14.0
7f10db389000-7f10db390000 r--p 000b7000 fd:00 9284 /usr/lib64/libfreetype.so.6.14.0
7f10db390000-7f10db391000 rw-p 000be000 fd:00 9284 /usr/lib64/libfreetype.so.6.14.0
7f10db391000-7f10db4c9000 r-xp 00000000 fd:00 9961 /usr/lib64/libX11.so.6.3.0
7f10db4c9000-7f10db6c9000 ---p 00138000 fd:00 9961 /usr/lib64/libX11.so.6.3.0
7f10db6c9000-7f10db6ca000 r--p 00138000 fd:00 9961 /usr/lib64/libX11.so.6.3.0
7f10db6ca000-7f10db6cf000 rw-p 00139000 fd:00 9961 /usr/lib64/libX11.so.6.3.0
7f10db6cf000-7f10db6e0000 r-xp 00000000 fd:00 562980 /usr/lib64/libXpm.so.4.11.0
7f10db6e0000-7f10db8df000 ---p 00011000 fd:00 562980 /usr/lib64/libXpm.so.4.11.0
7f10db8df000-7f10db8e0000 r--p 00010000 fd:00 562980 /usr/lib64/libXpm.so.4.11.0
7f10db8e0000-7f10db8e1000 rw-p 00011000 fd:00 562980 /usr/lib64/libXpm.so.4.11.0
7f10db8e1000-7f10db924000 r-xp 00000000 fd:00 293411 /usr/lib64/libjpeg.so.62.1.0
7f10db924000-7f10dbb24000 ---p 00043000 fd:00 293411 /usr/lib64/libjpeg.so.62.1.0
7f10dbb24000-7f10dbb25000 r--p 00043000 fd:00 293411 /usr/lib64/libjpeg.so.62.1.0
7f10dbb25000-7f10dbb26000 rw-p 00044000 fd:00 293411 /usr/lib64/libjpeg.so.62.1.0
7f10dbb26000-7f10dbb36000 rw-p 00000000 00:00 0
7f10dbb36000-7f10dbb82000 r-xp 00000000 fd:00 1130914 /usr/lib64/libwebp.so.4.0.2
7f10dbb82000-7f10dbd81000 ---p 0004c000 fd:00 1130914 /usr/lib64/libwebp.so.4.0.2
7f10dbd81000-7f10dbd82000 r--p 0004b000 fd:00 1130914 /usr/lib64/libwebp.so.4.0.2
7f10dbd82000-7f10dbd83000 rw-p 0004c000 fd:00 1130914 /usr/lib64/libwebp.so.4.0.2
7f10dbd83000-7f10dbd86000 rw-p 00000000 00:00 0
7f10dbd86000-7f10dbdaf000 r-xp 00000000 fd:00 9271 /usr/lib64/libpng15.so.15.13.0
7f10dbdaf000-7f10dbfaf000 ---p 00029000 fd:00 9271 /usr/lib64/libpng15.so.15.13.0
7f10dbfaf000-7f10dbfb0000 r--p 00029000 fd:00 9271 /usr/lib64/libpng15.so.15.13.0
7f10dbfb0000-7f10dbfb1000 rw-p 0002a000 fd:00 9271 /usr/lib64/libpng15.so.15.13.0
7f10dbfb1000-7f10dc00a000 r-xp 00000000 fd:00 134632410 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/gd.so
7f10dc00a000-7f10dc20a000 ---p 00059000 fd:00 134632410 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/gd.so
7f10dc20a000-7f10dc20e000 r--p 00059000 fd:00 134632410 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/gd.so
7f10dc20e000-7f10dc20f000 rw-p 0005d000 fd:00 134632410 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/gd.so
7f10dc20f000-7f10dc213000 rw-p 00000000 00:00 0
7f10dc213000-7f10dc220000 r-xp 00000000 fd:00 136106644 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/ftp.so
7f10dc220000-7f10dc41f000 ---p 0000d000 fd:00 136106644 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/ftp.so
7f10dc41f000-7f10dc421000 r--p 0000c000 fd:00 136106644 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/ftp.so
7f10dc421000-7f10dc422000 rw-p 0000e000 fd:00 136106644 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/ftp.so
7f10dc422000-7f10dc444000 r-xp 00000000 fd:00 136106638 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/dom.so
7f10dc444000-7f10dc643000 ---p 00022000 fd:00 136106638 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/dom.so
7f10dc643000-7f10dc646000 r--p 00021000 fd:00 136106638 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/dom.so
7f10dc646000-7f10dc647000 rw-p 00024000 fd:00 136106638 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/dom.so
7f10dc647000-7f10dc648000 rw-p 00000000 00:00 0
7f10dc648000-7f10dc668000 r-xp 00000000 fd:00 203763276 /opt/cpanel/ea-brotli/lib/libbrotlicommon.so.1.0.9
7f10dc668000-7f10dc867000 ---p 00020000 fd:00 203763276 /opt/cpanel/ea-brotli/lib/libbrotlicommon.so.1.0.9
7f10dc867000-7f10dc868000 r--p 0001f000 fd:00 203763276 /opt/cpanel/ea-brotli/lib/libbrotlicommon.so.1.0.9
7f10dc868000-7f10dc869000 rw-p 00020000 fd:00 203763276 /opt/cpanel/ea-brotli/lib/libbrotlicommon.so.1.0.9
7f10dc869000-7f10dc86c000 r-xp 00000000 fd:00 9179 /usr/lib64/libkeyutils.so.1.5
7f10dc86c000-7f10dca6b000 ---p 00003000 fd:00 9179 /usr/lib64/libkeyutils.so.1.5
7f10dca6b000-7f10dca6c000 r--p 00002000 fd:00 9179 /usr/lib64/libkeyutils.so.1.5
7f10dca6c000-7f10dca6d000 rw-p 00003000 fd:00 9179 /usr/lib64/libkeyutils.so.1.5
7f10dca6d000-7f10dca7b000 r-xp 00000000 fd:00 8796 /usr/lib64/libkrb5support.so.0.1
7f10dca7b000-7f10dcc7b000 ---p 0000e000 fd:00 8796 /usr/lib64/libkrb5support.so.0.1
7f10dcc7b000-7f10dcc7c000 r--p 0000e000 fd:00 8796 /usr/lib64/libkrb5support.so.0.1
7f10dcc7c000-7f10dcc7d000 rw-p 0000f000 fd:00 8796 /usr/lib64/libkrb5support.so.0.1
7f10dcc7d000-7f10dceb4000 r-xp 00000000 fd:00 9917 /usr/lib64/libcrypto.so.1.0.2k
7f10dceb4000-7f10dd0b3000 ---p 00237000 fd:00 9917 /usr/lib64/libcrypto.so.1.0.2k
7f10dd0b3000-7f10dd0cf000 r--p 00236000 fd:00 9917 /usr/lib64/libcrypto.so.1.0.2k
7f10dd0cf000-7f10dd0dc000 rw-p 00252000 fd:00 9917 /usr/lib64/libcrypto.so.1.0.2k
7f10dd0dc000-7f10dd0e0000 rw-p 00000000 00:00 0
7f10dd0e0000-7f10dd147000 r-xp 00000000 fd:00 1385049 /usr/lib64/libssl.so.1.0.2k
7f10dd147000-7f10dd347000 ---p 00067000 fd:00 1385049 /usr/lib64/libssl.so.1.0.2k
7f10dd347000-7f10dd34b000 r--p 00067000 fd:00 1385049 /usr/lib64/libssl.so.1.0.2k
7f10dd34b000-7f10dd352000 rw-p 0006b000 fd:00 1385049 /usr/lib64/libssl.so.1.0.2k
7f10dd352000-7f10dd371000 r-xp 00000000 fd:00 203763278 /opt/cpanel/ea-brotli/lib/libbrotlidec.so.1.0.9
7f10dd371000-7f10dd570000 ---p 0001f000 fd:00 203763278 /opt/cpanel/ea-brotli/lib/libbrotlidec.so.1.0.9
7f10dd570000-7f10dd571000 r--p 0001e000 fd:00 203763278 /opt/cpanel/ea-brotli/lib/libbrotlidec.so.1.0.9
7f10dd571000-7f10dd572000 rw-p 0001f000 fd:00 203763278 /opt/cpanel/ea-brotli/lib/libbrotlidec.so.1.0.9
7f10dd572000-7f10dd575000 r-xp 00000000 fd:00 8773 /usr/lib64/libcom_err.so.2.1
7f10dd575000-7f10dd774000 ---p 00003000 fd:00 8773 /usr/lib64/libcom_err.so.2.1
7f10dd774000-7f10dd775000 r--p 00002000 fd:00 8773 /usr/lib64/libcom_err.so.2.1
7f10dd775000-7f10dd776000 rw-p 00003000 fd:00 8773 /usr/lib64/libcom_err.so.2.1
7f10dd776000-7f10dd7a7000 r-xp 00000000 fd:00 8784 /usr/lib64/libk5crypto.so.3.1
7f10dd7a7000-7f10dd9a6000 ---p 00031000 fd:00 8784 /usr/lib64/libk5crypto.so.3.1
7f10dd9a6000-7f10dd9a8000 r--p 00030000 fd:00 8784 /usr/lib64/libk5crypto.so.3.1
7f10dd9a8000-7f10dd9a9000 rw-p 00032000 fd:00 8784 /usr/lib64/libk5crypto.so.3.1
7f10dd9a9000-7f10dda82000 r-xp 00000000 fd:00 8793 /usr/lib64/libkrb5.so.3.3
7f10dda82000-7f10ddc81000 ---p 000d9000 fd:00 8793 /usr/lib64/libkrb5.so.3.3
7f10ddc81000-7f10ddc8f000 r--p 000d8000 fd:00 8793 /usr/lib64/libkrb5.so.3.3
7f10ddc8f000-7f10ddc92000 rw-p 000e6000 fd:00 8793 /usr/lib64/libkrb5.so.3.3
7f10ddc92000-7f10ddcdc000 r-xp 00000000 fd:00 8776 /usr/lib64/libgssapi_krb5.so.2.2
7f10ddcdc000-7f10ddedc000 ---p 0004a000 fd:00 8776 /usr/lib64/libgssapi_krb5.so.2.2
7f10ddedc000-7f10ddedd000 r--p 0004a000 fd:00 8776 /usr/lib64/libgssapi_krb5.so.2.2
7f10ddedd000-7f10ddedf000 rw-p 0004b000 fd:00 8776 /usr/lib64/libgssapi_krb5.so.2.2
7f10ddedf000-7f10ddf0a000 r-xp 00000000 fd:00 15797 /usr/lib64/libssh2.so.1.0.1
7f10ddf0a000-7f10de10a000 ---p 0002b000 fd:00 15797 /usr/lib64/libssh2.so.1.0.1
7f10de10a000-7f10de10b000 r--p 0002b000 fd:00 15797 /usr/lib64/libssh2.so.1.0.1
7f10de10b000-7f10de10c000 rw-p 0002c000 fd:00 15797 /usr/lib64/libssh2.so.1.0.1
7f10de10c000-7f10de132000 r-xp 00000000 fd:00 68309412 /opt/cpanel/nghttp2/lib/libnghttp2.so.14.21.1
7f10de132000-7f10de331000 ---p 00026000 fd:00 68309412 /opt/cpanel/nghttp2/lib/libnghttp2.so.14.21.1
7f10de331000-7f10de334000 r--p 00025000 fd:00 68309412 /opt/cpanel/nghttp2/lib/libnghttp2.so.14.21.1
7f10de334000-7f10de335000 rw-p 00028000 fd:00 68309412 /opt/cpanel/nghttp2/lib/libnghttp2.so.14.21.1
7f10de335000-7f10de3ca000 r-xp 00000000 fd:00 68929126 /opt/cpanel/libcurl/lib64/libcurl.so.4.7.0
7f10de3ca000-7f10de5c9000 ---p 00095000 fd:00 68929126 /opt/cpanel/libcurl/lib64/libcurl.so.4.7.0
7f10de5c9000-7f10de5cc000 r--p 00094000 fd:00 68929126 /opt/cpanel/libcurl/lib64/libcurl.so.4.7.0
7f10de5cc000-7f10de5cf000 rw-p 00097000 fd:00 68929126 /opt/cpanel/libcurl/lib64/libcurl.so.4.7.0
7f10de5cf000-7f10de5d0000 rw-p 00000000 00:00 0
7f10de5d0000-7f10de5e9000 r-xp 00000000 fd:00 134632411 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/curl.so
7f10de5e9000-7f10de7e8000 ---p 00019000 fd:00 134632411 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/curl.so
7f10de7e8000-7f10de7ea000 r--p 00018000 fd:00 134632411 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/curl.so
7f10de7ea000-7f10de7eb000 rw-p 0001a000 fd:00 134632411 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/curl.so
7f10de7eb000-7f10de7ed000 r-xp 00000000 fd:00 136046273 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/ctype.so
7f10de7ed000-7f10de9ed000 ---p 00002000 fd:00 136046273 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/ctype.so
7f10de9ed000-7f10de9ee000 r--p 00002000 fd:00 136046273 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/ctype.so
7f10de9ee000-7f10de9ef000 rw-p 00003000 fd:00 136046273 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/ctype.so
7f10de9ef000-7f10de9f5000 r-xp 00000000 fd:00 134632408 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/calendar.so
7f10de9f5000-7f10debf5000 ---p 00006000 fd:00 134632408 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/calendar.so
7f10debf5000-7f10debf6000 r--p 00006000 fd:00 134632408 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/calendar.so
7f10debf6000-7f10debf7000 rw-p 00007000 fd:00 134632408 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/calendar.so
7f10debf7000-7f10debfe000 r-xp 00000000 fd:00 134632407 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/bcmath.so
7f10debfe000-7f10dedfe000 ---p 00007000 fd:00 134632407 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/bcmath.so
7f10dedfe000-7f10dedff000 r--p 00007000 fd:00 134632407 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/bcmath.so
7f10dedff000-7f10dee00000 rw-p 00008000 fd:00 134632407 /opt/cpanel/ea-php80/root/usr/lib64/php/modules/bcmath.so
7f10dee00000-7f10df000000 rw-p 00000000 00:00 0
7f10df143000-7f10df152000 r-xp 00000000 fd:00 8873 /usr/lib64/libbz2.so.1.0.6
7f10df152000-7f10df351000 ---p 0000f000 fd:00 8873 /usr/lib64/libbz2.so.1.0.6
7f10df351000-7f10df352000 r--p 0000e000 fd:00 8873 /usr/lib64/libbz2.so.1.0.6
7f10df352000-7f10df353000 rw-p 0000f000 fd:00 8873 /usr/lib64/libbz2.so.1.0.6
7f10df353000-7f10df36a000 r-xp 00000000 fd:00 8820 /usr/lib64/libelf-0.176.so
7f10df36a000-7f10df569000 ---p 00017000 fd:00 8820 /usr/lib64/libelf-0.176.so
7f10df569000-7f10df56a000 r--p 00016000 fd:00 8820 /usr/lib64/libelf-0.176.so
7f10df56a000-7f10df56b000 rw-p 00017000 fd:00 8820 /usr/lib64/libelf-0.176.so
7f10df56b000-7f10df5cb000 r-xp 00000000 fd:00 8847 /usr/lib64/libpcre.so.1.2.0
7f10df5cb000-7f10df7cb000 ---p 00060000 fd:00 8847 /usr/lib64/libpcre.so.1.2.0
7f10df7cb000-7f10df7cc000 r--p 00060000 fd:00 8847 /usr/lib64/libpcre.so.1.2.0
7f10df7cc000-7f10df7cd000 rw-p 00061000 fd:00 8847 /usr/lib64/libpcre.so.1.2.0
7f10df7cd000-7f10df7d1000 r-xp 00000000 fd:00 8943 /usr/lib64/libattr.so.1.1.0
7f10df7d1000-7f10df9d0000 ---p 00004000 fd:00 8943 /usr/lib64/libattr.so.1.1.0
7f10df9d0000-7f10df9d1000 r--p 00003000 fd:00 8943 /usr/lib64/libattr.so.1.1.0
7f10df9d1000-7f10df9d2000 rw-p 00004000 fd:00 8943 /usr/lib64/libattr.so.1.1.0
7f10df9d2000-7f10df9e7000 r-xp 00000000 fd:00 4000441 /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7f10df9e7000-7f10dfbe6000 ---p 00015000 fd:00 4000441 /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7f10dfbe6000-7f10dfbe7000 r--p 00014000 fd:00 4000441 /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7f10dfbe7000-7f10dfbe8000 rw-p 00015000 fd:00 4000441 /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7f10dfbe8000-7f10dfc36000 r-xp 00000000 fd:00 33838 /usr/lib64/libdw-0.176.so
7f10dfc36000-7f10dfe36000 ---p 0004e000 fd:00 33838 /usr/lib64/libdw-0.176.so
7f10dfe36000-7f10dfe38000 r--p 0004e000 fd:00 33838 /usr/lib64/libdw-0.176.so
7f10dfe38000-7f10dfe39000 rw-p 00050000 fd:00 33838 /usr/lib64/libdw-0.176.so
7f10dfe39000-7f10dfe3d000 r-xp 00000000 fd:00 8940 /usr/lib64/libgpg-error.so.0.10.0
7f10dfe3d000-7f10e003c000 ---p 00004000 fd:00 8940 /usr/lib64/libgpg-error.so.0.10.0
7f10e003c000-7f10e003d000 r--p 00003000 fd:00 8940 /usr/lib64/libgpg-error.so.0.10.0
7f10e003d000-7f10e003e000 rw-p 00004000 fd:00 8940 /usr/lib64/libgpg-error.so.0.10.0
7f10e003e000-7f10e00bb000 r-xp 00000000 fd:00 8965 /usr/lib64/libgcrypt.so.11.8.2
7f10e00bb000-7f10e02ba000 ---p 0007d000 fd:00 8965 /usr/lib64/libgcrypt.so.11.8.2
7f10e02ba000-7f10e02bb000 r--p 0007c000 fd:00 8965 /usr/lib64/libgcrypt.so.11.8.2
7f10e02bb000-7f10e02be000 rw-p 0007d000 fd:00 8965 /usr/lib64/libgcrypt.so.11.8.2
7f10e02be000-7f10e02bf000 rw-p 00000000 00:00 0
7f10e02bf000-7f10e02cd000 r-xp 00000000 fd:00 9112 /usr/lib64/liblz4.so.1.8.3
7f10e02cd000-7f10e04cc000 ---p 0000e000 fd:00 9112 /usr/lib64/liblz4.so.1.8.3
7f10e04cc000-7f10e04cd000 r--p 0000d000 fd:00 9112 /usr/lib64/liblz4.so.1.8.3
7f10e04cd000-7f10e04ce000 rw-p 0000e000 fd:00 9112 /usr/lib64/liblz4.so.1.8.3
7f10e04ce000-7f10e04f3000 r-xp 00000000 fd:00 8821 /usr/lib64/liblzma.so.5.2.2
7f10e04f3000-7f10e06f2000 ---p 00025000 fd:00 8821 /usr/lib64/liblzma.so.5.2.2
7f10e06f2000-7f10e06f3000 r--p 00024000 fd:00 8821 /usr/lib64/liblzma.so.5.2.2
7f10e06f3000-7f10e06f4000 rw-p 00025000 fd:00 8821 /usr/lib64/liblzma.so.5.2.2
7f10e06f4000-7f10e0718000 r-xp 00000000 fd:00 8859 /usr/lib64/libselinux.so.1
7f10e0718000-7f10e0917000 ---p 00024000 fd:00 8859 /usr/lib64/libselinux.so.1
7f10e0917000-7f10e0918000 r--p 00023000 fd:00 8859 /usr/lib64/libselinux.so.1
7f10e0918000-7f10e0919000 rw-p 00024000 fd:00 8859 /usr/lib64/libselinux.so.1
7f10e0919000-7f10e091b000 rw-p 00000000 00:00 0
7f10e091b000-7f10e091f000 r-xp 00000000 fd:00 8947 /usr/lib64/libcap.so.2.22
7f10e091f000-7f10e0b1e000 ---p 00004000 fd:00 8947 /usr/lib64/libcap.so.2.22
7f10e0b1e000-7f10e0b1f000 r--p 00003000 fd:00 8947 /usr/lib64/libcap.so.2.22
7f10e0b1f000-7f10e0b20000 rw-p 00004000 fd:00 8947 /usr/lib64/libcap.so.2.22
7f10e0b20000-7f10e0b37000 r-xp 00000000 fd:00 8724 /usr/lib64/libpthread-2.17.so
7f10e0b37000-7f10e0d36000 ---p 00017000 fd:00 8724 /usr/lib64/libpthread-2.17.so
7f10e0d36000-7f10e0d37000 r--p 00016000 fd:00 8724 /usr/lib64/libpthread-2.17.so
7f10e0d37000-7f10e0d38000 rw-p 00017000 fd:00 8724 /usr/lib64/libpthread-2.17.so
7f10e0d38000-7f10e0d3c000 rw-p 00000000 00:00 0
7f10e0d3c000-7f10e0d3e000 r-xp 00000000 fd:00 8465 /usr/lib64/libfreebl3.so
7f10e0d3e000-7f10e0f3d000 ---p 00002000 fd:00 8465 /usr/lib64/libfreebl3.so
7f10e0f3d000-7f10e0f3e000 r--p 00001000 fd:00 8465 /usr/lib64/libfreebl3.so
7f10e0f3e000-7f10e0f3f000 rw-p 00002000 fd:00 8465 /usr/lib64/libfreebl3.so
7f10e0f3f000-7f10e1103000 r-xp 00000000 fd:00 8698 /usr/lib64/libc-2.17.so
7f10e1103000-7f10e1302000 ---p 001c4000 fd:00 8698 /usr/lib64/libc-2.17.so
7f10e1302000-7f10e1306000 r--p 001c3000 fd:00 8698 /usr/lib64/libc-2.17.so
7f10e1306000-7f10e1308000 rw-p 001c7000 fd:00 8698 /usr/lib64/libc-2.17.so
7f10e1308000-7f10e130d000 rw-p 00000000 00:00 0
7f10e130d000-7f10e1322000 r-xp 00000000 fd:00 1541 /usr/lib64/libz.so.1.2.7
7f10e1322000-7f10e1521000 ---p 00015000 fd:00 1541 /usr/lib64/libz.so.1.2.7
7f10e1521000-7f10e1522000 r--p 00014000 fd:00 1541 /usr/lib64/libz.so.1.2.7
7f10e1522000-7f10e1523000 rw-p 00015000 fd:00 1541 /usr/lib64/libz.so.1.2.7
7f10e1523000-7f10e1539000 r-xp 00000000 fd:00 1542026 /usr/lib64/libresolv-2.17.so
7f10e1539000-7f10e1739000 ---p 00016000 fd:00 1542026 /usr/lib64/libresolv-2.17.so
7f10e1739000-7f10e173a000 r--p 00016000 fd:00 1542026 /usr/lib64/libresolv-2.17.so
7f10e173a000-7f10e173b000 rw-p 00017000 fd:00 1542026 /usr/lib64/libresolv-2.17.so
7f10e173b000-7f10e173d000 rw-p 00000000 00:00 0
7f10e173d000-7f10e19f7000 r-xp 00000000 fd:00 203763198 /opt/cpanel/ea-openssl11/lib/libcrypto-ea.so.1.1
7f10e19f7000-7f10e1bf6000 ---p 002ba000 fd:00 203763198 /opt/cpanel/ea-openssl11/lib/libcrypto-ea.so.1.1
7f10e1bf6000-7f10e1c21000 r--p 002b9000 fd:00 203763198 /opt/cpanel/ea-openssl11/lib/libcrypto-ea.so.1.1
7f10e1c21000-7f10e1c24000 rw-p 002e4000 fd:00 203763198 /opt/cpanel/ea-openssl11/lib/libcrypto-ea.so.1.1
7f10e1c24000-7f10e1c28000 rw-p 00000000 00:00 0
7f10e1c28000-7f10e1cae000 r-xp 00000000 fd:00 202804909 /opt/cpanel/ea-openssl11/lib/libssl-ea.so.1.1
7f10e1cae000-7f10e1eae000 ---p 00086000 fd:00 202804909 /opt/cpanel/ea-openssl11/lib/libssl-ea.so.1.1
7f10e1eae000-7f10e1eb6000 r--p 00086000 fd:00 202804909 /opt/cpanel/ea-openssl11/lib/libssl-ea.so.1.1
7f10e1eb6000-7f10e1ebb000 rw-p 0008e000 fd:00 202804909 /opt/cpanel/ea-openssl11/lib/libssl-ea.so.1.1
7f10e1ebb000-7f10e2019000 r-xp 00000000 fd:00 203766620 /opt/cpanel/ea-libxml2/lib64/libxml2.so.2.9.7
7f10e2019000-7f10e2219000 ---p 0015e000 fd:00 203766620 /opt/cpanel/ea-libxml2/lib64/libxml2.so.2.9.7
7f10e2219000-7f10e2221000 r--p 0015e000 fd:00 203766620 /opt/cpanel/ea-libxml2/lib64/libxml2.so.2.9.7
7f10e2221000-7f10e2223000 rw-p 00166000 fd:00 203766620 /opt/cpanel/ea-libxml2/lib64/libxml2.so.2.9.7
7f10e2223000-7f10e2224000 rw-p 00000000 00:00 0
7f10e2224000-7f10e2253000 r-xp 00000000 fd:00 8740 /usr/lib64/libsystemd.so.0.6.0
7f10e2253000-7f10e2453000 ---p 0002f000 fd:00 8740 /usr/lib64/libsystemd.so.0.6.0
7f10e2453000-7f10e2454000 r--p 0002f000 fd:00 8740 /usr/lib64/libsystemd.so.0.6.0
7f10e2454000-7f10e2455000 rw-p 00030000 fd:00 8740 /usr/lib64/libsystemd.so.0.6.0
7f10e2455000-7f10e2457000 r-xp 00000000 fd:00 1501685 /usr/lib64/libdl-2.17.so
7f10e2457000-7f10e2657000 ---p 00002000 fd:00 1501685 /usr/lib64/libdl-2.17.so
7f10e2657000-7f10e2658000 r--p 00002000 fd:00 1501685 /usr/lib64/libdl-2.17.so
7f10e2658000-7f10e2659000 rw-p 00003000 fd:00 1501685 /usr/lib64/libdl-2.17.so
7f10e2659000-7f10e275a000 r-xp 00000000 fd:00 1501687 /usr/lib64/libm-2.17.so
7f10e275a000-7f10e2959000 ---p 00101000 fd:00 1501687 /usr/lib64/libm-2.17.so
7f10e2959000-7f10e295a000 r--p 00100000 fd:00 1501687 /usr/lib64/libm-2.17.so
7f10e295a000-7f10e295b000 rw-p 00101000 fd:00 1501687 /usr/lib64/libm-2.17.so
7f10e295b000-7f10e2962000 r-xp 00000000 fd:00 1542039 /usr/lib64/librt-2.17.so
7f10e2962000-7f10e2b61000 ---p 00007000 fd:00 1542039 /usr/lib64/librt-2.17.so
7f10e2b61000-7f10e2b62000 r--p 00006000 fd:00 1542039 /usr/lib64/librt-2.17.so
7f10e2b62000-7f10e2b63000 rw-p 00007000 fd:00 1542039 /usr/lib64/librt-2.17.so
7f10e2b63000-7f10e2b65000 r-xp 00000000 fd:00 8732 /usr/lib64/libutil-2.17.so
7f10e2b65000-7f10e2d64000 ---p 00002000 fd:00 8732 /usr/lib64/libutil-2.17.so
7f10e2d64000-7f10e2d65000 r--p 00001000 fd:00 8732 /usr/lib64/libutil-2.17.so
7f10e2d65000-7f10e2d66000 rw-p 00002000 fd:00 8732 /usr/lib64/libutil-2.17.so
7f10e2d66000-7f10e2d6d000 r-xp 00000000 fd:00 1130881 /opt/cpanel/libargon2/lib64/libargon2.so.0
7f10e2d6d000-7f10e2f6c000 ---p 00007000 fd:00 1130881 /opt/cpanel/libargon2/lib64/libargon2.so.0
7f10e2f6c000-7f10e2f6d000 r--p 00006000 fd:00 1130881 /opt/cpanel/libargon2/lib64/libargon2.so.0
7f10e2f6d000-7f10e2f6e000 rw-p 00007000 fd:00 1130881 /opt/cpanel/libargon2/lib64/libargon2.so.0
7f10e2f6e000-7f10e2f76000 r-xp 00000000 fd:00 8702 /usr/lib64/libcrypt-2.17.so
7f10e2f76000-7f10e3175000 ---p 00008000 fd:00 8702 /usr/lib64/libcrypt-2.17.so
7f10e3175000-7f10e3176000 r--p 00007000 fd:00 8702 /usr/lib64/libcrypt-2.17.so
7f10e3176000-7f10e3177000 rw-p 00008000 fd:00 8702 /usr/lib64/libcrypt-2.17.so
7f10e3177000-7f10e31a5000 rw-p 00000000 00:00 0
7f10e31a5000-7f10e31c7000 r-xp 00000000 fd:00 1622641 /usr/lib64/ld-2.17.so
7f10e31d2000-7f10e3222000 rwxp 00000000 00:00 0
7f10e3222000-7f10e3257000 r--s 00000000 fd:00 134387344 /var/db/nscd/group
7f10e3257000-7f10e328c000 r--s 00000000 fd:00 134385273 /var/db/nscd/passwd
7f10e328c000-7f10e32e1000 r--s 00000000 fd:00 134387345 /var/db/nscd/hosts
7f10e32e1000-7f10e3362000 rw-p 00000000 00:00 0
7f10e336b000-7f10e338b000 rwxp 00000000 00:00 0
7f10e338b000-7f10e33bb000 rw-p 00000000 00:00 0
7f10e33bd000-7f10e33c3000 rw-s 00000000 00:04 19244636 /dev/zero (deleted)
7f10e33c5000-7f10e33c6000 rw-p 00000000 00:00 0
7f10e33c6000-7f10e33c7000 r--p 00021000 fd:00 1622641 /usr/lib64/ld-2.17.so
7f10e33c7000-7f10e33c8000 rw-p 00022000 fd:00 1622641 /usr/lib64/ld-2.17.so
7f10e33c8000-7f10e33c9000 rw-p 00000000 00:00 0
7ffee37f9000-7ffee381a000 rw-p 00000000 00:00 0 [stack]
7ffee3957000-7ffee3959000 r-xp 00000000 00:00 0 [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]


The port and the PID is changing every time
Is there real risk from attack?

Re: Suspicious process running under user itrservices

Posted: 19 Feb 2022, 15:00
by Sergio
Have you tried to add the following line into CSF.PIGNORE?

exe:/opt/cpanel/ea-php80/root/usr/sbin/php-fpm