Suspicious processes detected on the server

kshivachev

• August 29, 2017 03:51

Hello, Here is what my security system detected. The processes are very strange and I don't know what they are doing. Has anyone an idea what they can be ?
Executable: /opt/alt/php56/usr/bin/php-cgi Command Line (often faked in exploits): /opt/cpanel/ea-php56/root/usr/bin/php-cgi /home/username/public_html/index.php Network connections by the process (if any): tcp: SERVER_IP:37759 -> SERVER_IP:80 Files open by the process (if any): (deleted)/tmp/.ZendSem.fPbx9T Memory maps by the process (if any): 00400000-0088e000 r-xp 00000000 08:01 162426 /opt/alt/php56/usr/bin/php-cgi 00a8d000-00b29000 rw-p 0048d000 08:01 162426 /opt/alt/php56/usr/bin/php-cgi 00b29000-00b45000 rw-p 00000000 00:00 0 02315000-02fda000 rw-p 00000000 00:00 0 [heap] 7f0da95d9000-7f0dad5d9000 rw-s 00000000 00:04 39576783 (deleted)/dev/zero 7f0dad5d9000-7f0dad5e6000 r-xp 00000000 08:01 554334 /lib64/libnss_files-2.12.so 7f0dad5e6000-7f0dad7e5000 ---p 0000d000 08:01 554334 /lib64/libnss_files-2.12.so 7f0dad7e5000-7f0dad7e6000 r--p 0000c000 08:01 554334 /lib64/libnss_files-2.12.so 7f0dad7e6000-7f0dad7e7000 rw-p 0000d000 08:01 554334 /lib64/libnss_files-2.12.so 7f0dad7e7000-7f0dad801000 r-xp 00000000 08:01 159570 /opt/alt/php56/usr/lib64/php/modules/zip.so 7f0dad801000-7f0dada00000 ---p 0001a000 08:01 159570 /opt/alt/php56/usr/lib64/php/modules/zip.so 7f0dada00000-7f0dada03000 rw-p 00019000 08:01 159570 /opt/alt/php56/usr/lib64/php/modules/zip.so 7f0dada03000-7f0dada06000 r-xp 00000000 08:01 524511 /lib64/libgpg-error.so.0.5.0 7f0dada06000-7f0dadc05000 ---p 00003000 08:01 524511 /lib64/libgpg-error.so.0.5.0 7f0dadc05000-7f0dadc06000 r--p 00002000 08:01 524511 /lib64/libgpg-error.so.0.5.0 7f0dadc06000-7f0dadc07000 rw-p 00003000 08:01 524511 /lib64/libgpg-error.so.0.5.0 7f0dadc07000-7f0dadc79000 r-xp 00000000 08:01 524655 /lib64/libgcrypt.so.11.5.3 7f0dadc79000-7f0dade78000 ---p 00072000 08:01 524655 /lib64/libgcrypt.so.11.5.3 7f0dade78000-7f0dade79000 r--p 00071000 08:01 524655 /lib64/libgcrypt.so.11.5.3 7f0dade79000-7f0dade7c000 rw-p 00072000 08:01 524655 /lib64/libgcrypt.so.11.5.3 7f0dade7c000-7f0dadeb7000 r-xp 00000000 08:07 4457157 /usr/lib64/libxslt.so.1.1.26 7f0dadeb7000-7f0dae0b7000 ---p 0003b000 08:07 4457157 /usr/lib64/libxslt.so.1.1.26 7f0dae0b7000-7f0dae0b9000 rw-p 0003b000 08:07 4457157 /usr/lib64/libxslt.so.1.1.26 7f0dae0b9000-7f0dae0cc000 r-xp 00000000 08:07 4456973 /usr/lib64/libexslt.so.0.8.15 7f0dae0cc000-7f0dae2cc000 ---p 00013000 08:07 4456973 /usr/lib64/libexslt.so.0.8.15 7f0dae2cc000-7f0dae2cd000 rw-p 00013000 08:07 4456973 /usr/lib64/libexslt.so.0.8.15 7f0dae2cd000-7f0dae2d4000 r-xp 00000000 08:01 167623 /opt/alt/php56/usr/lib64/php/modules/xsl.so 7f0dae2d4000-7f0dae4d4000 ---p 00007000 08:01 167623 /opt/alt/php56/usr/lib64/php/modules/xsl.so 7f0dae4d4000-7f0dae4d5000 rw-p 00007000 08:01 167623 /opt/alt/php56/usr/lib64/php/modules/xsl.so 7f0dae4d5000-7f0dae4de000 r-xp 00000000 08:01 167622 /opt/alt/php56/usr/lib64/php/modules/xmlwriter.so 7f0dae4de000-7f0dae6dd000 ---p 00009000 08:01 167622 /opt/alt/php56/usr/lib64/php/modules/xmlwriter.so 7f0dae6dd000-7f0dae6e0000 rw-p 00008000 08:01 167622 /opt/alt/php56/usr/lib64/php/modules/xmlwriter.so 7f0dae6e0000-7f0dae6f2000 r-xp 00000000 08:01 167595 /opt/alt/php56/usr/lib64/php/modules/xmlrpc.so 7f0dae6f2000-7f0dae8f1000 ---p 00012000 08:01 167595 /opt/alt/php56/usr/lib64/php/modules/xmlrpc.so 7f0dae8f1000-7f0dae8f3000 rw-p 00011000 08:01 167595 /opt/alt/php56/usr/lib64/php/modules/xmlrpc.so 7f0dae8f3000-7f0dae8f9000 r-xp 00000000 08:01 167621 /opt/alt/php56/usr/lib64/php/modules/xmlreader.so 7f0dae8f9000-7f0daeaf9000 ---p 00006000 08:01 167621 /opt/alt/php56/usr/lib64/php/modules/xmlreader.so 7f0daeaf9000-7f0daeafa000 rw-p 00006000 08:01 167621 /opt/alt/php56/usr/lib64/php/modules/xmlreader.so 7f0daeafa000-7f0daeb02000 r-xp 00000000 08:01 167620 /opt/alt/php56/usr/lib64/php/modules/wddx.so 7f0daeb02000-7f0daed02000 ---p 00008000 08:01 167620 /opt/alt/php56/usr/lib64/php/modules/wddx.so 7f0daed02000-7f0daed03000 rw-p 00008000 08:01 167620 /opt/alt/php56/usr/lib64/php/modules/wddx.so 7f0daed03000-7f0daed06000 r-xp 00000000 08:01 165083 /opt/alt/php56/usr/lib64/php/modules/sysvshm.so 7f0daed06000-7f0daef05000 ---p 00003000 08:01 165083 /opt/alt/php56/usr/lib64/php/modules/sysvshm.so 7f0daef05000-7f0daef06000 rw-p 00002000 08:01 165083 /opt/alt/php56/usr/lib64/php/modules/sysvshm.so 7f0daef06000-7f0daef08000 r-xp 00000000 08:01 165082 /opt/alt/php56/usr/lib64/php/modules/sysvsem.so 7f0daef08000-7f0daf107000 ---p 00002000 08:01 165082 /opt/alt/php56/usr/lib64/php/modules/sysvsem.so 7f0daf107000-7f0daf108000 rw-p 00001000 08:01 165082 /opt/alt/php56/usr/lib64/php/modules/sysvsem.so 7f0daf108000-7f0daf10b000 r-xp 00000000 08:01 165081 /opt/alt/php56/usr/lib64/php/modules/sysvmsg.so 7f0daf10b000-7f0daf30b000 ---p 00003000 08:01 165081 /opt/alt/php56/usr/lib64/php/modules/sysvmsg.so 7f0daf30b000-7f0daf30c000 rw-p 00003000 08:01 165081 /opt/alt/php56/usr/lib64/php/modules/sysvmsg.so 7f0daf30c000-7f0daf31f000 r-xp 00000000 08:01 159569 /opt/alt/php56/usr/lib64/php/modules/sockets.so 7f0daf31f000-7f0daf51f000 ---p 00013000 08:01 159569 /opt/alt/php56/usr/lib64/php/modules/sockets.so 7f0daf51f000-7f0daf521000 rw-p 00013000 08:01 159569 /opt/alt/php56/usr/lib64/php/modules/sockets.so 7f0daf521000-7f0daf575000 r-xp 00000000 08:01 167613 /opt/alt/php56/usr/lib64/php/modules/soap.so 7f0daf575000-7f0daf775000 ---p 00054000 08:01 167613 /opt/alt/php56/usr/lib64/php/modules/soap.so 7f0daf775000-7f0daf778000 rw-p 00054000 08:01 167613 /opt/alt/php56/usr/lib64/php/modules/soap.so 7f0daf778000-7f0daf804000 r-xp 00000000 08:01 159871 /opt/alt/net-snmp/usr/lib64/libnetsnmp.so.31.0.2 7f0daf804000-7f0dafa04000 ---p 0008c000 08:01 159871 /opt/alt/net-snmp/usr/lib64/libnetsnmp.so.31.0.2 7f0dafa04000-7f0dafa09000 rw-p 0008c000 08:01 159871 /opt/alt/net-snmp/usr/lib64/libnetsnmp.so.31.0.2 7f0dafa09000-7f0dafa3d000 rw-p 00000000 00:00 0 7f0dafa3d000-7f0dafa48000 r-xp 00000000 08:01 167305 /opt/alt/php56/usr/lib64/php/modules/snmp.so 7f0dafa48000-7f0dafc47000 ---p 0000b000 08:01 167305 /opt/alt/php56/usr/lib64/php/modules/snmp.so 7f0dafc47000-7f0dafc4a000 rw-p 0000a000 08:01 167305 /opt/alt/php56/usr/lib64/php/modules/snmp.so 7f0dafc4a000-7f0dafc4b000 r-xp 00000000 08:07 4462771 /usr/lib64/libpspell.so.15.1.4 7f0dafc4b000-7f0dafe4a000 ---p 00001000 08:07 4462771 /usr/lib64/libpspell.so.15.1.4 7f0dafe4a000-7f0dafe4b000 rw-p 00000000 08:07 4462771 /usr/lib64/libpspell.so.15.1.4 7f0dafe4b000-7f0dafefd000 r-xp 00000000 08:07 4462769 /usr/lib64/libaspell.so.15.1.4 7f0dafefd000-7f0db00fd000 ---p 000b2000 08:07 4462769 /usr/lib64/libaspell.so.15.1.4 7f0db00fd000-7f0db0104000 rw-p 000b2000 08:07 4462769 /usr/lib64/libaspell.so.15.1.4 7f0db0104000-7f0db010c000 rw-p 00000000 00:00 0 7f0db010c000-7f0db0110000 r-xp 00000000 08:01 167593 /opt/alt/php56/usr/lib64/php/modules/pspell.so 7f0db0110000-7f0db0310000 ---p 00004000 08:01 167593 /opt/alt/php56/usr/lib64/php/modules/pspell.so 7f0db0310000-7f0db0311000 rw-p 00004000 08:01 167593 /opt/alt/php56/usr/lib64/php/modules/pspell.so 7f0db0311000-7f0db0317000 r-xp 00000000 08:01 165080 /opt/alt/php56/usr/lib64/php/modules/posix.so 7f0db0317000-7f0db0516000 ---p 00006000 08:01 165080 /opt/alt/php56/usr/lib64/php/modules/posix.so 7f0db0516000-7f0db0518000 rw-p 00005000 08:01 165080 /opt/alt/php56/usr/lib64/php/modules/posix.so 7f0db0518000-7f0db0557000 r-xp 00000000 08:01 159568 /opt/alt/php56/usr/lib64/php/modules/phar.so 7f0db0557000-7f0db0756000 ---p 0003f000 08:01 159568 /opt/alt/php56/usr/lib64/php/modules/phar.so 7f0db0756000-7f0db0759000 rw-p 0003e000 08:01 159568 /opt/alt/php56/usr/lib64/php/modules/phar.so 7f0db0759000-7f0db0776000 r-xp 00000000 08:01 167381 /opt/alt/php56/usr/lib64/php/modules/pgsql.so 7f0db0776000-7f0db0976000 ---p 0001d000 08:01 167381 /opt/alt/php56/usr/lib64/php/modules/pgsql.so 7f0db0976000-7f0db097a000 rw-p 0001d000 08:01 167381 /opt/alt/php56/usr/lib64/php/modules/pgsql.so 7f0db097a000-7f0db0a34000 r-xp 00000000 08:01 544793 /opt/alt/sqlite/usr/lib64/libsqlite3.so.0.8.6 7f0db0a34000-7f0db0c33000 ---p 000ba000 08:01 544793 /opt/alt/sqlite/usr/lib64/libsqlite3.so.0.8.6 7f0db0c33000-7f0db0c38000 rw-p 000b9000 08:01 544793 /opt/alt/sqlite/usr/lib64/libsqlite3.so.0.8.6 7f0db0c38000-7f0db0c3e000 r-xp 00000000 08:01 159764 /opt/alt/php56/usr/lib64/php/modules/pdo_sqlite.so 7f0db0c3e000-7f0db0e3d000 ---p 00006000 08:01 159764 /opt/alt/php56/usr/lib64/php/modules/pdo_sqlite.so 7f0db0e3d000-7f0db0e3e000 rw-p 00005000 08:01 159764 /opt/alt/php56/usr/lib64/php/modules/pdo_sqlite.so 7f0db0e3e000-7f0db0e92000 r-xp 00000000 08:01 555733 /lib64/libldap_r-2.4.so.2.10.3 7f0db0e92000-7f0db1092000 ---p 00054000 08:01 555733 /lib64/libldap_r-2.4.so.2.10.3 7f0db1092000-7f0db1094000 r--p 00054000 08:01 555733 /lib64/libldap_r-2.4.so.2.10.3 7f0db1094000-7f0db1096000 rw-p 00056000 08:01 555733 /lib64/libldap_r-2.4.so.2.10.3 7f0db1096000-7f0db1098000 rw-p 00000000 00:00 0 7f0db1098000-7f0db10be000 r-xp 00000000 08:07 4456531 /usr/lib64/libpq.so.5.2 7f0db10be000-7f0db12bd000 ---p 00026000 08:07 4456531 /usr/lib64/libpq.so.5.2 7f0db12bd000-7f0db12c0000 rw-p 00025000 08:07 4456531 /usr/lib64/libpq.so.5.2 7f0db12c0000-7f0db12c9000 r-xp 00000000 08:01 167380 /opt/alt/php56/usr/lib64/php/modules/pdo_pgsql.so 7f0db12c9000-7f0db14c9000 ---p 00009000 08:01 167380 /opt/alt/php56/usr/lib64/php/modules/pdo_pgsql.so 7f0db14c9000-7f0db14ca000 rw-p 00009000 08:01 167380 /opt/alt/php56/usr/lib64/php/modules/pdo_pgsql.so 7f0db14ca000-7f0db14d0000 r-xp 00000000 08:01 167385 /opt/alt/php56/usr/lib64/php/modules/pdo_odbc.so 7f0db14d0000-7f0db16cf000 ---p 00006000 08:01 167385 /opt/alt/php56/usr/lib64/php/modules/pdo_odbc.so 7f0db16cf000-7f0db16d0000 rw-p 00005000 08:01 167385 /opt/alt/php56/usr/lib64/php/modules/pdo_odbc.so 7f0db16d0000-7f0db16d7000 r-xp 00000000 08:01 165061 /opt/alt/php56/etc/percona5.6/pdo_mysql.so 7f0db16d7000-7f0db18d7000 ---p 00007000 08:01 165061 /opt/alt/php56/etc/percona5.6/pdo_mysql.so 7f0db18d7000-7f0db18d8000 rw-p 00007000 08:01 165061 /opt/alt/php56/etc/percona5.6/pdo_mysql.so 7f0db18d8000-7f0db18ef000 r-xp 00000000 08:01 159762 /opt/alt/php56/usr/lib64/php/modules/pdo.so 7f0db18ef000-7f0db1aee000 ---p 00017000 08:01 159762 /opt/alt/php56/usr/lib64/php/modules/pdo.so 7f0db1aee000-7f0db1af1000 rw-p 00016000 08:01 159762 /opt/alt/php56/usr/lib64/php/modules/pdo.so 7f0db1af1000-7f0db1b50000 r-xp 00000000 08:07 4462736 /usr/lib64/libodbc.so.2.0.0 7f0db1b50000-7f0db1d4f000 ---p 0005f000 08:07 4462736 /usr/lib64/libodbc.so.2.0.0 7f0db1d4f000-7f0db1d57000 rw-p 0005e000 08:07 4462736 /usr/lib64/libodbc.so.2.0.0 7f0db1d57000-7f0db1d58000 rw-p 00000000 00:00 0 7f0db1d58000-7f0db1d66000 r-xp 00000000 08:01 167384 /opt/alt/php56/usr/lib64/php/modules/odbc.so 7f0db1d66000-7f0db1f65000 ---p 0000e000 08:01 167384 /opt/alt/php56/usr/lib64/php/modules/odbc.so 7f0db1f65000-7f0db1f68000 rw-p 0000d000 08:01 167384 /opt/alt/php56/usr/lib64/php/modules/odbc.so 7f0db1f68000-7f0db1fa6000 r-xp 00000000 08:01 167600 /opt/alt/php56/usr/lib64/php/modules/mysqlnd.so 7f0db1fa6000-7f0db21a6000 ---p 0003e000 08:01 167600 /opt/alt/php56/usr/lib64/php/modules/mysqlnd.so 7f0db21a6000-7f0db21ac000 rw-p 0003e000 08:01 167600 /opt/alt/php56/usr/lib64/php/modules/mysqlnd.so 7f0db21ac000-7f0db21ad000 rw-p 00000000 00:00 0 7f0db21ad000-7f0db21cd000 r-xp 00000000 08:01 165060 /opt/alt/php56/etc/percona5.6/mysqli.so 7f0db21cd000-7f0db23cc000 ---p 00020000 08:01 165060 /opt/alt/php56/etc/percona5.6/mysqli.so 7f0db23cc000-7f0db23d2000 rw-p 0001f000 08:01 165060 /opt/alt/php56/etc/percona5.6/mysqli.so 7f0db23d2000-7f0db2660000 r-xp 00000000 08:07 4456603 /usr/lib64/libperconaserverclient.so.18.1.0 7f0db2660000-7f0db285f000 ---p 0028e000 08:07 4456603 /usr/lib64/libperconaserverclient.so.18.1.0 7f0db285f000-7f0db292f000 rw-p 0028d000 08:07 4456603 /usr/lib64/libperconaserverclient.so.18.1.0 7f0db292f000-7f0db2934000 rw-p 00000000 00:00 0 7f0db2934000-7f0db2940000 r-xp 00000000 08:01 165059 /opt/alt/php56/etc/percona5.6/mysql.so 7f0db2940000-7f0db2b40000 ---p 0000c000 08:01 165059 /opt/alt/php56/etc/percona5.6/mysql.so 7f0db2b40000-7f0db2b42000 rw-p 0000c000 08:01 165059 /opt/alt/php56/etc/percona5.6/mysql.so 7f0db2b42000-7f0db2b4b000 r-xp 00000000 08:07 4457028 /usr/lib64/libltdl.so.7.2.1 7f0db2b4b000-7f0db2d4a000 ---p 00009000 08:07 4457028 /usr/lib64/libltdl.so.7.2.1 7f0db2d4a000-7f0db2d4b000 rw-p 00008000 08:07 4457028 /usr/lib64/libltdl.so.7.2.1 7f0db2d4b000-7f0db2d75000 r-xp 00000000 08:07 4465901 /usr/lib64/libmcrypt.so.4.4.8 7f0db2d75000-7f0db2f75000 ---p 0002a000 08:07 4465901 /usr/lib64/libmcrypt.so.4.4.8 7f0db2f75000-7f0db2f78000 rw-p 0002a000 08:07 4465901 /usr/lib64/libmcrypt.so.4.4.8 7f0db2f78000-7f0db2f7e000 rw-p 00000000 00:00 0 7f0db2f7e000-7f0db2f87000 r-xp 00000000 08:01 167291 /opt/alt/php56/usr/lib64/php/modules/mcrypt.so 7f0db2f87000-7f0db3187000 ---p 00009000 08:01 167291 /opt/alt/php56/usr/lib64/php/modules/mcrypt.so 7f0db3187000-7f0db3189000 rw-p 00009000 08:01 167291 /opt/alt/php56/usr/lib64/php/modules/mcrypt.so 7f0db3189000-7f0db32d6000 r-xp 00000000 08:01 165075 /opt/alt/php56/usr/lib64/php/modules/mbstring.so 7f0db32d6000-7f0db34d5000 ---p 0014d000 08:01 165075 /opt/alt/php56/usr/lib64/php/modules/mbstring.so 7f0db34d5000-7f0db34e2000 rw-p 0014c000 08:01 165075 /opt/alt/php56/usr/lib64/php/modules/mbstring.so 7f0db34e2000-7f0db34ef000 r-xp 00000000 08:01 167625 /opt/alt/php56/usr/lib64/php/modules/ldap.so 7f0db34ef000-7f0db36ee000 ---p 0000d000 08:01 167625 /opt/alt/php56/usr/lib64/php/modules/ldap.so 7f0db36ee000-7f0db36f1000 rw-p 0000c000 08:01 167625 /opt/alt/php56/usr/lib64/php/modules/ldap.so 7f0db36f1000-7f0db36fb000 r-xp 00000000 08:01 159567 /opt/alt/php56/usr/lib64/php/modules/json.so 7f0db36fb000-7f0db38fb000 ---p 0000a000 08:01 159567 /opt/alt/php56/usr/lib64/php/modules/json.so 7f0db38fb000-7f0db38fc000 rw-p 0000a000 08:01 159567 /opt/alt/php56/usr/lib64/php/modules/json.so 7f0db38fc000-7f0db3907000 r-xp 00000000 08:01 160060 /opt/alt/libicu/usr/lib64/libicuio.so.57.1 7f0db3907000-7f0db3b07000 ---p 0000b000 08:01 160060 /opt/alt/libicu/usr/lib64/libicuio.so.57.1 7f0db3b07000-7f0db3b09000 rw-p 0000b000 08:01 160060 /opt/alt/libicu/usr/lib64/libicuio.so.57.1 7f0db3b09000-7f0db5385000 r-xp 00000000 08:01 160056 /opt/alt/libicu/usr/lib64/libicudata.so.57.1 7f0db5385000-7f0db5584000 ---p 0187c000 08:01 160056 /opt/alt/libicu/usr/lib64/libicudata.so.57.1 7f0db5584000-7f0db5585000 rw-p 0187b000 08:01 160056 /opt/alt/libicu/usr/lib64/libicudata.so.57.1 7f0db5585000-7f0db5716000 r-xp 00000000 08:01 160070 /opt/alt/libicu/usr/lib64/libicuuc.so.57.1 7f0db5716000-7f0db5916000 ---p 00191000 08:01 160070 /opt/alt/libicu/usr/lib64/libicuuc.so.57.1 7f0db5916000-7f0db592a000 rw-p 00191000 08:01 160070 /opt/alt/libicu/usr/lib64/libicuuc.so.57.1 7f0db592a000-7f0db592b000 rw-p 00000000 00:00 0 7f0db592b000-7f0db5b95000 r-xp 00000000 08:01 160058 /opt/alt/libicu/usr/lib64/libicui18n.so.57.1 7f0db5b95000-7f0db5d95000 ---p 0026a000 08:01 160058 /opt/alt/libicu/usr/lib64/libicui18n.so.57.1 7f0db5d95000-7f0db5da6000 rw-p 0026a000 08:01 160058 /opt/alt/libicu/usr/lib64/libicui18n.so.57.1 7f0db5da6000-7f0db5dfc000 r-xp 00000000 08:01 167253 /opt/alt/php56/usr/lib64/php/modules/intl.so 7f0db5dfc000-7f0db5ffb000 ---p 00056000 08:01 167253 /opt/alt/php56/usr/lib64/php/modules/intl.so 7f0db5ffb000-7f0db6005000 rw-p 00055000 08:01 167253 /opt/alt/php56/usr/lib64/php/modules/intl.so 7f0db6005000-7f0db6006000 rw-p 00000000 00:00 0 7f0db6006000-7f0db601e000 r-xp 00000000 08:01 555699 /lib64/libaudit.so.1.0.0 7f0db601e000-7f0db621d000 ---p 00018000 08:01 555699 /lib64/libaudit.so.1.0.0 7f0db621d000-7f0db621f000 r--p 00017000 08:01 555699 /lib64/libaudit.so.1.0.0 7f0db621f000-7f0db622a000 rw-p 00019000 08:01 555699 /lib64/libaudit.so.1.0.0 7f0db622a000-7f0db6236000 r-xp 00000000 08:01 533430 /lib64/libpam.so.0.82.2 7f0db6236000-7f0db6436000 ---p 0000c000 08:01 533430 /lib64/libpam.so.0.82.2 7f0db6436000-7f0db6437000 r--p 0000c000 08:01 533430 /lib64/libpam.so.0.82.2 7f0db6437000-7f0db6438000 rw-p 0000d000 08:01 533430 /lib64/libpam.so.0.82.2 7f0db6438000-7f0db653f000 r-xp 00000000 08:07 4465902 /usr/lib64/libc-client.so.2007 7f0db653f000-7f0db673f000 ---p 00107000 08:07 4465902 /usr/lib64/libc-client.so.2007 7f0db673f000-7f0db6749000 rw-p 00107000 08:07 4465902 /usr/lib64/libc-client.so.2007 7f0db6749000-7f0db674a000 rw-p 00000000 00:00 0 7f0db674a000-7f0db675f000 r-xp 00000000 08:01 167263 /opt/alt/php56/usr/lib64/php/modules/imap.so 7f0db675f000-7f0db695f000 ---p 00015000 08:01 167263 /opt/alt/php56/usr/lib64/php/modules/imap.so 7f0db695f000-7f0db6962000 rw-p 00015000 08:01 167263 /opt/alt/php56/usr/lib64/php/modules/imap.so 7f0db6962000-7f0db6964000 r-xp 00000000 08:07 4456472 /usr/lib64/libXau.so.6.0.0 7f0db6964000-7f0db6b64000 ---p 00002000 08:07 4456472 /usr/lib64/libXau.so.6.0.0 7f0db6b64000-7f0db6b65000 rw-p 00002000 08:07 4456472 /usr/lib64/libXau.so.6.0.0 7f0db6b65000-7f0db6b89000 r-xp 00000000 08:07 4456781 /usr/lib64/libxcb.so.1.1.0 7f0db6b89000-7f0db6d89000 ---p 00024000 08:07 4456781 /usr/lib64/libxcb.so.1.1.0 7f0db6d89000-7f0db6d8a000 rw-p 00024000 08:07 4456781 /usr/lib64/libxcb.so.1.1.0 7f0db6d8a000-7f0db6e22000 r-xp 00000000 08:07 4456682 /usr/lib64/libfreetype.so.6.3.22 7f0db6e22000-7f0db7021000 ---p 00098000 08:07 4456682 /usr/lib64/libfreetype.so.6.3.22 7f0db7021000-7f0db7027000 rw-p 00097000 08:07 4456682 /usr/lib64/libfreetype.so.6.3.22 7f0db7027000-7f0db7169000 r-xp 00000000 08:07 4462792 /usr/lib64/libvpx.so.1.3.0 7f0db7169000-7f0db7369000 ---p 00142000 08:07 4462792 /usr/lib64/libvpx.so.1.3.0 7f0db7369000-7f0db736c000 rw-p 00142000 08:07 4462792 /usr/lib64/libvpx.so.1.3.0 7f0db736c000-7f0db73b2000 rw-p 00000000 00:00 0 7f0db73b2000-7f0db73f1000 r-xp 00000000 08:07 4457900 /usr/lib64/libjpeg.so.62.0.0 7f0db73f1000-7f0db75f1000 ---p 0003f000 08:07 4457900 /usr/lib64/libjpeg.so.62.0.0 7f0db75f1000-7f0db75f2000 rw-p 0003f000 08:07 4457900 /usr/lib64/libjpeg.so.62.0.0 7f0db75f2000-7f0db7602000 rw-p 00000000 00:00 0 7f0db7602000-7f0db7627000 r-xp 00000000 08:07 4456686 /usr/lib64/libpng12.so.0.49.0 7f0db7627000-7f0db7827000 ---p 00025000 08:07 4456686 /usr/lib64/libpng12.so.0.49.0 7f0db7827000-7f0db7828000 rw-p 00025000 08:07 4456686 /usr/lib64/libpng12.so.0.49.0 7f0db7828000-7f0db7839000 r-xp 00000000 08:07 4456486 /usr/lib64/libXpm.so.4.11.0 7f0db7839000-7f0db7a38000 ---p 00011000 08:07 4456486 /usr/lib64/libXpm.so.4.11.0 7f0db7a38000-7f0db7a39000 rw-p 00010000 08:07 4456486 /usr/lib64/libXpm.so.4.11.0 7f0db7a39000-7f0db7b70000 r-xp 00000000 08:07 4456948 /usr/lib64/libX11.so.6.3.0 7f0db7b70000-7f0db7d70000 ---p 00137000 08:07 4456948 /usr/lib64/libX11.so.6.3.0 7f0db7d70000-7f0db7d76000 rw-p 00137000 08:07 4456948 /usr/lib64/libX11.so.6.3.0 7f0db7d76000-7f0db7dbb000 r-xp 00000000 08:01 159793 /opt/alt/t1lib/usr/lib64/libt1.so.5.1.2 7f0db7dbb000-7f0db7fba000 ---p 00045000 08:01 159793 /opt/alt/t1lib/usr/lib64/libt1.so.5.1.2 7f0db7fba000-7f0db7fbe000 rw-p 00044000 08:01 159793 /opt/alt/t1lib/usr/lib64/libt1.so.5.1.2 7f0db7fbe000-7f0db7fd4000 rw-p 00000000 00:00 0 7f0db7fd4000-7f0db8031000 r-xp 00000000 08:01 165037 /opt/alt/php56/usr/lib64/php/modules/gd.so 7f0db8031000-7f0db8230000 ---p 0005d000 08:01 165037 /opt/alt/php56/usr/lib64/php/modules/gd.so 7f0db8230000-7f0db8236000 rw-p 0005c000 08:01 165037 /opt/alt/php56/usr/lib64/php/modules/gd.so 7f0db8236000-7f0db823b000 rw-p 00000000 00:00 0 7f0db823b000-7f0db84fe000 r-xp 00000000 08:01 159566 /opt/alt/php56/usr/lib64/php/modules/fileinfo.so 7f0db84fe000-7f0db86fd000 ---p 002c3000 08:01 159566 /opt/alt/php56/usr/lib64/php/modules/fileinfo.so 7f0db86fd000-7f0db86ff000 rw-p 002c2000 08:01 159566 /opt/alt/php56/usr/lib64/php/modules/fileinfo.so 7f0db86ff000-7f0db8814000 r-xp 00000000 08:01 524583 /lib64/libglib-2.0.so.0.2800.8 7f0db8814000-7f0db8a14000 ---p 00115000 08:01 524583 /lib64/libglib-2.0.so.0.2800.8 7f0db8a14000-7f0db8a15000 rw-p 00115000 08:01 524583 /lib64/libglib-2.0.so.0.2800.8 7f0db8a15000-7f0db8a16000 rw-p 00000000 00:00 0 7f0db8a16000-7f0db8a19000 r-xp 00000000 08:01 555696 /lib64/libgmodule-2.0.so.0.2800.8 7f0db8a19000-7f0db8c18000 ---p 00003000 08:01 555696 /lib64/libgmodule-2.0.so.0.2800.8 7f0db8c18000-7f0db8c19000 rw-p 00002000 08:01 555696 /lib64/libgmodule-2.0.so.0.2800.8 7f0db8c19000-7f0db8c23000 r-xp 00000000 08:07 4457167 /usr/lib64/libenchant.so.1.5.0 7f0db8c23000-7f0db8e23000 ---p 0000a000 08:07 4457167 /usr/lib64/libenchant.so.1.5.0 7f0db8e23000-7f0db8e24000 rw-p 0000a000 08:07 4457167 /usr/lib64/libenchant.so.1.5.0 7f0db8e24000-7f0db8e29000 r-xp 00000000 08:01 167611 /opt/alt/php56/usr/lib64/php/modules/enchant.so 7f0db8e29000-7f0db9028000 ---p 00005000 08:01 167611 /opt/alt/php56/usr/lib64/php/modules/enchant.so 7f0db9028000-7f0db9029000 rw-p 00004000 08:01 167611 /opt/alt/php56/usr/lib64/php/modules/enchant.so 7f0db9029000-7f0db9050000 r-xp 00000000 08:01 167619 /opt/alt/php56/usr/lib64/php/modules/dom.so 7f0db9050000-7f0db924f000 ---p 00027000 08:01 167619 /opt/alt/php56/usr/lib64/php/modules/dom.so 7f0db924f000-7f0db9254000 rw-p 00026000 08:01 167619 /opt/alt/php56/usr/lib64/php/modules/dom.so 7f0db9254000-7f0db9255000 rw-p 00000000 00:00 0 7f0db9255000-7f0db93c4000 r-xp 00000000 08:01 555704 /lib64/libdb-4.7.so 7f0db93c4000-7f0db95c4000 ---p 0016f000 08:01 555704 /lib64/libdb-4.7.so 7f0db95c4000-7f0db95c9000 rw-p 0016f000 08:01 555704 /lib64/libdb-4.7.so 7f0db95c9000-7f0db95ca000 rw-p 00000000 00:00 0 7f0db95ca000-7f0db95d5000 r-xp 00000000 08:01 167607 /opt/alt/php56/usr/lib64/php/modules/dba.so 7f0db95d5000-7f0db97d4000 ---p 0000b000 08:01 167607 /opt/alt/php56/usr/lib64/php/modules/dba.so 7f0db97d4000-7f0db97d6000 rw-p 0000a000 08:01 167607 /opt/alt/php56/usr/lib64/php/modules/dba.so 7f0db97d6000-7f0db97dd000 r-xp 00000000 08:01 167605 /opt/alt/php56/usr/lib64/php/modules/bcmath.so 7f0db97dd000-7f0db99dc000 ---p 00007000 08:01 167605 /opt/alt/php56/usr/lib64/php/modules/bcmath.so 7f0db99dc000-7f0db99dd000 rw-p 00006000 08:01 167605 /opt/alt/php56/usr/lib64/php/modules/bcmath.so 7f0db99dd000-7f0db9b23000 r-xp 00000000 08:01 166841 /opt/alt/php56/usr/lib64/php/modules/ZendGuardLoader.so 7f0db9b23000-7f0db9d23000 ---p 00146000 08:01 166841 /opt/alt/php56/usr/lib64/php/modules/ZendGuardLoader.so 7f0db9d23000-7f0db9d40000 rw-p 00146000 08:01 166841 /opt/alt/php56/usr/lib64/php/modules/ZendGuardLoader.so 7f0db9d40000-7f0db9d46000 rw-p 00000000 00:00 0 7f0db9d46000-7f0db9d5c000 r-xp 00000000 08:01 166844 /opt/alt/php56/usr/lib64/php/modules/ixed.5.6.lin 7f0db9d5c000-7f0db9f5c000 ---p 00016000 08:01 166844 /opt/alt/php56/usr/lib64/php/modules/ixed.5.6.lin 7f0db9f5c000-7f0db9f5d000 rw-p 00016000 08:01 166844 /opt/alt/php56/usr/lib64/php/modules/ixed.5.6.lin 7f0db9f5d000-7f0db9f82000 r-xp 00000000 08:01 166842 /opt/alt/php56/usr/lib64/php/modules/opcache.so 7f0db9f82000-7f0dba181000 ---p 00025000 08:01 166842 /opt/alt/php56/usr/lib64/php/modules/opcache.so 7f0dba181000-7f0dba184000 rw-p 00024000 08:01 166842 /opt/alt/php56/usr/lib64/php/modules/opcache.so 7f0dba184000-7f0dba18d000 rw-p 00000000 00:00 0 7f0dba18d000-7f0dba2e6000 r-xp 00000000 08:01 166846 /opt/alt/php56/usr/lib64/php/ioncube/ioncube_loader_lin_5.6.so 7f0dba2e6000-7f0dba3e6000 ---p 00159000 08:01 166846 /opt/alt/php56/usr/lib64/php/ioncube/ioncube_loader_lin_5.6.so 7f0dba3e6000-7f0dba3f5000 rw-p 00159000 08:01 166846 /opt/alt/php56/usr/lib64/php/ioncube/ioncube_loader_lin_5.6.so 7f0dba3f5000-7f0dba3f8000 rw-p 00000000 00:00 0 7f0dba3f8000-7f0dba415000 r-xp 00000000 08:01 532332 /lib64/libselinux.so.1 7f0dba415000-7f0dba614000 ---p 0001d000 08:01 532332 /lib64/libselinux.so.1 7f0dba614000-7f0dba615000 r--p 0001c000 08:01 532332 /lib64/libselinux.so.1 7f0dba615000-7f0dba616000 rw-p 0001d000 08:01 532332 /lib64/libselinux.so.1 7f0dba616000-7f0dba617000 rw-p 00000000 00:00 0 7f0dba617000-7f0dba650000 r-xp 00000000 08:01 555690 /lib64/libnspr4.so 7f0dba650000-7f0dba850000 ---p 00039000 08:01 555690 /lib64/libnspr4.so 7f0dba850000-7f0dba851000 r--p 00039000 08:01 555690 /lib64/libnspr4.so 7f0dba851000-7f0dba853000 rw-p 0003a000 08:01 555690 /lib64/libnspr4.so 7f0dba853000-7f0dba855000 rw-p 00000000 00:00 0 7f0dba855000-7f0dba859000 r-xp 00000000 08:01 555691 /lib64/libplc4.so 7f0dba859000-7f0dbaa58000 ---p 00004000 08:01 555691 /lib64/libplc4.so 7f0dbaa58000-7f0dbaa59000 r--p 00003000 08:01 555691 /lib64/libplc4.so 7f0dbaa59000-7f0dbaa5a000 rw-p 00004000 08:01 555691 /lib64/libplc4.so 7f0dbaa5a000-7f0dbaa5d000 r-xp 00000000 08:01 555692 /lib64/libplds4.so 7f0dbaa5d000-7f0dbac5c000 ---p 00003000 08:01 555692 /lib64/libplds4.so 7f0dbac5c000-7f0dbac5d000 r--p 00002000 08:01 555692 /lib64/libplds4.so 7f0dbac5d000-7f0dbac5e000 rw-p 00003000 08:01 555692 /lib64/libplds4.so 7f0dbac5e000-7f0dbac84000 r-xp 00000000 08:07 4461671 /usr/lib64/libnssutil3.so 7f0dbac84000-7f0dbae83000 ---p 00026000 08:07 4461671 /usr/lib64/libnssutil3.so 7f0dbae83000-7f0dbae8a000 r--p 00025000 08:07 4461671 /usr/lib64/libnssutil3.so 7f0dbae8a000-7f0dbae8b000 rw-p 0002c000 08:07 4461671 /usr/lib64/libnssutil3.so 7f0dbae8b000-7f0dbafc5000 r-xp 00000000 08:07 4456721 /usr/lib64/libnss3.so 7f0dbafc5000-7f0dbb1c4000 ---p 0013a000 08:07 4456721 /usr/lib64/libnss3.so 7f0dbb1c4000-7f0dbb1ca000 r--p 00139000 08:07 4456721 /usr/lib64/libnss3.so 7f0dbb1ca000-7f0dbb1cc000 rw-p 0013f000 08:07 4456721 /usr/lib64/libnss3.so 7f0dbb1cc000-7f0dbb1ce000 rw-p 00000000 00:00 0 7f0dbb1ce000-7f0dbb1f6000 r-xp 00000000 08:07 4460430 /usr/lib64/libsmime3.so 7f0dbb1f6000-7f0dbb3f5000 ---p 00028000 08:07 4460430 /usr/lib64/libsmime3.so 7f0dbb3f5000-7f0dbb3f9000 r--p 00027000 08:07 4460430 /usr/lib64/libsmime3.so 7f0dbb3f9000-7f0dbb3fa000 rw-p 0002b000 08:07 4460430 /usr/lib64/libsmime3.so 7f0dbb3fa000-7f0dbb441000 r-xp 00000000 08:07 4461312 /usr/lib64/libssl3.so 7f0dbb441000-7f0dbb641000 ---p 00047000 08:07 4461312 /usr/lib64/libssl3.so 7f0dbb641000-7f0dbb645000 r--p 00047000 08:07 4461312 /usr/lib64/libssl3.so 7f0dbb645000-7f0dbb646000 rw-p 0004b000 08:07 4461312 /usr/lib64/libssl3.so 7f0dbb646000-7f0dbb647000 rw-p 00000000 00:00 0 7f0dbb647000-7f0dbb660000 r-xp 00000000 08:07 4457782 /usr/lib64/libsasl2.so.2.0.23 7f0dbb660000-7f0dbb85f000 ---p 00019000 08:07 4457782 /usr/lib64/libsasl2.so.2.0.23 7f0dbb85f000-7f0dbb860000 r--p 00018000 08:07 4457782 /usr/lib64/libsasl2.so.2.0.23 7f0dbb860000-7f0dbb861000 rw-p 00019000 08:07 4457782 /usr/lib64/libsasl2.so.2.0.23 7f0dbb861000-7f0dbb86f000 r-xp 00000000 08:01 533537 /lib64/liblber-2.4.so.2.10.3 7f0dbb86f000-7f0dbba6e000 ---p 0000e000 08:01 533537 /lib64/liblber-2.4.so.2.10.3 7f0dbba6e000-7f0dbba6f000 r--p 0000d000 08:01 533537 /lib64/liblber-2.4.so.2.10.3 7f0dbba6f000-7f0dbba70000 rw-p 0000e000 08:01 533537 /lib64/liblber-2.4.so.2.10.3 7f0dbba70000-7f0dbba72000 r-xp 00000000 08:01 524416 /lib64/libkeyutils.so.1.3 7f0dbba72000-7f0dbbc71000 ---p 00002000 08:01 524416 /lib64/libkeyutils.so.1.3 7f0dbbc71000-7f0dbbc72000 r--p 00001000 08:01 524416 /lib64/libkeyutils.so.1.3 7f0dbbc72000-7f0dbbc73000 rw-p 00002000 08:01 524416 /lib64/libkeyutils.so.1.3 7f0dbbc73000-7f0dbbc7d000 r-xp 00000000 08:01 555689 /lib64/libkrb5support.so.0.1 7f0dbbc7d000-7f0dbbe7c000 ---p 0000a000 08:01 555689 /lib64/libkrb5support.so.0.1 7f0dbbe7c000-7f0dbbe7d000 r--p 00009000 08:01 555689 /lib64/libkrb5support.so.0.1 7f0dbbe7d000-7f0dbbe7e000 rw-p 0000a000 08:01 555689 /lib64/libkrb5support.so.0.1 7f0dbbe7e000-7f0dbbe95000 r-xp 00000000 08:01 532338 /lib64/libpthread-2.12.so 7f0dbbe95000-7f0dbc095000 ---p 00017000 08:01 532338 /lib64/libpthread-2.12.so 7f0dbc095000-7f0dbc096000 r--p 00017000 08:01 532338 /lib64/libpthread-2.12.so 7f0dbc096000-7f0dbc097000 rw-p 00018000 08:01 532338 /lib64/libpthread-2.12.so 7f0dbc097000-7f0dbc09b000 rw-p 00000000 00:00 0 7f0dbc09b000-7f0dbc0e9000 r-xp 00000000 08:01 555731 /lib64/libldap-2.4.so.2.10.3 7f0dbc0e9000-7f0dbc2e8000 ---p 0004e000 08:01 555731 /lib64/libldap-2.4.so.2.10.3 7f0dbc2e8000-7f0dbc2ea000 r--p 0004d000 08:01 555731 /lib64/libldap-2.4.so.2.10.3 7f0dbc2ea000-7f0dbc2ec000 rw-p 0004f000 08:01 555731 /lib64/libldap-2.4.so.2.10.3 7f0dbc2ec000-7f0dbc317000 r-xp 00000000 08:01 159954 /opt/alt/libssh2/usr/lib64/libssh2.so.1.0.1 7f0dbc317000-7f0dbc516000 ---p 0002b000 08:01 159954 /opt/alt/libssh2/usr/lib64/libssh2.so.1.0.1 7f0dbc516000-7f0dbc518000 rw-p 0002a000 08:01 159954 /opt/alt/libssh2/usr/lib64/libssh2.so.1.0.1 7f0dbc518000-7f0dbc53b000 r-xp 00000000 08:07 4464328

• 

  cPanelMichael

  • August 29, 2017 14:57

  Hello, You can find discussion of this topic on the following threads: Suspicious process running under user Suspicious process running under lfd suspicious process /usr/bin/php Thank you.

  0

Please sign in to leave a comment.