File: /home/golnoor/mail/golnoor.com/root/cur/1668096977.M436982P20288.vps.golnoor.com,S=9811,W=9957:2,
Return-Path: <root@vps.golnoor.com>
Delivered-To: root@golnoor.com
Received: from vps.golnoor.com
by vps.golnoor.com with LMTP
id GGWRGdEjbWNATwAA/P5FDA
(envelope-from <root@vps.golnoor.com>)
for <root@golnoor.com>; Thu, 10 Nov 2022 19:46:17 +0330
Return-path: <root@vps.golnoor.com>
Envelope-to: root@vps.golnoor.com
Delivery-date: Thu, 10 Nov 2022 19:46:17 +0330
Received: from root by vps.golnoor.com with local (Exim 4.95)
(envelope-from <root@vps.golnoor.com>)
id 1otADr-0005I5-1g
for root@vps.golnoor.com;
Thu, 10 Nov 2022 19:46:11 +0330
To: root@vps.golnoor.com
Subject: lfd on vps.golnoor.com: Suspicious process running under user dovecot
From: <root@vps.golnoor.com>
Message-Id: <E1otADr-0005I5-1g@vps.golnoor.com>
Date: Thu, 10 Nov 2022 19:46:11 +0330
X-YourOrg-MailScanner-Information: Please contact the ISP for more information
X-YourOrg-MailScanner-ID: 1otADr-0005I5-1g
X-YourOrg-MailScanner: Found to be clean
X-YourOrg-MailScanner-SpamCheck: not spam, SpamAssassin (not cached,
score=0.811, required 5, DKIM_ADSP_NXDOMAIN 0.80,
KAM_DMARC_STATUS 0.01, URIBL_BLOCKED 0.00)
X-YourOrg-MailScanner-From: root@vps.golnoor.com
X-Spam-Status: No
Time: Thu Nov 10 19:46:11 2022 +0330
PID: 18929 (Parent PID:21241)
Account: dovecot
Uptime: 970 seconds
Executable:
/usr/libexec/dovecot/auth
Command Line (often faked in exploits):
dovecot/auth
Network connections by the process (if any):
tcp: 127.0.0.1:40962 -> 127.0.0.1:579
Files open by the process (if any):
/dev/null
/dev/urandom
/dev/null
anon_inode:[eventpoll]
/run/dovecot/old-stats-user
Memory maps by the process (if any):
5639be799000-5639be7f8000 r-xp 00000000 fd:00 1053332 /usr/libexec/dovecot/auth
5639be9f8000-5639be9fb000 r--p 0005f000 fd:00 1053332 /usr/libexec/dovecot/auth
5639be9fb000-5639be9fd000 rw-p 00062000 fd:00 1053332 /usr/libexec/dovecot/auth
5639bf6d5000-5639bf735000 rw-p 00000000 00:00 0 [heap]
7f0cd1fdb000-7f0cd1ff2000 r-xp 00000000 fd:00 4122 /usr/lib64/libpthread-2.17.so
7f0cd1ff2000-7f0cd21f1000 ---p 00017000 fd:00 4122 /usr/lib64/libpthread-2.17.so
7f0cd21f1000-7f0cd21f2000 r--p 00016000 fd:00 4122 /usr/lib64/libpthread-2.17.so
7f0cd21f2000-7f0cd21f3000 rw-p 00017000 fd:00 4122 /usr/lib64/libpthread-2.17.so
7f0cd21f3000-7f0cd21f7000 rw-p 00000000 00:00 0
7f0cd21f7000-7f0cd22f8000 r-xp 00000000 fd:00 3417 /usr/lib64/libm-2.17.so
7f0cd22f8000-7f0cd24f7000 ---p 00101000 fd:00 3417 /usr/lib64/libm-2.17.so
7f0cd24f7000-7f0cd24f8000 r--p 00100000 fd:00 3417 /usr/lib64/libm-2.17.so
7f0cd24f8000-7f0cd24f9000 rw-p 00101000 fd:00 3417 /usr/lib64/libm-2.17.so
7f0cd24f9000-7f0cd250e000 r-xp 00000000 fd:00 4597 /usr/lib64/libz.so.1.2.7
7f0cd250e000-7f0cd270d000 ---p 00015000 fd:00 4597 /usr/lib64/libz.so.1.2.7
7f0cd270d000-7f0cd270e000 r--p 00014000 fd:00 4597 /usr/lib64/libz.so.1.2.7
7f0cd270e000-7f0cd270f000 rw-p 00015000 fd:00 4597 /usr/lib64/libz.so.1.2.7
7f0cd270f000-7f0cd2825000 r-xp 00000000 fd:00 1054216 /usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0.8.6
7f0cd2825000-7f0cd2a25000 ---p 00116000 fd:00 1054216 /usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0.8.6
7f0cd2a25000-7f0cd2a28000 r--p 00116000 fd:00 1054216 /usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0.8.6
7f0cd2a28000-7f0cd2a2b000 rw-p 00119000 fd:00 1054216 /usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0.8.6
7f0cd2a2b000-7f0cd2a2c000 rw-p 00000000 00:00 0
7f0cd2a2c000-7f0cd2a30000 r-xp 00000000 fd:00 398629 /usr/lib64/dovecot/libdriver_sqlite.so
7f0cd2a30000-7f0cd2c2f000 ---p 00004000 fd:00 398629 /usr/lib64/dovecot/libdriver_sqlite.so
7f0cd2c2f000-7f0cd2c30000 r--p 00003000 fd:00 398629 /usr/lib64/dovecot/libdriver_sqlite.so
7f0cd2c30000-7f0cd2c31000 rw-p 00004000 fd:00 398629 /usr/lib64/dovecot/libdriver_sqlite.so
7f0cd2c31000-7f0cd2c34000 r-xp 00000000 fd:00 394015 /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so
7f0cd2c34000-7f0cd2e33000 ---p 00003000 fd:00 394015 /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so
7f0cd2e33000-7f0cd2e34000 r--p 00002000 fd:00 394015 /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so
7f0cd2e34000-7f0cd2e35000 rw-p 00003000 fd:00 394015 /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so
7f0cd2e35000-7f0cd2eed000 r-xp 00000000 fd:00 2558 /usr/lib64/libfreeblpriv3.so
7f0cd2eed000-7f0cd30ed000 ---p 000b8000 fd:00 2558 /usr/lib64/libfreeblpriv3.so
7f0cd30ed000-7f0cd30ef000 r--p 000b8000 fd:00 2558 /usr/lib64/libfreeblpriv3.so
7f0cd30ef000-7f0cd30f0000 rw-p 000ba000 fd:00 2558 /usr/lib64/libfreeblpriv3.so
7f0cd30f0000-7f0cd30f4000 rw-p 00000000 00:00 0
7f0cd30f4000-7f0cd30f8000 r-xp 00000000 fd:00 5210 /usr/lib64/libcap-ng.so.0.0.0
7f0cd30f8000-7f0cd32f8000 ---p 00004000 fd:00 5210 /usr/lib64/libcap-ng.so.0.0.0
7f0cd32f8000-7f0cd32f9000 r--p 00004000 fd:00 5210 /usr/lib64/libcap-ng.so.0.0.0
7f0cd32f9000-7f0cd32fa000 rw-p 00005000 fd:00 5210 /usr/lib64/libcap-ng.so.0.0.0
7f0cd32fa000-7f0cd3318000 r-xp 00000000 fd:00 5213 /usr/lib64/libaudit.so.1.0.0
7f0cd3318000-7f0cd3517000 ---p 0001e000 fd:00 5213 /usr/lib64/libaudit.so.1.0.0
7f0cd3517000-7f0cd3518000 r--p 0001d000 fd:00 5213 /usr/lib64/libaudit.so.1.0.0
7f0cd3518000-7f0cd3519000 rw-p 0001e000 fd:00 5213 /usr/lib64/libaudit.so.1.0.0
7f0cd3519000-7f0cd3523000 rw-p 00000000 00:00 0
7f0cd3523000-7f0cd3525000 r-xp 00000000 fd:00 2556 /usr/lib64/libfreebl3.so
7f0cd3525000-7f0cd3724000 ---p 00002000 fd:00 2556 /usr/lib64/libfreebl3.so
7f0cd3724000-7f0cd3725000 r--p 00001000 fd:00 2556 /usr/lib64/libfreebl3.so
7f0cd3725000-7f0cd3726000 rw-p 00002000 fd:00 2556 /usr/lib64/libfreebl3.so
7f0cd3726000-7f0cd38ea000 r-xp 00000000 fd:00 3407 /usr/lib64/libc-2.17.so
7f0cd38ea000-7f0cd3ae9000 ---p 001c4000 fd:00 3407 /usr/lib64/libc-2.17.so
7f0cd3ae9000-7f0cd3aed000 r--p 001c3000 fd:00 3407 /usr/lib64/libc-2.17.so
7f0cd3aed000-7f0cd3aef000 rw-p 001c7000 fd:00 3407 /usr/lib64/libc-2.17.so
7f0cd3aef000-7f0cd3af4000 rw-p 00000000 00:00 0
7f0cd3af4000-7f0cd3b01000 r-xp 00000000 fd:00 5729 /usr/lib64/libpam.so.0.83.1
7f0cd3b01000-7f0cd3d01000 ---p 0000d000 fd:00 5729 /usr/lib64/libpam.so.0.83.1
7f0cd3d01000-7f0cd3d02000 r--p 0000d000 fd:00 5729 /usr/lib64/libpam.so.0.83.1
7f0cd3d02000-7f0cd3d03000 rw-p 0000e000 fd:00 5729 /usr/lib64/libpam.so.0.83.1
7f0cd3d03000-7f0cd3d0b000 r-xp 00000000 fd:00 3411 /usr/lib64/libcrypt-2.17.so
7f0cd3d0b000-7f0cd3f0a000 ---p 00008000 fd:00 3411 /usr/lib64/libcrypt-2.17.so
7f0cd3f0a000-7f0cd3f0b000 r--p 00007000 fd:00 3411 /usr/lib64/libcrypt-2.17.so
7f0cd3f0b000-7f0cd3f0c000 rw-p 00008000 fd:00 3411 /usr/lib64/libcrypt-2.17.so
7f0cd3f0c000-7f0cd3f3a000 rw-p 00000000 00:00 0
7f0cd3f3a000-7f0cd3f3c000 r-xp 00000000 fd:00 3415 /usr/lib64/libdl-2.17.so
7f0cd3f3c000-7f0cd413c000 ---p 00002000 fd:00 3415 /usr/lib64/libdl-2.17.so
7f0cd413c000-7f0cd413d000 r--p 00002000 fd:00 3415 /usr/lib64/libdl-2.17.so
7f0cd413d000-7f0cd413e000 rw-p 00003000 fd:00 3415 /usr/lib64/libdl-2.17.so
7f0cd413e000-7f0cd42f2000 r-xp 00000000 fd:00 398624 /usr/lib64/dovecot/libdovecot.so.0.0.0
7f0cd42f2000-7f0cd44f1000 ---p 001b4000 fd:00 398624 /usr/lib64/dovecot/libdovecot.so.0.0.0
7f0cd44f1000-7f0cd44fa000 r--p 001b3000 fd:00 398624 /usr/lib64/dovecot/libdovecot.so.0.0.0
7f0cd44fa000-7f0cd44fc000 rw-p 001bc000 fd:00 398624 /usr/lib64/dovecot/libdovecot.so.0.0.0
7f0cd44fc000-7f0cd44ff000 rw-p 00000000 00:00 0
7f0cd44ff000-7f0cd4500000 r-xp 00000000 fd:00 398653 /usr/lib64/dovecot/old-stats/libstats_auth.so
7f0cd4500000-7f0cd4700000 ---p 00001000 fd:00 398653 /usr/lib64/dovecot/old-stats/libstats_auth.so
7f0cd4700000-7f0cd4701000 r--p 00001000 fd:00 398653 /usr/lib64/dovecot/old-stats/libstats_auth.so
7f0cd4701000-7f0cd4702000 rw-p 00002000 fd:00 398653 /usr/lib64/dovecot/old-stats/libstats_auth.so
7f0cd4702000-7f0cd4724000 r-xp 00000000 fd:00 3400 /usr/lib64/ld-2.17.so
7f0cd4911000-7f0cd4916000 rw-p 00000000 00:00 0
7f0cd4921000-7f0cd4923000 rw-p 00000000 00:00 0
7f0cd4923000-7f0cd4924000 r--p 00021000 fd:00 3400 /usr/lib64/ld-2.17.so
7f0cd4924000-7f0cd4925000 rw-p 00022000 fd:00 3400 /usr/lib64/ld-2.17.so
7f0cd4925000-7f0cd4926000 rw-p 00000000 00:00 0
7ffdd6a36000-7ffdd6a57000 rw-p 00000000 00:00 0 [stack]
7ffdd6b45000-7ffdd6b47000 r-xp 00000000 00:00 0 [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]