File: /home/golnoor/mail/golnoor.com/root/cur/1668105746.M469187P29713.vps.golnoor.com,S=9811,W=9957:2,
Return-Path: <root@vps.golnoor.com>
Delivered-To: root@golnoor.com
Received: from vps.golnoor.com
by vps.golnoor.com with LMTP
id GOVGGxJGbWMRdAAA/P5FDA
(envelope-from <root@vps.golnoor.com>)
for <root@golnoor.com>; Thu, 10 Nov 2022 22:12:26 +0330
Return-path: <root@vps.golnoor.com>
Envelope-to: root@vps.golnoor.com
Delivery-date: Thu, 10 Nov 2022 22:12:26 +0330
Received: from root by vps.golnoor.com with local (Exim 4.95)
(envelope-from <root@vps.golnoor.com>)
id 1otCVH-0007jU-MS
for root@vps.golnoor.com;
Thu, 10 Nov 2022 22:12:19 +0330
To: root@vps.golnoor.com
Subject: lfd on vps.golnoor.com: Suspicious process running under user dovecot
From: <root@vps.golnoor.com>
Message-Id: <E1otCVH-0007jU-MS@vps.golnoor.com>
Date: Thu, 10 Nov 2022 22:12:19 +0330
X-YourOrg-MailScanner-Information: Please contact the ISP for more information
X-YourOrg-MailScanner-ID: 1otCVH-0007jU-MS
X-YourOrg-MailScanner: Found to be clean
X-YourOrg-MailScanner-SpamCheck: not spam, SpamAssassin (not cached,
score=0.811, required 5, DKIM_ADSP_NXDOMAIN 0.80,
KAM_DMARC_STATUS 0.01, URIBL_BLOCKED 0.00)
X-YourOrg-MailScanner-From: root@vps.golnoor.com
X-Spam-Status: No
Time: Thu Nov 10 22:12:19 2022 +0330
PID: 29363 (Parent PID:21241)
Account: dovecot
Uptime: 250 seconds
Executable:
/usr/libexec/dovecot/auth
Command Line (often faked in exploits):
dovecot/auth
Network connections by the process (if any):
tcp: 127.0.0.1:48096 -> 127.0.0.1:579
Files open by the process (if any):
/dev/null
/dev/urandom
/dev/null
anon_inode:[eventpoll]
/run/dovecot/old-stats-user
Memory maps by the process (if any):
5611e436e000-5611e43cd000 r-xp 00000000 fd:00 1053332 /usr/libexec/dovecot/auth
5611e45cd000-5611e45d0000 r--p 0005f000 fd:00 1053332 /usr/libexec/dovecot/auth
5611e45d0000-5611e45d2000 rw-p 00062000 fd:00 1053332 /usr/libexec/dovecot/auth
5611e5740000-5611e57a6000 rw-p 00000000 00:00 0 [heap]
7fc263238000-7fc26324f000 r-xp 00000000 fd:00 4122 /usr/lib64/libpthread-2.17.so
7fc26324f000-7fc26344e000 ---p 00017000 fd:00 4122 /usr/lib64/libpthread-2.17.so
7fc26344e000-7fc26344f000 r--p 00016000 fd:00 4122 /usr/lib64/libpthread-2.17.so
7fc26344f000-7fc263450000 rw-p 00017000 fd:00 4122 /usr/lib64/libpthread-2.17.so
7fc263450000-7fc263454000 rw-p 00000000 00:00 0
7fc263454000-7fc263555000 r-xp 00000000 fd:00 3417 /usr/lib64/libm-2.17.so
7fc263555000-7fc263754000 ---p 00101000 fd:00 3417 /usr/lib64/libm-2.17.so
7fc263754000-7fc263755000 r--p 00100000 fd:00 3417 /usr/lib64/libm-2.17.so
7fc263755000-7fc263756000 rw-p 00101000 fd:00 3417 /usr/lib64/libm-2.17.so
7fc263756000-7fc26376b000 r-xp 00000000 fd:00 4597 /usr/lib64/libz.so.1.2.7
7fc26376b000-7fc26396a000 ---p 00015000 fd:00 4597 /usr/lib64/libz.so.1.2.7
7fc26396a000-7fc26396b000 r--p 00014000 fd:00 4597 /usr/lib64/libz.so.1.2.7
7fc26396b000-7fc26396c000 rw-p 00015000 fd:00 4597 /usr/lib64/libz.so.1.2.7
7fc26396c000-7fc263a82000 r-xp 00000000 fd:00 1054216 /usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0.8.6
7fc263a82000-7fc263c82000 ---p 00116000 fd:00 1054216 /usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0.8.6
7fc263c82000-7fc263c85000 r--p 00116000 fd:00 1054216 /usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0.8.6
7fc263c85000-7fc263c88000 rw-p 00119000 fd:00 1054216 /usr/local/cpanel/3rdparty/lib64/libsqlite3.so.0.8.6
7fc263c88000-7fc263c89000 rw-p 00000000 00:00 0
7fc263c89000-7fc263c8d000 r-xp 00000000 fd:00 398629 /usr/lib64/dovecot/libdriver_sqlite.so
7fc263c8d000-7fc263e8c000 ---p 00004000 fd:00 398629 /usr/lib64/dovecot/libdriver_sqlite.so
7fc263e8c000-7fc263e8d000 r--p 00003000 fd:00 398629 /usr/lib64/dovecot/libdriver_sqlite.so
7fc263e8d000-7fc263e8e000 rw-p 00004000 fd:00 398629 /usr/lib64/dovecot/libdriver_sqlite.so
7fc263e8e000-7fc263e91000 r-xp 00000000 fd:00 394015 /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so
7fc263e91000-7fc264090000 ---p 00003000 fd:00 394015 /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so
7fc264090000-7fc264091000 r--p 00002000 fd:00 394015 /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so
7fc264091000-7fc264092000 rw-p 00003000 fd:00 394015 /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so
7fc264092000-7fc26414a000 r-xp 00000000 fd:00 2558 /usr/lib64/libfreeblpriv3.so
7fc26414a000-7fc26434a000 ---p 000b8000 fd:00 2558 /usr/lib64/libfreeblpriv3.so
7fc26434a000-7fc26434c000 r--p 000b8000 fd:00 2558 /usr/lib64/libfreeblpriv3.so
7fc26434c000-7fc26434d000 rw-p 000ba000 fd:00 2558 /usr/lib64/libfreeblpriv3.so
7fc26434d000-7fc264351000 rw-p 00000000 00:00 0
7fc264351000-7fc264355000 r-xp 00000000 fd:00 5210 /usr/lib64/libcap-ng.so.0.0.0
7fc264355000-7fc264555000 ---p 00004000 fd:00 5210 /usr/lib64/libcap-ng.so.0.0.0
7fc264555000-7fc264556000 r--p 00004000 fd:00 5210 /usr/lib64/libcap-ng.so.0.0.0
7fc264556000-7fc264557000 rw-p 00005000 fd:00 5210 /usr/lib64/libcap-ng.so.0.0.0
7fc264557000-7fc264575000 r-xp 00000000 fd:00 5213 /usr/lib64/libaudit.so.1.0.0
7fc264575000-7fc264774000 ---p 0001e000 fd:00 5213 /usr/lib64/libaudit.so.1.0.0
7fc264774000-7fc264775000 r--p 0001d000 fd:00 5213 /usr/lib64/libaudit.so.1.0.0
7fc264775000-7fc264776000 rw-p 0001e000 fd:00 5213 /usr/lib64/libaudit.so.1.0.0
7fc264776000-7fc264780000 rw-p 00000000 00:00 0
7fc264780000-7fc264782000 r-xp 00000000 fd:00 2556 /usr/lib64/libfreebl3.so
7fc264782000-7fc264981000 ---p 00002000 fd:00 2556 /usr/lib64/libfreebl3.so
7fc264981000-7fc264982000 r--p 00001000 fd:00 2556 /usr/lib64/libfreebl3.so
7fc264982000-7fc264983000 rw-p 00002000 fd:00 2556 /usr/lib64/libfreebl3.so
7fc264983000-7fc264b47000 r-xp 00000000 fd:00 3407 /usr/lib64/libc-2.17.so
7fc264b47000-7fc264d46000 ---p 001c4000 fd:00 3407 /usr/lib64/libc-2.17.so
7fc264d46000-7fc264d4a000 r--p 001c3000 fd:00 3407 /usr/lib64/libc-2.17.so
7fc264d4a000-7fc264d4c000 rw-p 001c7000 fd:00 3407 /usr/lib64/libc-2.17.so
7fc264d4c000-7fc264d51000 rw-p 00000000 00:00 0
7fc264d51000-7fc264d5e000 r-xp 00000000 fd:00 5729 /usr/lib64/libpam.so.0.83.1
7fc264d5e000-7fc264f5e000 ---p 0000d000 fd:00 5729 /usr/lib64/libpam.so.0.83.1
7fc264f5e000-7fc264f5f000 r--p 0000d000 fd:00 5729 /usr/lib64/libpam.so.0.83.1
7fc264f5f000-7fc264f60000 rw-p 0000e000 fd:00 5729 /usr/lib64/libpam.so.0.83.1
7fc264f60000-7fc264f68000 r-xp 00000000 fd:00 3411 /usr/lib64/libcrypt-2.17.so
7fc264f68000-7fc265167000 ---p 00008000 fd:00 3411 /usr/lib64/libcrypt-2.17.so
7fc265167000-7fc265168000 r--p 00007000 fd:00 3411 /usr/lib64/libcrypt-2.17.so
7fc265168000-7fc265169000 rw-p 00008000 fd:00 3411 /usr/lib64/libcrypt-2.17.so
7fc265169000-7fc265197000 rw-p 00000000 00:00 0
7fc265197000-7fc265199000 r-xp 00000000 fd:00 3415 /usr/lib64/libdl-2.17.so
7fc265199000-7fc265399000 ---p 00002000 fd:00 3415 /usr/lib64/libdl-2.17.so
7fc265399000-7fc26539a000 r--p 00002000 fd:00 3415 /usr/lib64/libdl-2.17.so
7fc26539a000-7fc26539b000 rw-p 00003000 fd:00 3415 /usr/lib64/libdl-2.17.so
7fc26539b000-7fc26554f000 r-xp 00000000 fd:00 398624 /usr/lib64/dovecot/libdovecot.so.0.0.0
7fc26554f000-7fc26574e000 ---p 001b4000 fd:00 398624 /usr/lib64/dovecot/libdovecot.so.0.0.0
7fc26574e000-7fc265757000 r--p 001b3000 fd:00 398624 /usr/lib64/dovecot/libdovecot.so.0.0.0
7fc265757000-7fc265759000 rw-p 001bc000 fd:00 398624 /usr/lib64/dovecot/libdovecot.so.0.0.0
7fc265759000-7fc26575c000 rw-p 00000000 00:00 0
7fc26575c000-7fc26575d000 r-xp 00000000 fd:00 398653 /usr/lib64/dovecot/old-stats/libstats_auth.so
7fc26575d000-7fc26595d000 ---p 00001000 fd:00 398653 /usr/lib64/dovecot/old-stats/libstats_auth.so
7fc26595d000-7fc26595e000 r--p 00001000 fd:00 398653 /usr/lib64/dovecot/old-stats/libstats_auth.so
7fc26595e000-7fc26595f000 rw-p 00002000 fd:00 398653 /usr/lib64/dovecot/old-stats/libstats_auth.so
7fc26595f000-7fc265981000 r-xp 00000000 fd:00 3400 /usr/lib64/ld-2.17.so
7fc265b6e000-7fc265b73000 rw-p 00000000 00:00 0
7fc265b7e000-7fc265b80000 rw-p 00000000 00:00 0
7fc265b80000-7fc265b81000 r--p 00021000 fd:00 3400 /usr/lib64/ld-2.17.so
7fc265b81000-7fc265b82000 rw-p 00022000 fd:00 3400 /usr/lib64/ld-2.17.so
7fc265b82000-7fc265b83000 rw-p 00000000 00:00 0
7fff75f8e000-7fff75faf000 rw-p 00000000 00:00 0 [stack]
7fff75fdc000-7fff75fde000 r-xp 00000000 00:00 0 [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]