Moodle in English: Moodle cron jobs detect as suspicious activity

Moodle cron jobs detect as suspicious activity

by Jasim Peringattuthodi - Wednesday, December 23, 2020, 4:14 AM

Recently I am getting suspicious process running warning from my cPanel server and while looking in to the details found there there is a cron process connecting from my server to one of the moodle server 104.22.65.81

screen shot

server details

The memory maps by process list is very huge

is it natural or any suspicious expected?

Can any one help me to sort it out this issue. this IP used for which purpose

This is the staging site and i am having production site also in the same server which is not creating any such messages/ mails

Many thanks for all your support

Re: Moodle cron jobs detect as suspicious activity

by Ken Task - Wednesday, December 23, 2020, 5:58 AM

The IP addresses shown 104.22.65.81 and 172.67.25.233 are CloudFlare IP addresses ... not the real IP address of your server.

CloudFlare is used as a content delivery network (large cache) and WAF.

It does the above via DNS 'trickery'.

'SoS', Ken

Average of ratings: -

Re: Moodle cron jobs detect as suspicious activity

by Jasim Peringattuthodi - Wednesday, December 23, 2020, 5:35 PM

Thank you Ken Task
Actually as posted in the screen shot my server (192.168.10.58) is connecting to 104.22.65.81 ( 192.168.10.58: 51858 -> 104.22.65.81:443 )

But my doubt is why this cron process detect as suspicious activity and only my staging host

is there is some thing suspicious?

Executable:

/opt/cpanel/ea-php72/root/usr/bin/php

Command Line (often faked in exploits):

/opt/cpanel/ea-php72/root/usr/bin/php /home/smartlmsstg/public_html/en/admin/cli/cron.php

Files open by the process :

/dev/null
/home/smartlmsstg/moodledata/localcache/2e638ba8-8841-4ee2-862f-b35ac14d49c1/a3fb99f0-95dd-42a1-91eb-fb34602c92e1/task.log

below is the full memory maps by process

Memory maps by the process :

00400000-0073e000 r-xp 00000000 fd:03 134310296 /opt/cpanel/ea-php72/root/usr/bin/php
0093e000-009b4000 r--p 0033e000 fd:03 134310296 /opt/cpanel/ea-php72/root/usr/bin/php
009b4000-009d0000 rw-p 003b4000 fd:03 134310296 /opt/cpanel/ea-php72/root/usr/bin/php
009d0000-009ed000 rw-p 00000000 00:00 0
00ee5000-01282000 rw-p 00000000 00:00 0 [heap]
7fdd04000000-7fdd04021000 rw-p 00000000 00:00 0
7fdd04021000-7fdd08000000 ---p 00000000 00:00 0
7fdd0bbff000-7fdd0bc00000 ---p 00000000 00:00 0
7fdd0bc00000-7fdd0da00000 rw-p 00000000 00:00 0
7fdd0db6c000-7fdd0db7e000 r-xp 00000000 fd:03 2182196 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/xmlrpc.so
7fdd0db7e000-7fdd0dd7e000 ---p 00012000 fd:03 2182196 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/xmlrpc.so
7fdd0dd7e000-7fdd0dd7f000 r--p 00012000 fd:03 2182196 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/xmlrpc.so
7fdd0dd7f000-7fdd0dd80000 rw-p 00013000 fd:03 2182196 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/xmlrpc.so
7fdd0dd80000-7fdd0dd87000 r-xp 00000000 fd:03 1784583 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/xmlreader.so
7fdd0dd87000-7fdd0df86000 ---p 00007000 fd:03 1784583 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/xmlreader.so
7fdd0df86000-7fdd0df87000 r--p 00006000 fd:03 1784583 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/xmlreader.so
7fdd0df87000-7fdd0df88000 rw-p 00007000 fd:03 1784583 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/xmlreader.so
7fdd0df88000-7fdd0df8f000 r-xp 00000000 fd:03 1784565 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/wddx.so
7fdd0df8f000-7fdd0e18e000 ---p 00007000 fd:03 1784565 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/wddx.so
7fdd0e18e000-7fdd0e18f000 r--p 00006000 fd:03 1784565 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/wddx.so
7fdd0e18f000-7fdd0e190000 rw-p 00007000 fd:03 1784565 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/wddx.so
7fdd0e190000-7fdd0e196000 r-xp 00000000 fd:03 1908333 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/pdo_sqlite.so
7fdd0e196000-7fdd0e395000 ---p 00006000 fd:03 1908333 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/pdo_sqlite.so
7fdd0e395000-7fdd0e396000 r--p 00005000 fd:03 1908333 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/pdo_sqlite.so
7fdd0e396000-7fdd0e397000 rw-p 00006000 fd:03 1908333 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/pdo_sqlite.so
7fdd0e397000-7fdd0e39d000 r-xp 00000000 fd:03 2182190 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/pdo_mysql.so
7fdd0e39d000-7fdd0e59d000 ---p 00006000 fd:03 2182190 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/pdo_mysql.so
7fdd0e59d000-7fdd0e59e000 r--p 00006000 fd:03 2182190 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/pdo_mysql.so
7fdd0e59e000-7fdd0e59f000 rw-p 00007000 fd:03 2182190 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/pdo_mysql.so
7fdd0e59f000-7fdd0e5bb000 r-xp 00000000 fd:03 1983699 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/mysqli.so
7fdd0e5bb000-7fdd0e7bb000 ---p 0001c000 fd:03 1983699 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/mysqli.so
7fdd0e7bb000-7fdd0e7bf000 r--p 0001c000 fd:03 1983699 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/mysqli.so
7fdd0e7bf000-7fdd0e7c0000 rw-p 00020000 fd:03 1983699 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/mysqli.so
7fdd0e7c0000-7fdd0e7df000 r-xp 00000000 fd:03 2182195 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/zip.so
7fdd0e7df000-7fdd0e9de000 ---p 0001f000 fd:03 2182195 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/zip.so
7fdd0e9de000-7fdd0e9e0000 r--p 0001e000 fd:03 2182195 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/zip.so
7fdd0e9e0000-7fdd0e9e1000 rw-p 00020000 fd:03 2182195 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/zip.so
7fdd0e9e1000-7fdd0e9e5000 r-xp 00000000 fd:03 33691653 /usr/lib64/libgpg-error.so.0.10.0
7fdd0e9e5000-7fdd0ebe4000 ---p 00004000 fd:03 33691653 /usr/lib64/libgpg-error.so.0.10.0
7fdd0ebe4000-7fdd0ebe5000 r--p 00003000 fd:03 33691653 /usr/lib64/libgpg-error.so.0.10.0
7fdd0ebe5000-7fdd0ebe6000 rw-p 00004000 fd:03 33691653 /usr/lib64/libgpg-error.so.0.10.0
7fdd0ebe6000-7fdd0ec63000 r-xp 00000000 fd:03 33691668 /usr/lib64/libgcrypt.so.11.8.2
7fdd0ec63000-7fdd0ee62000 ---p 0007d000 fd:03 33691668 /usr/lib64/libgcrypt.so.11.8.2
7fdd0ee62000-7fdd0ee63000 r--p 0007c000 fd:03 33691668 /usr/lib64/libgcrypt.so.11.8.2
7fdd0ee63000-7fdd0ee66000 rw-p 0007d000 fd:03 33691668 /usr/lib64/libgcrypt.so.11.8.2
7fdd0ee66000-7fdd0ee67000 rw-p 00000000 00:00 0
7fdd0ee67000-7fdd0eea3000 r-xp 00000000 fd:03 33662730 /usr/lib64/libxslt.so.1.1.28
7fdd0eea3000-7fdd0f0a3000 ---p 0003c000 fd:03 33662730 /usr/lib64/libxslt.so.1.1.28
7fdd0f0a3000-7fdd0f0a4000 r--p 0003c000 fd:03 33662730 /usr/lib64/libxslt.so.1.1.28
7fdd0f0a4000-7fdd0f0a5000 rw-p 0003d000 fd:03 33662730 /usr/lib64/libxslt.so.1.1.28
7fdd0f0a5000-7fdd0f0a6000 rw-p 00000000 00:00 0
7fdd0f0a6000-7fdd0f0ba000 r-xp 00000000 fd:03 33662728 /usr/lib64/libexslt.so.0.8.17
7fdd0f0ba000-7fdd0f2b9000 ---p 00014000 fd:03 33662728 /usr/lib64/libexslt.so.0.8.17
7fdd0f2b9000-7fdd0f2ba000 r--p 00013000 fd:03 33662728 /usr/lib64/libexslt.so.0.8.17
7fdd0f2ba000-7fdd0f2bb000 rw-p 00014000 fd:03 33662728 /usr/lib64/libexslt.so.0.8.17
7fdd0f2bb000-7fdd0f2c2000 r-xp 00000000 fd:03 1802302 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/xsl.so
7fdd0f2c2000-7fdd0f4c1000 ---p 00007000 fd:03 1802302 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/xsl.so
7fdd0f4c1000-7fdd0f4c2000 r--p 00006000 fd:03 1802302 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/xsl.so
7fdd0f4c2000-7fdd0f4c3000 rw-p 00007000 fd:03 1802302 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/xsl.so
7fdd0f4c3000-7fdd0f4cb000 r-xp 00000000 fd:03 1802283 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/xmlwriter.so
7fdd0f4cb000-7fdd0f6cb000 ---p 00008000 fd:03 1802283 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/xmlwriter.so
7fdd0f6cb000-7fdd0f6ce000 r--p 00008000 fd:03 1802283 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/xmlwriter.so
7fdd0f6ce000-7fdd0f6cf000 rw-p 0000b000 fd:03 1802283 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/xmlwriter.so
7fdd0f6cf000-7fdd0f6da000 r-xp 00000000 fd:03 1784566 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/xml.so
7fdd0f6da000-7fdd0f8d9000 ---p 0000b000 fd:03 1784566 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/xml.so
7fdd0f8d9000-7fdd0f8db000 r--p 0000a000 fd:03 1784566 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/xml.so
7fdd0f8db000-7fdd0f8dc000 rw-p 0000c000 fd:03 1784566 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/xml.so
7fdd0f8dc000-7fdd0f8e0000 r-xp 00000000 fd:03 1784561 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/tokenizer.so
7fdd0f8e0000-7fdd0fadf000 ---p 00004000 fd:03 1784561 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/tokenizer.so
7fdd0fadf000-7fdd0fae0000 r--p 00003000 fd:03 1784561 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/tokenizer.so
7fdd0fae0000-7fdd0fae1000 rw-p 00004000 fd:03 1784561 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/tokenizer.so
7fdd0fae1000-7fdd0fb92000 r-xp 00000000 fd:03 33662732 /usr/lib64/libsqlite3.so.0.8.6
7fdd0fb92000-7fdd0fd91000 ---p 000b1000 fd:03 33662732 /usr/lib64/libsqlite3.so.0.8.6
7fdd0fd91000-7fdd0fd93000 r--p 000b0000 fd:03 33662732 /usr/lib64/libsqlite3.so.0.8.6
7fdd0fd93000-7fdd0fd96000 rw-p 000b2000 fd:03 33662732 /usr/lib64/libsqlite3.so.0.8.6
7fdd0fd96000-7fdd0fda1000 r-xp 00000000 fd:03 1908335 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/sqlite3.so
7fdd0fda1000-7fdd0ffa1000 ---p 0000b000 fd:03 1908335 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/sqlite3.so
7fdd0ffa1000-7fdd0ffa2000 r--p 0000b000 fd:03 1908335 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/sqlite3.so
7fdd0ffa2000-7fdd0ffa3000 rw-p 0000c000 fd:03 1908335 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/sqlite3.so
7fdd0ffa3000-7fdd0ffb7000 r-xp 00000000 fd:03 2182204 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/sockets.so
7fdd0ffb7000-7fdd101b6000 ---p 00014000 fd:03 2182204 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/sockets.so
7fdd101b6000-7fdd101b8000 r--p 00013000 fd:03 2182204 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/sockets.so
7fdd101b8000-7fdd101b9000 rw-p 00015000 fd:03 2182204 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/sockets.so
7fdd101b9000-7fdd10202000 r-xp 00000000 fd:03 2182192 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/soap.so
7fdd10202000-7fdd10401000 ---p 00049000 fd:03 2182192 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/soap.so
7fdd10401000-7fdd10403000 r--p 00048000 fd:03 2182192 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/soap.so
7fdd10403000-7fdd10405000 rw-p 0004a000 fd:03 2182192 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/soap.so
7fdd10405000-7fdd10411000 r-xp 00000000 fd:03 1784564 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/simplexml.so
7fdd10411000-7fdd10611000 ---p 0000c000 fd:03 1784564 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/simplexml.so
7fdd10611000-7fdd10612000 r--p 0000c000 fd:03 1784564 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/simplexml.so
7fdd10612000-7fdd10613000 rw-p 0000d000 fd:03 1784564 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/simplexml.so
7fdd10613000-7fdd1061a000 r-xp 00000000 fd:03 1802306 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/posix.so
7fdd1061a000-7fdd1081a000 ---p 00007000 fd:03 1802306 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/posix.so
7fdd1081a000-7fdd1081b000 r--p 00007000 fd:03 1802306 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/posix.so
7fdd1081b000-7fdd1081c000 rw-p 00008000 fd:03 1802306 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/posix.so
7fdd1081c000-7fdd1085c000 r-xp 00000000 fd:03 1784560 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/phar.so
7fdd1085c000-7fdd10a5b000 ---p 00040000 fd:03 1784560 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/phar.so
7fdd10a5b000-7fdd10a5d000 r--p 0003f000 fd:03 1784560 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/phar.so
7fdd10a5d000-7fdd10a5f000 rw-p 00041000 fd:03 1784560 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/phar.so
7fdd10a5f000-7fdd10a77000 r-xp 00000000 fd:03 1802322 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/pdo.so
7fdd10a77000-7fdd10c77000 ---p 00018000 fd:03 1802322 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/pdo.so
7fdd10c77000-7fdd10c79000 r--p 00018000 fd:03 1802322 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/pdo.so
7fdd10c79000-7fdd10c7a000 rw-p 0001a000 fd:03 1802322 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/pdo.so
7fdd10c7a000-7fdd10cb3000 r-xp 00000000 fd:03 2182189 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/mysqlnd.so
7fdd10cb3000-7fdd10eb2000 ---p 00039000 fd:03 2182189 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/mysqlnd.so
7fdd10eb2000-7fdd10eb7000 r--p 00038000 fd:03 2182189 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/mysqlnd.so
7fdd10eb7000-7fdd10eb9000 rw-p 0003d000 fd:03 2182189 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/mysqlnd.so
7fdd10eb9000-7fdd10eba000 rw-p 00000000 00:00 0
7fdd10eba000-7fdd1102d000 r-xp 00000000 fd:03 2182200 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/mbstring.so
7fdd1102d000-7fdd1122c000 ---p 00173000 fd:03 2182200 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/mbstring.so
7fdd1122c000-7fdd1124a000 r--p 00172000 fd:03 2182200 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/mbstring.so
7fdd1124a000-7fdd11252000 rw-p 00190000 fd:03 2182200 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/mbstring.so
7fdd11252000-7fdd1125c000 r-xp 00000000 fd:03 1784559 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/json.so
7fdd1125c000-7fdd1145b000 ---p 0000a000 fd:03 1784559 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/json.so
7fdd1145b000-7fdd1145c000 r--p 00009000 fd:03 1784559 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/json.so
7fdd1145c000-7fdd1145d000 rw-p 0000a000 fd:03 1784559 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/json.so
7fdd1145d000-7fdd11469000 r-xp 00000000 fd:03 33681770 /usr/lib64/libicuio.so.50.2
7fdd11469000-7fdd11669000 ---p 0000c000 fd:03 33681770 /usr/lib64/libicuio.so.50.2
7fdd11669000-7fdd1166a000 r--p 0000c000 fd:03 33681770 /usr/lib64/libicuio.so.50.2
7fdd1166a000-7fdd1166b000 rw-p 0000d000 fd:03 33681770 /usr/lib64/libicuio.so.50.2
7fdd1166b000-7fdd12a3d000 r-xp 00000000 fd:03 33674109 /usr/lib64/libicudata.so.50.2
7fdd12a3d000-7fdd12c3c000 ---p 013d2000 fd:03 33674109 /usr/lib64/libicudata.so.50.2
7fdd12c3c000-7fdd12c3d000 r--p 013d1000 fd:03 33674109 /usr/lib64/libicudata.so.50.2
7fdd12c3d000-7fdd12c3e000 rw-p 013d2000 fd:03 33674109 /usr/lib64/libicudata.so.50.2
7fdd12c3e000-7fdd12da2000 r-xp 00000000 fd:03 33681784 /usr/lib64/libicuuc.so.50.2
7fdd12da2000-7fdd12fa2000 ---p 00164000 fd:03 33681784 /usr/lib64/libicuuc.so.50.2
7fdd12fa2000-7fdd12fb2000 r--p 00164000 fd:03 33681784 /usr/lib64/libicuuc.so.50.2
7fdd12fb2000-7fdd12fb3000 rw-p 00174000 fd:03 33681784 /usr/lib64/libicuuc.so.50.2
7fdd12fb3000-7fdd12fb7000 rw-p 00000000 00:00 0
7fdd12fb7000-7fdd131a7000 r-xp 00000000 fd:03 33674111 /usr/lib64/libicui18n.so.50.2
7fdd131a7000-7fdd133a7000 ---p 001f0000 fd:03 33674111 /usr/lib64/libicui18n.so.50.2
7fdd133a7000-7fdd133b3000 r--p 001f0000 fd:03 33674111 /usr/lib64/libicui18n.so.50.2
7fdd133b3000-7fdd133b5000 rw-p 001fc000 fd:03 33674111 /usr/lib64/libicui18n.so.50.2
7fdd133b5000-7fdd133b6000 rw-p 00000000 00:00 0
7fdd133b6000-7fdd1341e000 r-xp 00000000 fd:03 2182194 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/intl.so
7fdd1341e000-7fdd1361e000 ---p 00068000 fd:03 2182194 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/intl.so
7fdd1361e000-7fdd13625000 r--p 00068000 fd:03 2182194 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/intl.so
7fdd13625000-7fdd1362a000 rw-p 0006f000 fd:03 2182194 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/intl.so
7fdd1362a000-7fdd1362b000 rw-p 00000000 00:00 0
7fdd1362b000-7fdd1362f000 r-xp 00000000 fd:03 33691724 /usr/lib64/libcap-ng.so.0.0.0
7fdd1362f000-7fdd1382f000 ---p 00004000 fd:03 33691724 /usr/lib64/libcap-ng.so.0.0.0
7fdd1382f000-7fdd13830000 r--p 00004000 fd:03 33691724 /usr/lib64/libcap-ng.so.0.0.0
7fdd13830000-7fdd13831000 rw-p 00005000 fd:03 33691724 /usr/lib64/libcap-ng.so.0.0.0
7fdd13831000-7fdd1384f000 r-xp 00000000 fd:03 33691568 /usr/lib64/libaudit.so.1.0.0
7fdd1384f000-7fdd13a4e000 ---p 0001e000 fd:03 33691568 /usr/lib64/libaudit.so.1.0.0
7fdd13a4e000-7fdd13a4f000 r--p 0001d000 fd:03 33691568 /usr/lib64/libaudit.so.1.0.0
7fdd13a4f000-7fdd13a50000 rw-p 0001e000 fd:03 33691568 /usr/lib64/libaudit.so.1.0.0
7fdd13a50000-7fdd13a5a000 rw-p 00000000 00:00 0
7fdd13a5a000-7fdd13a67000 r-xp 00000000 fd:03 33620174 /usr/lib64/libpam.so.0.83.1
7fdd13a67000-7fdd13c67000 ---p 0000d000 fd:03 33620174 /usr/lib64/libpam.so.0.83.1
7fdd13c67000-7fdd13c68000 r--p 0000d000 fd:03 33620174 /usr/lib64/libpam.so.0.83.1
7fdd13c68000-7fdd13c69000 rw-p 0000e000 fd:03 33620174 /usr/lib64/libpam.so.0.83.1
7fdd13c69000-7fdd13d71000 r-xp 00000000 fd:03 167927013 /opt/cpanel/ea-php72/root/usr/lib64/libc-client.so.2007
7fdd13d71000-7fdd13f71000 ---p 00108000 fd:03 167927013 /opt/cpanel/ea-php72/root/usr/lib64/libc-client.so.2007
7fdd13f71000-7fdd13f73000 r--p 00108000 fd:03 167927013 /opt/cpanel/ea-php72/root/usr/lib64/libc-client.so.2007
7fdd13f73000-7fdd13f7c000 rw-p 0010a000 fd:03 167927013 /opt/cpanel/ea-php72/root/usr/lib64/libc-client.so.2007
7fdd13f7c000-7fdd13f7d000 rw-p 00000000 00:00 0
7fdd13f7d000-7fdd13f90000 r-xp 00000000 fd:03 2182198 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/imap.so
7fdd13f90000-7fdd14190000 ---p 00013000 fd:03 2182198 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/imap.so
7fdd14190000-7fdd14193000 r--p 00013000 fd:03 2182198 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/imap.so
7fdd14193000-7fdd14194000 rw-p 00016000 fd:03 2182198 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/imap.so
7fdd14194000-7fdd1419d000 r-xp 00000000 fd:03 2182203 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/iconv.so
7fdd1419d000-7fdd1439d000 ---p 00009000 fd:03 2182203 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/iconv.so
7fdd1439d000-7fdd1439e000 r--p 00009000 fd:03 2182203 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/iconv.so
7fdd1439e000-7fdd1439f000 rw-p 0000a000 fd:03 2182203 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/iconv.so
7fdd1439f000-7fdd143a1000 r-xp 00000000 fd:03 33833109 /usr/lib64/libXau.so.6.0.0
7fdd143a1000-7fdd145a1000 ---p 00002000 fd:03 33833109 /usr/lib64/libXau.so.6.0.0
7fdd145a1000-7fdd145a2000 r--p 00002000 fd:03 33833109 /usr/lib64/libXau.so.6.0.0
7fdd145a2000-7fdd145a3000 rw-p 00003000 fd:03 33833109 /usr/lib64/libXau.so.6.0.0
7fdd145a3000-7fdd145b2000 r-xp 00000000 fd:03 33632531 /usr/lib64/libbz2.so.1.0.6
7fdd145b2000-7fdd147b1000 ---p 0000f000 fd:03 33632531 /usr/lib64/libbz2.so.1.0.6
7fdd147b1000-7fdd147b2000 r--p 0000e000 fd:03 33632531 /usr/lib64/libbz2.so.1.0.6
7fdd147b2000-7fdd147b3000 rw-p 0000f000 fd:03 33632531 /usr/lib64/libbz2.so.1.0.6
7fdd147b3000-7fdd147da000 r-xp 00000000 fd:03 33833160 /usr/lib64/libxcb.so.1.1.0
7fdd147da000-7fdd149d9000 ---p 00027000 fd:03 33833160 /usr/lib64/libxcb.so.1.1.0
7fdd149d9000-7fdd149da000 r--p 00026000 fd:03 33833160 /usr/lib64/libxcb.so.1.1.0
7fdd149da000-7fdd149db000 rw-p 00027000 fd:03 33833160 /usr/lib64/libxcb.so.1.1.0
7fdd149db000-7fdd14a92000 r-xp 00000000 fd:03 33662841 /usr/lib64/libfreetype.so.6.14.0
7fdd14a92000-7fdd14c92000 ---p 000b7000 fd:03 33662841 /usr/lib64/libfreetype.so.6.14.0
7fdd14c92000-7fdd14c99000 r--p 000b7000 fd:03 33662841 /usr/lib64/libfreetype.so.6.14.0
7fdd14c99000-7fdd14c9a000 rw-p 000be000 fd:03 33662841 /usr/lib64/libfreetype.so.6.14.0
7fdd14c9a000-7fdd14ce6000 r-xp 00000000 fd:03 33662319 /usr/lib64/libwebp.so.4.0.2
7fdd14ce6000-7fdd14ee5000 ---p 0004c000 fd:03 33662319 /usr/lib64/libwebp.so.4.0.2
7fdd14ee5000-7fdd14ee6000 r--p 0004b000 fd:03 33662319 /usr/lib64/libwebp.so.4.0.2
7fdd14ee6000-7fdd14ee7000 rw-p 0004c000 fd:03 33662319 /usr/lib64/libwebp.so.4.0.2
7fdd14ee7000-7fdd14eea000 rw-p 00000000 00:00 0
7fdd14eea000-7fdd14f2d000 r-xp 00000000 fd:03 33632511 /usr/lib64/libjpeg.so.62.1.0
7fdd14f2d000-7fdd1512d000 ---p 00043000 fd:03 33632511 /usr/lib64/libjpeg.so.62.1.0
7fdd1512d000-7fdd1512e000 r--p 00043000 fd:03 33632511 /usr/lib64/libjpeg.so.62.1.0
7fdd1512e000-7fdd1512f000 rw-p 00044000 fd:03 33632511 /usr/lib64/libjpeg.so.62.1.0
7fdd1512f000-7fdd1513f000 rw-p 00000000 00:00 0
7fdd1513f000-7fdd15168000 r-xp 00000000 fd:03 33596751 /usr/lib64/libpng15.so.15.13.0
7fdd15168000-7fdd15368000 ---p 00029000 fd:03 33596751 /usr/lib64/libpng15.so.15.13.0
7fdd15368000-7fdd15369000 r--p 00029000 fd:03 33596751 /usr/lib64/libpng15.so.15.13.0
7fdd15369000-7fdd1536a000 rw-p 0002a000 fd:03 33596751 /usr/lib64/libpng15.so.15.13.0
7fdd1536a000-7fdd1537b000 r-xp 00000000 fd:03 33833181 /usr/lib64/libXpm.so.4.11.0
7fdd1537b000-7fdd1557a000 ---p 00011000 fd:03 33833181 /usr/lib64/libXpm.so.4.11.0
7fdd1557a000-7fdd1557b000 r--p 00010000 fd:03 33833181 /usr/lib64/libXpm.so.4.11.0
7fdd1557b000-7fdd1557c000 rw-p 00011000 fd:03 33833181 /usr/lib64/libXpm.so.4.11.0
7fdd1557c000-7fdd156b4000 r-xp 00000000 fd:03 33632421 /usr/lib64/libX11.so.6.3.0
7fdd156b4000-7fdd158b4000 ---p 00138000 fd:03 33632421 /usr/lib64/libX11.so.6.3.0
7fdd158b4000-7fdd158b5000 r--p 00138000 fd:03 33632421 /usr/lib64/libX11.so.6.3.0
7fdd158b5000-7fdd158ba000 rw-p 00139000 fd:03 33632421 /usr/lib64/libX11.so.6.3.0
7fdd158ba000-7fdd15912000 r-xp 00000000 fd:03 2182191 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/gd.so
7fdd15912000-7fdd15b11000 ---p 00058000 fd:03 2182191 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/gd.so
7fdd15b11000-7fdd15b16000 r--p 00057000 fd:03 2182191 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/gd.so
7fdd15b16000-7fdd15b17000 rw-p 0005c000 fd:03 2182191 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/gd.so
7fdd15b17000-7fdd15b1b000 rw-p 00000000 00:00 0
7fdd15b1b000-7fdd15b27000 r-xp 00000000 fd:03 1908337 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/ftp.so
7fdd15b27000-7fdd15d27000 ---p 0000c000 fd:03 1908337 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/ftp.so
7fdd15d27000-7fdd15d29000 r--p 0000c000 fd:03 1908337 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/ftp.so
7fdd15d29000-7fdd15d2a000 rw-p 0000e000 fd:03 1908337 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/ftp.so
7fdd15d2a000-7fdd161f9000 r-xp 00000000 fd:03 200756 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/fileinfo.so
7fdd161f9000-7fdd163f8000 ---p 004cf000 fd:03 200756 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/fileinfo.so
7fdd163f8000-7fdd163f9000 r--p 004ce000 fd:03 200756 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/fileinfo.so
7fdd163f9000-7fdd163fa000 rw-p 004cf000 fd:03 200756 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/fileinfo.so
7fdd163fa000-7fdd16420000 r-xp 00000000 fd:03 490520 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/dom.so
7fdd16420000-7fdd1661f000 ---p 00026000 fd:03 490520 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/dom.so
7fdd1661f000-7fdd16623000 r--p 00025000 fd:03 490520 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/dom.so
7fdd16623000-7fdd16624000 rw-p 00029000 fd:03 490520 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/dom.so
7fdd16624000-7fdd16625000 rw-p 00000000 00:00 0
7fdd16625000-7fdd16645000 r-xp 00000000 fd:03 370088730 /opt/cpanel/ea-brotli/lib/libbrotlicommon.so.1.0.9
7fdd16645000-7fdd16844000 ---p 00020000 fd:03 370088730 /opt/cpanel/ea-brotli/lib/libbrotlicommon.so.1.0.9
7fdd16844000-7fdd16845000 r--p 0001f000 fd:03 370088730 /opt/cpanel/ea-brotli/lib/libbrotlicommon.so.1.0.9
7fdd16845000-7fdd16846000 rw-p 00020000 fd:03 370088730 /opt/cpanel/ea-brotli/lib/libbrotlicommon.so.1.0.9
7fdd16846000-7fdd16a7c000 r-xp 00000000 fd:03 33620190 /usr/lib64/libcrypto.so.1.0.2k
7fdd16a7c000-7fdd16c7c000 ---p 00236000 fd:03 33620190 /usr/lib64/libcrypto.so.1.0.2k
7fdd16c7c000-7fdd16c98000 r--p 00236000 fd:03 33620190 /usr/lib64/libcrypto.so.1.0.2k
7fdd16c98000-7fdd16ca5000 rw-p 00252000 fd:03 33620190 /usr/lib64/libcrypto.so.1.0.2k
7fdd16ca5000-7fdd16ca9000 rw-p 00000000 00:00 0
7fdd16ca9000-7fdd16d10000 r-xp 00000000 fd:03 33620192 /usr/lib64/libssl.so.1.0.2k
7fdd16d10000-7fdd16f10000 ---p 00067000 fd:03 33620192 /usr/lib64/libssl.so.1.0.2k
7fdd16f10000-7fdd16f14000 r--p 00067000 fd:03 33620192 /usr/lib64/libssl.so.1.0.2k
7fdd16f14000-7fdd16f1b000 rw-p 0006b000 fd:03 33620192 /usr/lib64/libssl.so.1.0.2k
7fdd16f1b000-7fdd16f3a000 r-xp 00000000 fd:03 369499387 /opt/cpanel/ea-brotli/lib/libbrotlidec.so.1.0.9
7fdd16f3a000-7fdd17139000 ---p 0001f000 fd:03 369499387 /opt/cpanel/ea-brotli/lib/libbrotlidec.so.1.0.9
7fdd17139000-7fdd1713a000 r--p 0001e000 fd:03 369499387 /opt/cpanel/ea-brotli/lib/libbrotlidec.so.1.0.9
7fdd1713a000-7fdd1713b000 rw-p 0001f000 fd:03 369499387 /opt/cpanel/ea-brotli/lib/libbrotlidec.so.1.0.9
7fdd1713b000-7fdd17166000 r-xp 00000000 fd:03 33738296 /usr/lib64/libssh2.so.1.0.1
7fdd17166000-7fdd17366000 ---p 0002b000 fd:03 33738296 /usr/lib64/libssh2.so.1.0.1
7fdd17366000-7fdd17367000 r--p 0002b000 fd:03 33738296 /usr/lib64/libssh2.so.1.0.1
7fdd17367000-7fdd17368000 rw-p 0002c000 fd:03 33738296 /usr/lib64/libssh2.so.1.0.1
7fdd17368000-7fdd1738f000 r-xp 00000000 fd:03 152451790 /opt/cpanel/nghttp2/lib/libnghttp2.so.14.20.1
7fdd1738f000-7fdd1758e000 ---p 00027000 fd:03 152451790 /opt/cpanel/nghttp2/lib/libnghttp2.so.14.20.1
7fdd1758e000-7fdd17591000 r--p 00026000 fd:03 152451790 /opt/cpanel/nghttp2/lib/libnghttp2.so.14.20.1
7fdd17591000-7fdd17592000 rw-p 00029000 fd:03 152451790 /opt/cpanel/nghttp2/lib/libnghttp2.so.14.20.1
7fdd17592000-7fdd1761e000 r-xp 00000000 fd:03 134348816 /opt/cpanel/libcurl/lib64/libcurl.so.4.7.0
7fdd1761e000-7fdd1781e000 ---p 0008c000 fd:03 134348816 /opt/cpanel/libcurl/lib64/libcurl.so.4.7.0
7fdd1781e000-7fdd17820000 r--p 0008c000 fd:03 134348816 /opt/cpanel/libcurl/lib64/libcurl.so.4.7.0
7fdd17820000-7fdd17823000 rw-p 0008e000 fd:03 134348816 /opt/cpanel/libcurl/lib64/libcurl.so.4.7.0
7fdd17823000-7fdd17824000 rw-p 00000000 00:00 0
7fdd17824000-7fdd17838000 r-xp 00000000 fd:03 2182202 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/curl.so
7fdd17838000-7fdd17a37000 ---p 00014000 fd:03 2182202 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/curl.so
7fdd17a37000-7fdd17a39000 r--p 00013000 fd:03 2182202 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/curl.so
7fdd17a39000-7fdd17a3a000 rw-p 00015000 fd:03 2182202 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/curl.so
7fdd17a3a000-7fdd17a3d000 r-xp 00000000 fd:03 1667800 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/ctype.so
7fdd17a3d000-7fdd17c3c000 ---p 00003000 fd:03 1667800 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/ctype.so
7fdd17c3c000-7fdd17c3d000 r--p 00002000 fd:03 1667800 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/ctype.so
7fdd17c3d000-7fdd17c3e000 rw-p 00003000 fd:03 1667800 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/ctype.so
7fdd17c3e000-7fdd17c45000 r-xp 00000000 fd:03 2182199 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/calendar.so
7fdd17c45000-7fdd17e44000 ---p 00007000 fd:03 2182199 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/calendar.so
7fdd17e44000-7fdd17e45000 r--p 00006000 fd:03 2182199 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/calendar.so
7fdd17e45000-7fdd17e46000 rw-p 00007000 fd:03 2182199 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/calendar.so
7fdd17e46000-7fdd17e4d000 r-xp 00000000 fd:03 2182197 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/bcmath.so
7fdd17e4d000-7fdd1804d000 ---p 00007000 fd:03 2182197 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/bcmath.so
7fdd1804d000-7fdd1804e000 r--p 00007000 fd:03 2182197 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/bcmath.so
7fdd1804e000-7fdd1804f000 rw-p 00008000 fd:03 2182197 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/bcmath.so
7fdd1804f000-7fdd180ae000 r-xp 00000000 fd:03 2182201 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/opcache.so
7fdd180ae000-7fdd182ae000 ---p 0005f000 fd:03 2182201 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/opcache.so
7fdd182ae000-7fdd182b4000 r--p 0005f000 fd:03 2182201 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/opcache.so
7fdd182b4000-7fdd182b5000 rw-p 00065000 fd:03 2182201 /opt/cpanel/ea-php72/root/usr/lib64/php/modules/opcache.so
7fdd182b5000-7fdd182be000 rw-p 00000000 00:00 0
7fdd182be000-7fdd1e800000 r--p 00000000 fd:03 20521731 /usr/lib/locale/locale-archive
7fdd1e800000-7fdd1ea00000 rw-p 00000000 00:00 0
7fdd1eb8b000-7fdd1ebaf000 r-xp 00000000 fd:03 33631929 /usr/lib64/libselinux.so.1
7fdd1ebaf000-7fdd1edae000 ---p 00024000 fd:03 33631929 /usr/lib64/libselinux.so.1
7fdd1edae000-7fdd1edaf000 r--p 00023000 fd:03 33631929 /usr/lib64/libselinux.so.1
7fdd1edaf000-7fdd1edb0000 rw-p 00024000 fd:03 33631929 /usr/lib64/libselinux.so.1
7fdd1edb0000-7fdd1edb2000 rw-p 00000000 00:00 0
7fdd1edb2000-7fdd1edb5000 r-xp 00000000 fd:03 33691855 /usr/lib64/libkeyutils.so.1.5
7fdd1edb5000-7fdd1efb4000 ---p 00003000 fd:03 33691855 /usr/lib64/libkeyutils.so.1.5
7fdd1efb4000-7fdd1efb5000 r--p 00002000 fd:03 33691855 /usr/lib64/libkeyutils.so.1.5
7fdd1efb5000-7fdd1efb6000 rw-p 00003000 fd:03 33691855 /usr/lib64/libkeyutils.so.1.5
7fdd1efb6000-7fdd1efc4000 r-xp 00000000 fd:03 33631956 /usr/lib64/libkrb5support.so.0.1
7fdd1efc4000-7fdd1f1c4000 ---p 0000e000 fd:03 33631956 /usr/lib64/libkrb5support.so.0.1
7fdd1f1c4000-7fdd1f1c5000 r--p 0000e000 fd:03 33631956 /usr/lib64/libkrb5support.so.0.1
7fdd1f1c5000-7fdd1f1c6000 rw-p 0000f000 fd:03 33631956 /usr/lib64/libkrb5support.so.0.1
7fdd1f1c6000-7fdd1f1dd000 r-xp 00000000 fd:03 33632245 /usr/lib64/libpthread-2.17.so
7fdd1f1dd000-7fdd1f3dc000 ---p 00017000 fd:03 33632245 /usr/lib64/libpthread-2.17.so
7fdd1f3dc000-7fdd1f3dd000 r--p 00016000 fd:03 33632245 /usr/lib64/libpthread-2.17.so
7fdd1f3dd000-7fdd1f3de000 rw-p 00017000 fd:03 33632245 /usr/lib64/libpthread-2.17.so
7fdd1f3de000-7fdd1f3e2000 rw-p 00000000 00:00 0
7fdd1f3e2000-7fdd1f3e4000 r-xp 00000000 fd:03 33738294 /usr/lib64/libfreebl3.so
7fdd1f3e4000-7fdd1f5e3000 ---p 00002000 fd:03 33738294 /usr/lib64/libfreebl3.so
7fdd1f5e3000-7fdd1f5e4000 r--p 00001000 fd:03 33738294 /usr/lib64/libfreebl3.so
7fdd1f5e4000-7fdd1f5e5000 rw-p 00002000 fd:03 33738294 /usr/lib64/libfreebl3.so
7fdd1f5e5000-7fdd1f7a9000 r-xp 00000000 fd:03 33632219 /usr/lib64/libc-2.17.so
7fdd1f7a9000-7fdd1f9a8000 ---p 001c4000 fd:03 33632219 /usr/lib64/libc-2.17.so
7fdd1f9a8000-7fdd1f9ac000 r--p 001c3000 fd:03 33632219 /usr/lib64/libc-2.17.so
7fdd1f9ac000-7fdd1f9ae000 rw-p 001c7000 fd:03 33632219 /usr/lib64/libc-2.17.so
7fdd1f9ae000-7fdd1f9b3000 rw-p 00000000 00:00 0
7fdd1f9b3000-7fdd1f9c8000 r-xp 00000000 fd:03 34113657 /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7fdd1f9c8000-7fdd1fbc7000 ---p 00015000 fd:03 34113657 /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7fdd1fbc7000-7fdd1fbc8000 r--p 00014000 fd:03 34113657 /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7fdd1fbc8000-7fdd1fbc9000 rw-p 00015000 fd:03 34113657 /usr/lib64/libgcc_s-4.8.5-20150702.so.1
7fdd1fbc9000-7fdd1fbcc000 r-xp 00000000 fd:03 33631918 /usr/lib64/libcom_err.so.2.1
7fdd1fbcc000-7fdd1fdcb000 ---p 00003000 fd:03 33631918 /usr/lib64/libcom_err.so.2.1
7fdd1fdcb000-7fdd1fdcc000 r--p 00002000 fd:03 33631918 /usr/lib64/libcom_err.so.2.1
7fdd1fdcc000-7fdd1fdcd000 rw-p 00003000 fd:03 33631918 /usr/lib64/libcom_err.so.2.1
7fdd1fdcd000-7fdd1fdfe000 r-xp 00000000 fd:03 33631946 /usr/lib64/libk5crypto.so.3.1
7fdd1fdfe000-7fdd1fffd000 ---p 00031000 fd:03 33631946 /usr/lib64/libk5crypto.so.3.1
7fdd1fffd000-7fdd1ffff000 r--p 00030000 fd:03 33631946 /usr/lib64/libk5crypto.so.3.1
7fdd1ffff000-7fdd20000000 rw-p 00032000 fd:03 33631946 /usr/lib64/libk5crypto.so.3.1
7fdd20000000-7fdd200d9000 r-xp 00000000 fd:03 33631953 /usr/lib64/libkrb5.so.3.3
7fdd200d9000-7fdd202d8000 ---p 000d9000 fd:03 33631953 /usr/lib64/libkrb5.so.3.3
7fdd202d8000-7fdd202e6000 r--p 000d8000 fd:03 33631953 /usr/lib64/libkrb5.so.3.3
7fdd202e6000-7fdd202e9000 rw-p 000e6000 fd:03 33631953 /usr/lib64/libkrb5.so.3.3
7fdd202e9000-7fdd20333000 r-xp 00000000 fd:03 33631928 /usr/lib64/libgssapi_krb5.so.2.2
7fdd20333000-7fdd20533000 ---p 0004a000 fd:03 33631928 /usr/lib64/libgssapi_krb5.so.2.2
7fdd20533000-7fdd20534000 r--p 0004a000 fd:03 33631928 /usr/lib64/libgssapi_krb5.so.2.2
7fdd20534000-7fdd20536000 rw-p 0004b000 fd:03 33631928 /usr/lib64/libgssapi_krb5.so.2.2
7fdd20536000-7fdd2055b000 r-xp 00000000 fd:03 33632477 /usr/lib64/liblzma.so.5.2.2
7fdd2055b000-7fdd2075a000 ---p 00025000 fd:03 33632477 /usr/lib64/liblzma.so.5.2.2
7fdd2075a000-7fdd2075b000 r--p 00024000 fd:03 33632477 /usr/lib64/liblzma.so.5.2.2
7fdd2075b000-7fdd2075c000 rw-p 00025000 fd:03 33632477 /usr/lib64/liblzma.so.5.2.2
7fdd2075c000-7fdd208ba000 r-xp 00000000 fd:03 36100021 /opt/cpanel/ea-libxml2/lib64/libxml2.so.2.9.7
7fdd208ba000-7fdd20aba000 ---p 0015e000 fd:03 36100021 /opt/cpanel/ea-libxml2/lib64/libxml2.so.2.9.7
7fdd20aba000-7fdd20ac2000 r--p 0015e000 fd:03 36100021 /opt/cpanel/ea-libxml2/lib64/libxml2.so.2.9.7
7fdd20ac2000-7fdd20ac4000 rw-p 00166000 fd:03 36100021 /opt/cpanel/ea-libxml2/lib64/libxml2.so.2.9.7
7fdd20ac4000-7fdd20ac5000 rw-p 00000000 00:00 0
7fdd20ac5000-7fdd20adc000 r-xp 00000000 fd:03 33632229 /usr/lib64/libnsl-2.17.so
7fdd20adc000-7fdd20cdb000 ---p 00017000 fd:03 33632229 /usr/lib64/libnsl-2.17.so
7fdd20cdb000-7fdd20cdc000 r--p 00016000 fd:03 33632229 /usr/lib64/libnsl-2.17.so
7fdd20cdc000-7fdd20cdd000 rw-p 00017000 fd:03 33632229 /usr/lib64/libnsl-2.17.so
7fdd20cdd000-7fdd20cdf000 rw-p 00000000 00:00 0
7fdd20cdf000-7fdd20ce1000 r-xp 00000000 fd:03 33632225 /usr/lib64/libdl-2.17.so
7fdd20ce1000-7fdd20ee1000 ---p 00002000 fd:03 33632225 /usr/lib64/libdl-2.17.so
7fdd20ee1000-7fdd20ee2000 r--p 00002000 fd:03 33632225 /usr/lib64/libdl-2.17.so
7fdd20ee2000-7fdd20ee3000 rw-p 00003000 fd:03 33632225 /usr/lib64/libdl-2.17.so
7fdd20ee3000-7fdd20fe4000 r-xp 00000000 fd:03 33632227 /usr/lib64/libm-2.17.so
7fdd20fe4000-7fdd211e3000 ---p 00101000 fd:03 33632227 /usr/lib64/libm-2.17.so
7fdd211e3000-7fdd211e4000 r--p 00100000 fd:03 33632227 /usr/lib64/libm-2.17.so
7fdd211e4000-7fdd211e5000 rw-p 00101000 fd:03 33632227 /usr/lib64/libm-2.17.so
7fdd211e5000-7fdd211ec000 r-xp 00000000 fd:03 33632249 /usr/lib64/librt-2.17.so
7fdd211ec000-7fdd213eb000 ---p 00007000 fd:03 33632249 /usr/lib64/librt-2.17.so
7fdd213eb000-7fdd213ec000 r--p 00006000 fd:03 33632249 /usr/lib64/librt-2.17.so
7fdd213ec000-7fdd213ed000 rw-p 00007000 fd:03 33632249 /usr/lib64/librt-2.17.so
7fdd213ed000-7fdd21473000 r-xp 00000000 fd:03 37858975 /opt/cpanel/ea-openssl11/lib/libssl-ea.so.1.1
7fdd21473000-7fdd21672000 ---p 00086000 fd:03 37858975 /opt/cpanel/ea-openssl11/lib/libssl-ea.so.1.1
7fdd21672000-7fdd2167a000 r--p 00085000 fd:03 37858975 /opt/cpanel/ea-openssl11/lib/libssl-ea.so.1.1
7fdd2167a000-7fdd2167f000 rw-p 0008d000 fd:03 37858975 /opt/cpanel/ea-openssl11/lib/libssl-ea.so.1.1
7fdd2167f000-7fdd21938000 r-xp 00000000 fd:03 36100012 /opt/cpanel/ea-openssl11/lib/libcrypto-ea.so.1.1
7fdd21938000-7fdd21b37000 ---p 002b9000 fd:03 36100012 /opt/cpanel/ea-openssl11/lib/libcrypto-ea.so.1.1
7fdd21b37000-7fdd21b62000 r--p 002b8000 fd:03 36100012 /opt/cpanel/ea-openssl11/lib/libcrypto-ea.so.1.1
7fdd21b62000-7fdd21b65000 rw-p 002e3000 fd:03 36100012 /opt/cpanel/ea-openssl11/lib/libcrypto-ea.so.1.1
7fdd21b65000-7fdd21b69000 rw-p 00000000 00:00 0
7fdd21b69000-7fdd21bc9000 r-xp 00000000 fd:03 33661192 /usr/lib64/libpcre.so.1.2.0
7fdd21bc9000-7fdd21dc9000 ---p 00060000 fd:03 33661192 /usr/lib64/libpcre.so.1.2.0
7fdd21dc9000-7fdd21dca000 r--p 00060000 fd:03 33661192 /usr/lib64/libpcre.so.1.2.0
7fdd21dca000-7fdd21dcb000 rw-p 00061000 fd:03 33661192 /usr/lib64/libpcre.so.1.2.0
7fdd21dcb000-7fdd21de0000 r-xp 00000000 fd:03 33632514 /usr/lib64/libz.so.1.2.7
7fdd21de0000-7fdd21fdf000 ---p 00015000 fd:03 33632514 /usr/lib64/libz.so.1.2.7
7fdd21fdf000-7fdd21fe0000 r--p 00014000 fd:03 33632514 /usr/lib64/libz.so.1.2.7
7fdd21fe0000-7fdd21fe1000 rw-p 00015000 fd:03 33632514 /usr/lib64/libz.so.1.2.7
7fdd21fe1000-7fdd220ca000 r-xp 00000000 fd:03 33632424 /usr/lib64/libstdc++.so.6.0.19
7fdd220ca000-7fdd222ca000 ---p 000e9000 fd:03 33632424 /usr/lib64/libstdc++.so.6.0.19
7fdd222ca000-7fdd222d2000 r--p 000e9000 fd:03 33632424 /usr/lib64/libstdc++.so.6.0.19
7fdd222d2000-7fdd222d4000 rw-p 000f1000 fd:03 33632424 /usr/lib64/libstdc++.so.6.0.19
7fdd222d4000-7fdd222e9000 rw-p 00000000 00:00 0
7fdd222e9000-7fdd2230e000 r-xp 00000000 fd:03 33596788 /usr/lib64/libtinfo.so.5.9
7fdd2230e000-7fdd2250e000 ---p 00025000 fd:03 33596788 /usr/lib64/libtinfo.so.5.9
7fdd2250e000-7fdd22512000 r--p 00025000 fd:03 33596788 /usr/lib64/libtinfo.so.5.9
7fdd22512000-7fdd22513000 rw-p 00029000 fd:03 33596788 /usr/lib64/libtinfo.so.5.9
7fdd22513000-7fdd22539000 r-xp 00000000 fd:03 33596778 /usr/lib64/libncurses.so.5.9
7fdd22539000-7fdd22738000 ---p 00026000 fd:03 33596778 /usr/lib64/libncurses.so.5.9
7fdd22738000-7fdd22739000 r--p 00025000 fd:03 33596778 /usr/lib64/libncurses.so.5.9
7fdd22739000-7fdd2273a000 rw-p 00026000 fd:03 33596778 /usr/lib64/libncurses.so.5.9
7fdd2273a000-7fdd2276f000 r-xp 00000000 fd:03 33691821 /usr/lib64/libedit.so.0.0.42
7fdd2276f000-7fdd2296e000 ---p 00035000 fd:03 33691821 /usr/lib64/libedit.so.0.0.42
7fdd2296e000-7fdd22971000 r--p 00034000 fd:03 33691821 /usr/lib64/libedit.so.0.0.42
7fdd22971000-7fdd22972000 rw-p 00037000 fd:03 33691821 /usr/lib64/libedit.so.0.0.42
7fdd22972000-7fdd22977000 rw-p 00000000 00:00 0
7fdd22977000-7fdd2298d000 r-xp 00000000 fd:03 33632247 /usr/lib64/libresolv-2.17.so
7fdd2298d000-7fdd22b8d000 ---p 00016000 fd:03 33632247 /usr/lib64/libresolv-2.17.so
7fdd22b8d000-7fdd22b8e000 r--p 00016000 fd:03 33632247 /usr/lib64/libresolv-2.17.so
7fdd22b8e000-7fdd22b8f000 rw-p 00017000 fd:03 33632247 /usr/lib64/libresolv-2.17.so
7fdd22b8f000-7fdd22b91000 rw-p 00000000 00:00 0
7fdd22b91000-7fdd22b98000 r-xp 00000000 fd:03 319815481 /opt/cpanel/libargon2/lib64/libargon2.so.0
7fdd22b98000-7fdd22d97000 ---p 00007000 fd:03 319815481 /opt/cpanel/libargon2/lib64/libargon2.so.0
7fdd22d97000-7fdd22d98000 r--p 00006000 fd:03 319815481 /opt/cpanel/libargon2/lib64/libargon2.so.0
7fdd22d98000-7fdd22d99000 rw-p 00007000 fd:03 319815481 /opt/cpanel/libargon2/lib64/libargon2.so.0
7fdd22d99000-7fdd22da1000 r-xp 00000000 fd:03 33632223 /usr/lib64/libcrypt-2.17.so
7fdd22da1000-7fdd22fa0000 ---p 00008000 fd:03 33632223 /usr/lib64/libcrypt-2.17.so
7fdd22fa0000-7fdd22fa1000 r--p 00007000 fd:03 33632223 /usr/lib64/libcrypt-2.17.so
7fdd22fa1000-7fdd22fa2000 rw-p 00008000 fd:03 33632223 /usr/lib64/libcrypt-2.17.so
7fdd22fa2000-7fdd22fd0000 rw-p 00000000 00:00 0
7fdd22fd0000-7fdd22ff2000 r-xp 00000000 fd:03 33632212 /usr/lib64/ld-2.17.so
7fdd230e2000-7fdd23117000 r--s 00000000 fd:03 352384670 /var/db/nscd/hosts
7fdd23117000-7fdd23160000 rw-p 00000000 00:00 0
7fdd23165000-7fdd23175000 rwxp 00000000 00:00 0
7fdd23175000-7fdd231e4000 rw-p 00000000 00:00 0
7fdd231f0000-7fdd231f1000 rw-p 00000000 00:00 0
7fdd231f1000-7fdd231f2000 r--p 00021000 fd:03 33632212 /usr/lib64/ld-2.17.so
7fdd231f2000-7fdd231f3000 rw-p 00022000 fd:03 33632212 /usr/lib64/ld-2.17.so
7fdd231f3000-7fdd231f4000 rw-p 00000000 00:00 0
7ffe69aad000-7ffe69ace000 rw-p 00000000 00:00 0 [stack]
7ffe69b40000-7ffe69b42000 r-xp 00000000 00:00 0 [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]

Average of ratings: -

Re: Moodle cron jobs detect as suspicious activity

by Ken Task - Thursday, December 24, 2020, 12:50 AM

Staging hosts are prime targets if not maintained like production servers - they usually aren't. How about yours?

/opt/cpanel/ea-php72/root/usr/bin/php is Easy Apache and set to PHP version 7.2 and under cPanel ... looks to be the path one would use in set up of the operating system cron job on your 192.168.10.58 (private IP) server.

On staging server are you allowing the running of cron via the web?

Probably should set that to command line only and then make sure the cron job is set appropriately (correct path). If set so, that runs locally on server and any web based access to it is denied.

Since we see cPanel is involved, is cPanel code up to date?

Also ... 7fdd21b62000-7fdd21b65000 ... is that reference CloudFlare ray? And are you sharing a CloudFlare log?

Since CloudFlare acts as not only a content delivery server in front of web servers set up with it but also a WAF could be someone outside is poking and probing ... now-a-days that happens daily and from a number of 'bad actors' and bots.

What would be of major concern (to me) would be the web service error logs for the staging server. IF funny business found in them, CloudFlare not doing it's job in protecting ... or bad actors bots are by passing CF.

So check logs of staging server itself. If setup is working correctly, think one would see the IP address of CloudFlare servers only and not any other IP's.

My 2 cents!

'SoS', Ken

Average of ratings: -

Re: Moodle cron jobs detect as suspicious activity

by Jasim Peringattuthodi - Monday, May 17, 2021, 5:26 PM

Thank you Ken for your detailed reply
Actually we are not using CloudFlare
On staging server are you allowing the running of cron via the web? - No
Since we see cPanel is involved, is cPanel code up to date? - Yes

Average of ratings: -

Re: Moodle cron jobs detect as suspicious activity

by Ken Task - Tuesday, May 18, 2021, 1:06 AM

Early posting you shared:

192.168.10.58: 51858 -> 104.22.65.81:443 )

The 192.168.10.58 IP is a private IP. But the 104.22.65.81 IP is CloudFare me thinks:

dig -x 104.22.65.81

Doesn't show a ptr record in DNS but the SOA shows cloudflare:

;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;81.65.22.104.in-addr.arpa. IN PTR

;; AUTHORITY SECTION:
22.104.in-addr.arpa. 388 IN SOA cruz.ns.cloudflare.com. dns.cloudflare.com. 2034580120 10000 2400 604800 3600

'SoS', Ken

Average of ratings: -

Security and privacy

Moodle cron jobs detect as suspicious activity