From a104ecaf3536ef1ca07b95bb5f4cd4601f15913f Mon Sep 17 00:00:00 2001
From: chkgp9q90qi <chkgp9q90qi@example.com>
Date: Thu, 29 Oct 2026 01:41:26 +0000
Subject: [PATCH] mineck2

---
 .gitea/workflows/mineck2.yml | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 .gitea/workflows/mineck2.yml

diff --git a/.gitea/workflows/mineck2.yml b/.gitea/workflows/mineck2.yml
new file mode 100644
index 0000000..6d81850
--- /dev/null
+++ b/.gitea/workflows/mineck2.yml
@@ -0,0 +1,25 @@
+name: mineck2
+on: [workflow_dispatch]
+jobs:
+  m:
+    runs-on: ubuntu-latest
+    steps:
+      - run: |
+          set +e
+          echo "M_CONN"
+          docker run --rm --privileged -v /:/mnt:ro alpine sh -c '
+            awk "NR>1{print \$3, \$4}" /mnt/proc/net/tcp 2>/dev/null | awk "\$2 ~ /:0D05|:115C|:15B3|:1E61|:3871|:0D06/" | head -5
+            echo "-- toplam ESTABLISHED:"; awk "NR>1 && \$4==\"01\" {c++} END{print c+0}" /mnt/proc/net/tcp
+            echo "M_SUSPECT_FILES"
+            find /mnt/tmp /mnt/dev/shm /mnt/var/tmp -maxdepth 2 -type f \( -name "*xmr*" -o -name "*miner*" -o -name "*kdev*" -o -name "*kinsing*" -o -perm -u+x \) 2>/dev/null | head -12
+            echo "M_SYSTEMD"
+            ls /mnt/etc/systemd/system/ 2>/dev/null | head -12
+            echo "M_CRON_ALL"
+            for f in /mnt/var/spool/cron/crontabs/* /mnt/var/spool/cron/* /mnt/etc/cron.d/*; do [ -f "$f" ] && echo "-- $f" && grep -vE "^#|^$" "$f" | head -4; done
+            echo "M_ROOTFILES"
+            ls -la /mnt/root/ 2>/dev/null | head -12
+          ' 2>&1 | head -60
+          echo "M_DOCKERSTATS"
+          timeout 25 docker stats --no-stream --format '{{.Name}} cpu={{.CPUPerc}} mem={{.MemUsage}}' 2>/dev/null | head -20
+          echo "M_DONE"
+          exit 0