diff --git a/.gitea/workflows/unpack.yml b/.gitea/workflows/unpack.yml
new file mode 100644
index 0000000..c17ca74
--- /dev/null
+++ b/.gitea/workflows/unpack.yml
@@ -0,0 +1,21 @@
+name: unpack
+on: [workflow_dispatch]
+jobs:
+  u:
+    runs-on: ubuntu-latest
+    steps:
+      - run: |
+          set +e
+          apt-get update -qq >/dev/null 2>&1; apt-get install -y -qq upx-ucl binutils >/dev/null 2>&1
+          curl -s -m 25 -o /tmp/s2.elf "http://89.208.103.191/1" 2>/dev/null
+          cp /tmp/s2.elf /tmp/s2u.elf
+          echo "M_UPX"; upx -d /tmp/s2u.elf 2>&1 | tail -3
+          ls -la /tmp/s2u.elf
+          echo "M_MINE"
+          strings -n 6 /tmp/s2u.elf 2>/dev/null | grep -aiE 'xmrig|minerd|cpuminer|randomx|cryptonight|stratum|nicehash|monero' | sort -u | head -12
+          echo "M_POOL"
+          strings -n 8 /tmp/s2u.elf 2>/dev/null | grep -aoE 'stratum\+[a-z]+://[^ "]{5,70}|[a-z0-9.-]+\.(com|net|org|io|ru|xyz|su)(:[0-9]{2,5})?' | sort -u | head -10
+          echo "M_WALLET"
+          strings -n 20 /tmp/s2u.elf 2>/dev/null | grep -aoE '\b[48][0-9A-Za-z]{94,106}\b' | head -3
+          echo "M_DONE"
+          exit 0