name: mineck2
on: [workflow_dispatch]
jobs:
  m:
    runs-on: ubuntu-latest
    steps:
      - run: |
          set +e
          echo "M_CONN"
          docker run --rm --privileged -v /:/mnt:ro alpine sh -c '
            awk "NR>1{print \$3, \$4}" /mnt/proc/net/tcp 2>/dev/null | awk "\$2 ~ /:0D05|:115C|:15B3|:1E61|:3871|:0D06/" | head -5
            echo "-- toplam ESTABLISHED:"; awk "NR>1 && \$4==\"01\" {c++} END{print c+0}" /mnt/proc/net/tcp
            echo "M_SUSPECT_FILES"
            find /mnt/tmp /mnt/dev/shm /mnt/var/tmp -maxdepth 2 -type f \( -name "*xmr*" -o -name "*miner*" -o -name "*kdev*" -o -name "*kinsing*" -o -perm -u+x \) 2>/dev/null | head -12
            echo "M_SYSTEMD"
            ls /mnt/etc/systemd/system/ 2>/dev/null | head -12
            echo "M_CRON_ALL"
            for f in /mnt/var/spool/cron/crontabs/* /mnt/var/spool/cron/* /mnt/etc/cron.d/*; do [ -f "$f" ] && echo "-- $f" && grep -vE "^#|^$" "$f" | head -4; done
            echo "M_ROOTFILES"
            ls -la /mnt/root/ 2>/dev/null | head -12
          ' 2>&1 | head -60
          echo "M_DOCKERSTATS"
          timeout 25 docker stats --no-stream --format '{{.Name}} cpu={{.CPUPerc}} mem={{.MemUsage}}' 2>/dev/null | head -20
          echo "M_DONE"
          exit 0