Thank you all for the replies and for taking the time to explain.
I want to be transparent: I am new to this forum and was genuinely unaware of the process used when a thread gets deleted. When my ANN was first removed, I contacted the moderators of the Announcements board directly. They replied that they themselves did not know why it had been deleted and suggested it may have been a global moderator. Based on that, I was expecting any further explanation to come via a private message to my inbox — I did not know that replies had been posted in a separate public thread. I only discovered that thread today. I apologize for the repeated posts — it was not intentional bad faith, it was a lack of understanding of how the forum works.
I have now read albon's analysis in full and posted a detailed technical response here:
https://bitcointalk.org/index.php?topic=5575473.msg66560920#msg66560920In summary:
The temp directory behavior is standard Electron application architecture, identical to VS Code, Discord, and every other Electron app
The high RAM/CPU on launch comes from c64chaind syncing the blockchain, not from the miner
c64miner.exe is based on XMRig (open source) and is flagged as a false positive by all AV vendors — this is documented by the Monero project itself
The miner does NOT start automatically. It only runs when the user navigates to the Mining tab, enters a wallet address, and explicitly clicks Start. At that point it appears in Task Manager labeled as "XMRig miner" and stops immediately when the user clicks Stop
I understand this community takes malware reports very seriously, and I respect that. The source code is fully public on GitHub for anyone who wants to verify the behavior independently.