file_path

~/.cache/.sys_cache/.diag.enc

discovered 2026-07-14

Encrypted activity log written by the RAT payload (200 MB FIFO buffer per decrypted config, SafeDep).