~/.cache/.tf_cache/hw_probe.pyc

Compiled-only (source-less) persistent copy of the stealer. Sibling artifacts in ~/.cache/.tf_cache: .lock_<machineid> guard and .ts_<machineid> timestamp files.