Multi-part archives require all volumes (Part 1, Part 2, etc.) to be present for full extraction.
Examining timestamps and author metadata can provide attribution leads .
Use Wireshark to monitor if the software attempts to contact a Command & Control (C2) server.