@lisamakesstuff More thoughts:
- Check the creation timestamp of the rogue file. If it’s the middle of last night then I’d be looking for cron jobs creating it. If it’s always the same date long in the past then it’s been extracted from a package.
- On Debianish systems you can ask the package manager who owns the file with `dpkg -S /full/path/to/file`. Even an empty response is informative.