@thescriptkiddy said:
is it the .ht******.exam*** ???
No.
If you want a bigger hint, do a list (with -al) and ignore anything with a recent (last month) timestamp.
Then look at folder names and decide if you’d expect to see them there. Any which look interesting or like they may be specific to the local machine should be investigated further.
Then its a case of keep looking and keep reading files.