Large magic* files in /tmp?

In /tmp on one of my servers: (noexec, nosuid on tmp)

-rwxr-xr-x 1 nobody nobody 1076266440 Jan 12 13:19 magic5obAZs*
-rwxr-xr-x 1 nobody nobody 717510960 Jan 15 13:00 magic999bcI*
-rwxr-xr-x 1 nobody nobody 896888700 Jan 15 13:05 magicbCfs0l*


Anyone have anyidea whats causing these, if anything common? With the user nobody it gotta be a PHP script but is it malicious?

 

 

 

 

Top