Files being generated in wp-admin – are they malicious files?

Files are being generated in wp-admin at random intervals, somewhere between a week and two weeks.

They share a file naming structure of pThumb+some random string, for example:

pThumbEZR8rH

These files do not have file extensions although they are encoded as png files.

I am running WordFence.

Here is what I have done, without making any difference:

1. Replaced the ENTIRE wp-admin & wp-includes directories with fresh directories
2. WordFence scans show no malware
3. Securi scans show no malware
4. Looked through Theme files, Plugin files, not seeing any obvious code injections
5. Checked .htaccess and wp-config files, not seeing any obvious code injections
5. Searched online, not turning up any references to pThumb files

I am wondering specifically:

Has anyone else encountered pThumb or other files being generated in the wp-admin directory? Were you able to fix it?

And generally:

Should I keep trying to fix this (are these files indeed malicious?)