Your stock standard drive by PHP exploit attempts usually attempt to "wget" another PHP file to public_html.

They try wget, fail, and move on.