Indeed, that's the "feature" of NTFS implementation (NTFS-3G) in Linux systems. In normal Linux file systems (ext, btrfs, etc.), you can delete files that is currently open, i.e. a program being executed. This mechanism allows you to recompile while debugging a program. This is not possible under NTFS-3G (as a FUSE implementation), hence, the driver copies the currently running file as .fuse_hiddenWXYZABCD and then perform the actual copying, but normal user will notice it as overwriting. They will be deleted upon reboot/shutdown. BUT, if you don't do a graceful shutdown, the driver will lose links of those files and on next boot, they're still hanging around.