This is not a fix but perhaps I will shine more light on this ongoing issue.
When it comes to these specific .*TMP events and what I have seen before, they are very tricky to avoid.
One of those most common scenarios are with chrome.exe and their updates or browser cache. TMP files files are typically created by applications to store some form of temporary data, in a permanent form than RAM, on your hard disk. TMP files are commonly produced either when a program can't allocate enough memory for its tasks, or as part of inter-process communication. TMP files are usually deleted automatically by their parent application (the software, game, application) which created them hence hard to catch later as they get destroyed in the process.
I also believe that on the detection that you are receiving on *.TMP files you are not able to fetch them and in most cases you might see message similar to “Quarantine Failed”
As I said earlier temporary files are placed on the machine during a installation or upgrade or some time by just simply visiting a website. It is common to see even legitimate software such as google to generate this False Positive events. We always try to get our hands on these files and get them analyzed to avoid these events so if you can provide us with samples that will be great, as we will submit them to our developers so they can "fine-tune" these detection's.
As far for the quarantine-failure as I mentioned these files are usually short live so by the time we did analyze the file and based on many behavioral aspects we flagged this file as suspicious and go back and try to remove the file in many cases the file is simply not there because it gets auto-deleted by the system / program/ application . That’s why you see the message about failure to quarantine.
As far as your pictures two things to noticed.
A: The SHA of the file is grey color which means that the SHA is not malicious but rather classified as unknown/unseen
B: In your event detail picture from Device Trajectory, you can see which engine flagged the file and, in this case, this is the offline Tetra Engine.
So back again to samples, we will need that sample to analyze and determine which part is falsely triggering the detection.
Unfortunately, this is the issue when it comes to enterprise type of security, the more complex the engine is the more you will see false positive events, it really boils down to get familiar with the dashboard and spot these obvious FP events. I wish there is one click solution for everything.
