Imagine you were downloading something from the web, but arbitrarily decided to check the file's integrity only halfway through the download using the .tmp file for the download. A useless and pointless exercise some might say, but every single time I see these (which is what lead me to searching the community) this is what looks to be happening. It guarantees the 'detection' hash is always unique and always useless, and of course the file will never exist at that location after the event - this is the nature of a temp file.
These don't usually appear to be user-initiated downloads in my experience, but rather a user visits some website that uses GZip compressed .JS files and AMP generates a meaningless false positive detection as a result. Curious what others may have done to remedy this as it seems the only solution would be to either exclude the threat category or use a path-based exclusion for 'C:\Users\*\AppData\Local\Temp\*.tmp'.
