Since it's a TMP file, Endpoint creates a new one every time, deleting the old one.
Here is the path to the files;
C:\Program Files\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\LiveUpdate\
TMP files are named like this;
LUF{535CB6A4-441F-4e8a-A897-804CD859100E}1205230361205220207.TMP
I checked for this first when I thought it might be a defective disk area causing the issue but scandisk says disk is OK.
No other app on my system does this kind of agressive file access. I use Auslogic Defrag weekly and I've never seen it waitting on a cluster more than usual when moving files.