We don't have such TFRA files on our machines in Windows\Temp, neither on W10 Client machines nor on the Windows Server.

 Edit:

When searching for TFRA*.tmp in the Internet, different pages describing desinfection procedures from spyware or trojan viruses will be found. [:|]

I am trying to figure out the source of files named TFRA???.TMP written to C:\WINDOWS\TEMP.  I can open them in Notepad and they contain the body of incoming email messages (no headers).  Does anyone know what creates these files?

C:\WINDOWS\TEMP is not the system temp or tmp directory.

Mercury runs on a dedicated PC with ClamAV and POPFile.  

I can not find C:\WINDOWS\TEMP configured as a path in Mercury or POPFile (also searched mercury.ini).

Occasionally the AV product on this machine (Vipre) will quarantine one of them (scheduled scanning only).