In very rare instances, a poorly coded updater for a niche piece of software (e.g., a Chinese RGB controller or a legacy printer utility) uses random temp names. However, legitimate software usually signs their executables with a digital certificate (e.g., VeriSign, DigiCert). Right-click the file > Properties > Digital Signatures. If there is no signature, it is not legitimate.