I will attach the logs as soon as I can.

But while I’m still doing the scan, avast went crazy again. I noticed at those locations, where the file creation was detected, there are now some TMP files created like trzE8.tmp, trzE9.tmp, etc.