Boris 3,
Here are "%name%.tmp" file - with program data itself - wich just disappear after termination by user, or when installation ended; log-files still in that directory after the end of the process. Trojan, or somesthing, is a part of that ".tmp" file - which include a program data. There is no need to send harmless logs - but '.tmp" file with the trojan.
I've done the update with the standalone installer mentioned in the post of lightstep. As I run Defense+ in parano mode and haven't made a rule for Dragon updater, I'm alerted of all his moves. You'll see in the attached image the files created during the update process.
To be noted, in your original post you said that the alert from Avira pointed to a file in C:\Windows\Temp
Looks like we have problems here - an "Avira" reported "TR/Crypt.XPACK.Gen" trojan into installation distributive in process to install new version (C:\Windows\Temp\Dra4638.tmp).
In another post you were anxious of the use of \Windows\temp by Dragon updater
By the way - the installlation process looks strange itself - very suspicious that installation program choose directory such as "windows\temp"; directory like "C:\Users\%user%\AppData\Temp" looks more common.
Now you say that the "trojan" is in *\user\temp file
Here are "%name%.tmp" file - with program data itself - wich just disappear after termination by user, or when installation ended; log-files still in that directory after the end of the process. Trojan, or somesthing, is a part of that ".tmp" file - which include a program data. There is no need to send harmless logs - but '.tmp" file with the trojan.
By the way, would it not be more correct to speak of potential FP instead of trojan?