Today we have noticed the same with 8.5 2021-02-13 (build 85360175).
Windows 10 client, Linux server.
User was attaching an external document to the NL transaction paperclip via Operations menu of the paperclip. File attached successfully, but in the original location of that attached file hansa.log file has been created with a few rows of content.