Could be the Cybercapture function at work. As those are new files and avast likely doesn’t have their hash in the database, they are analyzed before executing.