One malicious file was trying to reach out to an malicious URL which was blocked by Avast.
And it set an Autorun key.