It could have been stopped by the avast sandbox, but it also could be windows doing, a program that was prevented to run from start up.
Then user must allow it to be excluded. This could have been Windows Defender’s doing…
Did user do an online scan before downloading or a VirusTotal scan for eventual pup detections or even malcode?
polonus