Why don’t you send junction.exe to www.virustotal.com, check, and just make an exception into avast autosandbox?