Is this program morphing in the wild? Shouldn’t Avast be able to detect it and stop the install? What about the behavior shield - isn’t this the kind of thing it’s supposed to prevent? Not even automatic sandbox would catch it?