Speculating here... but could it be that this is some reasonable safe and isolated method, where the malware does not interfere? (I'm not familiar at all with t

Speculating here... but could it be that this is some reasonable safe and isolated method, where the malware does not interfere? (I'm not familiar at all with the malware).