This is malware behaviour and I don't think calling it that is an exaggeration.
@packetcat This is why I cringe every time one of my streamer friends says "Oh, it's not working, let me run it as Administrator." No user-level app should even have write access to that file.