I'd imagine the app is run in a DMZ and the internet FW blocks typical malware behavior once detected. After all the whole point of running it is to find if the executable is going to do these types of things so they'd be prepared.