I have totally caught malware checking to see if task manager is running, and cooling it until it is closed. Some cryptocurrency mining trojans do this. You can verify it by using a tool other than task manager, e.g. System Explorer or Process Hacker. Usually they’re not smart enough to poll for third party tools, so they’ll quiet down when only task manager is opened and not when you’re using any third party tools.