Resume

Big files checkpoint. Stubs pretend to checkpoint so you leave them running longer.

.part / .tmp

A growing temp file is not proof of GTA. It is proof something is writing bytes. Those bytes can be anything.

A classic. On landers it is a timer for the next upsell. On stores it is usually a verify stage — still inside a trusted app.

Loops forever on purpose so nobody thinks a payload finished.

If a fake fetcher is running, end the task. Then read the antivirus page.