Loads dropped Dex/Jar

Runs executable file dropped to the device during analysis.

Registers a broadcast receiver at runtime (usually for listening for system events)

Requests disabling of battery optimizations (often used to enable hiding in the background).

Schedules tasks to execute at a specified time

Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.