Suspicious folder in storage\emulated\0

[AC Question]

Phone: Galaxy S7 (ATT)

Suspicious folder name: .slc-yjmahecjs6wmsi9uhdeyr_m=...

The folder contains a nomedia file (8bytes). I've been able to delete and/or compress this folder, but it will regenerate the folder later or upon restart. I usually keep my storage folders pretty clean, but I'm unsure what this one is or what keeps generating it. I've found a few references to this file after some searching, but no answers.

1.) My first concern is could it be malicious. Unknown folder on my phone that I can't seem to get rid of...malicious just pops into mind. But Avast security and Clean Master scans seem unable to find anything upon scans.

2.) Is there a way to find out what's generating this folder. (short of uninstalling all my apps 1 at a time)

Additional info. I can't be sure when this folder popped up, just that I noticed yesterday. All apps that I've installed recently I've uninstalled, but this folder still generates upon restart.

Any help in figuring this out would be greatly appreciated. Thank you for your time!

 

[anon(9983233)]

Q: Have you rooted your device?

 

[B. Diddy]

Welcome to Android Central! It could be for an ad network (which isn't in itself malicious).

 

[Edilberto Galan]

Recuperar contenido demo celular

 

[birdbrain45]

I've been dealing with this for almost 4 years. It is malicious. All someone needs to do shell Injection attacks on your device is a path to your storage. From there they can run scripts , use dos/
Ddos, get you to mass spam domains until you're banned, accsess and take over your accounts & what's worse? It's Microsoft enterprise azure solutions/sub
Scrition service doing it tunneling through cloudflair as an azure partner.....good luck getting Att or Microsoft to do anything about it. My emulated storage has a 36 bite no media folder you can accsess with ghost commander app. I can't acsess but I can view. My folder has 203 uid & pid in it leading back to azure ......