Trend Micro Apex One monitors data transmitted to a mobile device through synchronization software.
For a list of supported synchronization software, see the Data Protection Lists document at:
http://docs.trendmicro.com/en-us/enterprise/data-protection-reference-documents.aspx
If the data has a source IP address of 127.0.0.1 and is sent through either port 990 or 5678 (the ports used for synchronization), Trend Micro Apex One checks if the data is a data identifier before allowing or blocking its transmission.
When Trend Micro Apex One blocks a file transmitted on port 990, a file of the same name containing malformed characters may still be created at the destination folder on the mobile device. This is because parts of the file have been copied to the device before Trend Micro Apex One blocked the transmission.