Strange Behaviour, possibly Google Play related?

PintOfGuinness

I use several secondary profiles on my device with Sandboxed Google Play installed. Recently, a strange behaviour occurred that I'd previously never seen before, and am hoping someone here can shed some light on this.

After switching to my secondary profile and unlocking it, a notification appeared which read:

FullArchive-(lots of random numbers)
Download size requires Wi-Fi

The notification came from Download Manager.

I ignored the download and took my device offline. I also examined all files and folders on my device (within this secondary profile) and came across the following. Using the Files system app, I discovered many other similarly titled "FullArchive-(lots of random numbers)" files in the following location:

Android > data > com.android.vending > files > dna_data

It's here in the dna_data folder that there are multiple other FullArchive files. They're all the same file size of 16.31MB, and they appear to be BIN files.

I should clarify that Sandboxed Google Play was installed in this secondary profile from GrapheneOS Apps. The only other apps installed in this secondary profile are Proton VPN and the Amazon app.

I've tried searching online for answers to this but have come up empty handed. Can anyone clarify/assist with this?

other8026

PintOfGuinness several FullArchive-(lots of random numbers) BIN files, with some profiles having more of them than others. Each file is exactly 16.31MB in size.

I cannot find an answer online as to what the dna_data folder is, or what the FullArchive files are. Thoughts?

The fact is Google Play and the others are all closed source apps. If you can't find out what this folder contains or what the files are after searching online, then chances are the public just doesn't know or have any theories. That's just how it works.

PintOfGuinness The notification came from Download Manager.

sounds normal

PintOfGuinness Update: on any profile that has Sandboxed Google Play installed, there exists the same folder:

Android > data > com.android.vending > files > dna_data

I have the same folder.

PintOfGuinness

Update: on any profile that has Sandboxed Google Play installed, there exists the same folder:

Android > data > com.android.vending > files > dna_data

Like I mentioned previously, I use multiple profiles on my device. In some profiles with Sandboxed Google Play installed, the dna_data folder is empty, while in others there exist several FullArchive-(lots of random numbers) BIN files, with some profiles having more of them than others. Each file is exactly 16.31MB in size.

I cannot find an answer online as to what the dna_data folder is, or what the FullArchive files are. Thoughts?

PintOfGuinness

other8026 Thanks, appreciate the clarification!

other8026 The fact is Google Play and the others are all closed source apps. If you can't find out what this folder contains or what the files are after searching online, then chances are the public just doesn't know or have any theories. That's just how it works.

Completely understandable, wish it wasn't the case, but it is what it is.

My primary concern when this first presented itself a couple of days ago was "wait a minute, what's this that's trying to download?"

If I understand correctly, the com.android.vending folder corresponds to the Google Play Store, so the FullArchive files that are appearing in the dna_data subfolder (and attempting to download to that folder) are because of some function of Google Play? It's not something to be concerned about?

other8026

PintOfGuinness It's not something to be concerned about?

I don't think I can tell others what to be concerned about, but I personally am not. The reason is because Google Play and other Google apps don't have special privileges on GrapheneOS, unlike the Stock OS. Those apps have very limited access to my phone, so what can they really do or what information can they collect? Hardly anything unless the apps are given permission to things.

Honestly, I'd bet that the content of those files is probably boring.

PintOfGuinness

other8026 Honestly, I'd bet that the content of those files is probably boring.

Very true!

other8026 I don't think I can tell others what to be concerned about, but I personally am not. The reason is because Google Play and other Google apps don't have special privileges on GrapheneOS, unlike the Stock OS.

Fully understood, I am familiar with how Google apps on GrapheneOS are only installed as user apps, so they don't have the privileged status they're accustomed to having.

So my concern about this strange behaviour (the never-before-seen notification from Download Manager wanting to download something called FullArchive) wasn't that Google is (potentially) still collecting troves of information, because as you mentioned, those apps have very limited access, and I've further denied most permissions. Instead, my concern was whether or not the unexpected download was malicious?

I'm assuming because this is occurring within the com.android.vending, which is the Google Play Store package name, this is just related to a function of Google Play? Is that about right?