A very strange file appeared in my main user system

Gdd

Its called .exmu-cfg.data

But i cant access it... With a date before i used the system

Gdd

Gdd how can i send it for analysis?

tac

Gdd There are some idiosyncrasies on Android related to how filenames with an initial dot . are handled: for example I can copy such a file from the device via MTP but I can't copy the same file back, and I can't "open" it on the device either. It might be an issue on the Windows side: I never bothered to investigate it deeper as I still remember the times when I had to patch a DLL just to get rid of a prompt trying to stop me every time from copying over media files because maybe the device cannot play them – starting from that point, the fact that you can access the files without any pestering prompts can already be considered tremendous progress. Anyway, that is by design and no reason for concern. You should be able to access such files normally with an app on the device (there's an option to "show hidden files," since such files are traditionally considered "hidden" by UN*X convention).

From my observation, such files with cryptic unique identifiers inside are par for the course with Chinese apps, and of course the purpose is usually to track you in a more persistent way. A cursory search suggest this particular file could have been created by Shein. If you use such apps, it might be a good idea to check out GrapheneOS's profile functionality so that you can let them do all that stuff in a separate space, and delete it when done. Alternatively you can try to enable storage scopes for such apps.

Gdd

The content of the file is this

0k62OHG770fAotFQ8ZccH34esR0w3kU3

Gdd

The log behind this file

type: logcat
osVersion: google/komodo/komodo:16/BP2A.250705.008/2025070800:user/release-keys
buffers: main,system,kernel
level: verbose
filterRegex: exmu

--------- beginning of main
07-18 18:48:33.627 10149  2984  3149 D MediaProvider: Open with FUSE. FilePath: /storage/emulated/0/Download/_.exmu-cfg1.txt. Uid: 10149. Media Capabilities Uid: 0. ShouldRedact: false. ShouldTranscode: false
07-18 18:48:33.676 10149  2984  3149 D MediaProvider: Open with FUSE. FilePath: /storage/emulated/0/Download/_.exmu-cfg1.txt. Uid: 10149. Media Capabilities Uid: 0. ShouldRedact: false. ShouldTranscode: false
07-18 18:48:33.678 10149  2984  3117 D MediaProvider: Open with FUSE. FilePath: /storage/emulated/0/Download/_.exmu-cfg1.txt. Uid: 10149. Media Capabilities Uid: 0. ShouldRedact: false. ShouldTranscode: false
07-18 18:48:33.744 10149  2984  3117 D MediaProvider: Open with FUSE. FilePath: /storage/emulated/0/Download/_.exmu-cfg1.txt. Uid: 10149. Media Capabilities Uid: 0. ShouldRedact: false. ShouldTranscode: false
07-18 18:48:33.755 10149  2984  3149 D MediaProvider: Open with FUSE. FilePath: /storage/emulated/0/Download/_.exmu-cfg1.txt. Uid: 10149. Media Capabilities Uid: 0. ShouldRedact: false. ShouldTranscode: false
07-18 18:48:33.776 10149  2984  3117 D MediaProvider: Open with FUSE. FilePath: /storage/emulated/0/Download/_.exmu-cfg1.txt. Uid: 10149. Media Capabilities Uid: 0. ShouldRedact: false. ShouldTranscode: false
07-18 18:48:33.781 10149  2984  3117 D MediaProvider: Open with FUSE. FilePath: /storage/emulated/0/Download/_.exmu-cfg1.txt. Uid: 10149. Media Capabilities Uid: 0. ShouldRedact: false. ShouldTranscode: false
07-18 18:48:33.791 10149  2984  3117 D MediaProvider: Open with FUSE. FilePath: /storage/emulated/0/Download/_.exmu-cfg1.txt. Uid: 10149. Media Capabilities Uid: 0. ShouldRedact: false. ShouldTranscode: false
07-18 18:48:34.219 10149  2984  3149 D MediaProvider: Open with FUSE. FilePath: /storage/emulated/0/Download/_.exmu-cfg1.txt. Uid: 10149. Media Capabilities Uid: 0. ShouldRedact: false. ShouldTranscode: false
07-18 18:48:34.238 10149  2984  3149 D MediaProvider: Open with FUSE. FilePath: /storage/emulated/0/Download/_.exmu-cfg1.txt. Uid: 10149. Media Capabilities Uid: 0. ShouldRedact: false. ShouldTranscode: false
07-18 18:48:34.267 10149  2984  3117 D MediaProvider: Open with FUSE. FilePath: /storage/emulated/0/Download/_.exmu-cfg1.txt. Uid: 10149. Media Capabilities Uid: 0. ShouldRedact: false. ShouldTranscode: false
07-18 18:48:34.287 10149  2984  3149 D MediaProvider: Open with FUSE. FilePath: /storage/emulated/0/Download/_.exmu-cfg1.txt. Uid: 10149. Media Capabilities Uid: 0. ShouldRedact: false. ShouldTranscode: false
07-18 18:48:34.309 10149  2984  3149 D MediaProvider: Open with FUSE. FilePath: /storage/emulated/0/Download/_.exmu-cfg1.txt. Uid: 10149. Media Capabilities Uid: 0. ShouldRedact: false. ShouldTranscode: false
07-18 18:48:34.319 10149  2984  3117 D MediaProvider: Open with FUSE. FilePath: /storage/emulated/0/Download/_.exmu-cfg1.txt. Uid: 10149. Media Capabilities Uid: 0. ShouldRedact: false. ShouldTranscode: false
07-18 18:48:34.327 10149  2984  3117 D MediaProvider: Open with FUSE. FilePath: /storage/emulated/0/Download/_.exmu-cfg1.txt. Uid: 10149. Media Capabilities Uid: 0. ShouldRedact: false. ShouldTranscode: false
07-18 18:48:34.339 10149  2984  3149 D MediaProvider: Open with FUSE. FilePath: /storage/emulated/0/Download/_.exmu-cfg1.txt. Uid: 10149. Media Capabilities Uid: 0. ShouldRedact: false. ShouldTranscode: false
07-18 18:48:34.347 10149  2984  3149 D MediaProvider: Open with FUSE. FilePath: /storage/emulated/0/Download/_.exmu-cfg1.txt. Uid: 10149. Media Capabilities Uid: 0. ShouldRedact: false. ShouldTranscode: false
07-18 18:48:34.363 10149  2984  3149 D MediaProvider: Open with FUSE. FilePath: /storage/emulated/0/Download/_.exmu-cfg1.txt. Uid: 10149. Media Capabilities Uid: 0. ShouldRedact: false. ShouldTranscode: false
07-18 18:50:42.525 10149  2984  3276 W ModernMediaScanner: Failed to visit /storage/emulated/0/Download/_.exmu-cfg1.txt: java.nio.file.NoSuchFileException: /storage/emulated/0/Download/_.exmu-cfg1.txt
07-18 18:51:24.888 10061  5863  5863 D LogcatActivity: command: logcat --buffer=main,system,kernel -d --dividers --format=UTC,printable,uid,descriptive --regex=exmu *:V

Gdd

When booting this is the log

type: logcat
osVersion: google/komodo/komodo:16/BP2A.250705.008/2025070800:user/release-keys
buffers: main,system,crash,events,kernel
level: verbose
filterRegex: exmu

--------- beginning of main
07-18 18:55:55.032 10061  3668  3668 D LogcatActivity: command: logcat --buffer=main,system,crash,events,kernel -d --dividers --format=UTC,printable,uid,descriptive --regex=exmu *:V

Gdd

Im very worried about this because happened from nothing. The file didnt exists and im a higly target for hacking.

Gdd

This is something very strange

Gdd

I dont have deepseek . and no google apps or anything in main account. The file appeared today with date of april 22.... That time i havent bought this pixel

DeletedUser495

Calm down, it's a plain text file that appears in your Downloads folder because you likely downloaded it by mistake. This kind of file can't execute any malicious code.

Gdd

DeletedUser495 no i didnt.. My mobile was chargind and i was away from my house.... That happened now...thanks for trying calming me down but i assure that this file dated april 22 wasnt here

Lilac6044

Gdd It has been reported that this file has turned up after downloading a number of apps, Shein, Temu, Deepseek etc. It is likely the result of an app being downloaded. Regardless, like SgtSurehand said, this type of file is harmless.

Gdd

Lilac6044 i havent download any of them... Thats the problem... The date of the file also is not corretct... April 22 i didnt havê bought a pixel... The file appeared today and opened a vanadium web page which i never know it existes: hackaday.com. i was away from the mobile

p-marg

This is just a basic text file, happens especially with apps coming out of China, it's like a config file, where the app looks for changes I believe, someone will correct me if I'm wrong!

To put it simply, It’s just a file on your device (like a piece of paper in a folder called Download).

Gdd

And i never installed nothing on main account ...

Lilac6044

Gdd If you are that worried, then factory reset your phone and that will give you some peace of mind.

DeletedUser495

Lilac6044 You would agree with me that won't be necessary. Just delete the dang file. I lots of times ended up with media in my Downloads folder which had creation date well before I owned my device and I not once thought I was getting hacked. :)

Lilac6044

DeletedUser495 100%, I agree that deleting the file is more than sufficient.

angela

Factory reset if you have the time and can easily restore

Gdd

I still think grapheneos crew should look at those logs... Asking gemini the ai das very concerning about this

angela

Gdd Unfortunately they likely don't have time. They are a small team that has been through a lot. Use the tools included to check your phone (auditor) or just do a fresh reinstall or wipe.

If you use no other Apps in the main profile, other than default, then something happened.

Just do a fresh reinstall if your threat model is that high.

When your threat model is high, paranoia is a good thing.