Benign windows Download

firebase

Android /sdcard pathAndroid Download folder

SHA-256caad2743e884328ecd6397a6e0b43a27bd50aee0ee099c7a0cfc99b7ddc78c64

URLhttps://github.com/firebase/firebase-tools/releases/download/v15.30.1/firebase-tools-win.exe#/firebase.exe

MaleculeK₂(Li₆Te)O₈(AlAs₁₃C₁₂CaDy₄Er₄IP₃)H₁₀(Cm₃₀Cr₁₄Db₁₆F₁₄HfMg₃Os₁₉Po₂₄TiU)Md₇(Bi₁₅Pa₂Pt₂Si)

Evidence

PE imports module-path and file-I/O APIs and has appended data 0x0–0xd0

0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x3000000000000000000000000040010000............@...
⋯10 more rows

Large null run in executable (64+ bytes) 0x21ec0–0x220a0

⋯3 more rows
0x21ef090909090909090909090909090909090................
0x21f0000000000000000000000000000000000................
0x21f1000000000000000000000000000000000................
0x21f2000000000000000000000000000000000................
0x21f3000000000000000000000000000000000................
0x21f4001000000000000008280000000000000................
0x21f508a800000000000800080008000000080................
0x21f608b800000000000000100008000000000................
0x21f7081800080000000800980000000000080................
0x21f808a000000000000008800000000000000................
0x21f9009800080000000000a00008000000000................
0x21fa08b800080000000008b00000000000080................
0x21fb089800000000000800380000000000080................
0x21fc002800000000000808000000000000080................
⋯14 more rows

X25519 or Curve25519 algorithm reference 0x2ae00–0x2aed0

⋯3 more rows
0x2ae304c895f18488b7c2408488b742410f3c3L._.H.|$.H.t$...
0x2ae40583235353139207072696d6974697665X25519 primitive
0x2ae507320666f72207838365f36342c204352s for x86_64, CR
⋯8 more rows

ChaCha20/Salsa20 cipher constant 0x54e40–0x54f10

⋯3 more rows
0x54e7010000000100000001000000010000000................
0x54e80657870616e642033322d62797465206bexpand 32-byte k
0x54e9000436861436861323020666f72207838.ChaCha20 for x8
0x54ea0365f36342c2043525950544f47414d536_64, CRYPTOGAMS
⋯7 more rows

Large binary with repetitive padding 0x68c70–0x68d40

⋯3 more rows
0x68ca00300010206070405090a0b080c0d0e0f................
0x68cb055555555555555555555555555555555UUUUUUUUUUUUUUUU
0x68cc0333333333333333333333333333333333333333333333333
0x68cd00f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f................
⋯7 more rows