Benign Download

LICENSE

HTA contains encoded remote URLEncoded payload detected: base64

SHA-2568e49a01fc3d0b0134b96ded8c23e3cb630ea28c9956e70e69c1d5a432c8ada03

URLhttps://github.com/zloirock/core-js/blob/v3.49.0/LICENSE

Evidence

Copilot identity reference lines 52–54

52  <script type="application/json" id="client-env">{"locale":"en","featureFlags":["actions_enable_background_steps","activity_diff_file_tree","activity_repos_file_tree","activity_repos_overview_header","activity_repos_overview_sidebar","agent_author_search_expansion","agent_author_search_expansion_ui_pulls","alternate_user_config_repo","artifact_ui_v2","billing_billable_licenses_cost_center_bucket_fix","billing_cost_center_user_level_budgets","billing_discount_threshold_notification","billing_multi_user_cost_center_total_user_count","billing_user_level_budgets","billing_user_level_budgets_manage","ccr_files_changed_model_picker","code_quality_enablement_banner_targeting","code_quality_new_repo_selection_card","code_quality_remove_preview","code_view_raf_sticky_lines","code_view_react_header","codespaces_prebuild_region_target_update","coding_agent_third_party_model_ui","comment_viewer_copy_raw_markdown","contentful_primer_code_blocks","copilot_agent_snippy","copilot_api_agentic_issue_marshal_yaml","copilot_ask
53<script crossorigin="anonymous" type="module" src="https://github.githubassets.com/assets/high-contrast-cookie-9d73b8ae1abef9dc.js"></script>
54<script crossorigin="anonymous" type="module" src="https://github.githubassets.com/assets/wp-runtime-565ff4bd534f5d0b.js" defer="defer"></script>

Encoded payload detected: base64 line 157

157  <meta name="request-id" content="88F0:327BF5:13FEA9:1B9666:6A638FFB" data-pjax-transient="true"/><meta name="html-safe-nonce" content="d133ad0ef446ff2aa843f7e64f14d070ce213bfd262b5e8bd8d1b366700bd7ce" data-pjax-transient="true"/><meta name="visitor-payload" content="eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiI4OEYwOjMyN0JGNToxM0ZFQTk6MUI5NjY2OjZBNjM4RkZCIiwidmlzaXRvcl9pZCI6IjQyNjg1MzI3MTg5NzA4MzQ5MzkiLCJyZWdpb25fZWRnZSI6ImlhZCIsInJlZ2lvbl9yZW5kZXIiOiJpYWQifQ==" data-pjax-transient="true"/><meta name="visitor-hmac" content="aaf5d7fec7171a60917633c0ec2e0c9c02a6e75d42f5f230945c4fc8c293555b" data-pjax-transient="true"/>

Contains a hostname field token line 207

207 <meta name="hostname" content="github.com">

Encoded payload detected: url lines 332–336

    <div class="d-flex flex-1 flex-order-2 text-right d-lg-none gap-2 flex-justify-end">
        <a
          href="/login?return_to=https%3A%2F%2Fgithub.com%2Fzloirock%2Fcore-js%2Fblob%2Fv3.49.0%2FLICENSE"
          class="HeaderMenu-link HeaderMenu-button d-inline-flex f5 no-underline border color-border-default rounded-2 px-2 py-1 color-fg-inherit js-prevent-focus-on-mobile-nav"
          data-hydro-click="{&quot;event_type&quot;:&quot;authentication.click&quot;,&quot;payload&quot;:{&quot;location_in_page&quot;:&quot;site header menu&quot;,&quot;repository_id&quot;:null,&quot;auth_type&quot;:&quot;SIGN_UP&quot;,&quot;originating_url&quot;:&quot;https://github.com/zloirock/core-js/blob/v3.49.0/LICENSE&quot;,&quot;user_id&quot;:null}}" data-hydro-click-hmac="cbd9bb35f3a4860ee7eab2aee6230f5298ec8894f37d02a15182f60ded936763"