Benign Download

install-locations.md

Encoded payload detected: base64Encoded shell interpreter (unicode escapes)

SHA-2569352fc96d2ff9abf221868d8bab428ecfea8b9158468dd87b8a6d693692ffcde

URLhttps://github.com/dotnet/designs/blob/main/accepted/2020/install-locations.md

Evidence

Encoded payload detected: base64 line 161

161:205… data-pjax-transient="true"/><meta name="visitor-payload" content="eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJFQjlDOjI3REY1MDpDRDJFRkQ6MTE5RUQxQTo2QTZGNTdEOCIsInZpc2l0b3JfaWQiOiI0MDIwNjI3ODI5NDE2NzQ0OTIwIiwicmVnaW9uX2VkZ2UiOiJpYWQiLCJyZWdpb25fcmV …

Percent-encoded content decoded lines 336–339

41… er-2 text-right d-lg-none gap-2 flex-justify-end">
        <a
          href="/login?return_to=https%3A%2F%2Fgithub.com%2Fdotnet%2Fdesigns%2Fblob%2Fmain%2Faccepted%2F2020%2Finstall-locations.md"
          class="HeaderMenu-link Head …

Encoded shell interpreter (unicode escapes) line 1317

1317:41186… arched as well:\n\u003cul dir=\"auto\"\u003e\n\u003cli\u003e🆕 global registered install location\n\u003cul dir=\"auto\"\u003e\n\u003cli\u003eWindows - \u003ccode\u003eHKLM\\SOFTWARE\\dotnet\\Setup\\InstalledVersions\\\u0026lt;arch\u0026gt;\\InstallLocation\u003c/code\u003e (32-bit view)\u003 …