What "legit" can and cannot mean here
Two separate questions get mixed together. The first is technical: is the code safe to run? The second is legal: are you allowed to activate software you did not license? This article answers the first, which is checkable. The second is a decision you make yourself.
The code is readable, and that is the point
MAS is batch and PowerShell — plain text throughout the activation path. You can open every file in Notepad and see every command before it runs. That property is genuinely rare in this category, where the norm is a packed EXE from a forum post.
Readable does not automatically mean safe. It means verification is possible, and a very large number of people have done it.
Why Defender flags it
The detection is HackTool:Win32/AutoKMS. Read the name literally — it classifies activation tooling by purpose, not by behaviour. The same family name fires on legitimate enterprise KMS utilities used inside corporate networks.
Ohook adds a second reason: it places a small library next to Office, which pattern-matches to DLL side-loading. The technique is used by malware; the heuristic is accurate about the technique and wrong about intent.
What should worry you is a different family name. Trojan, Stealer, Miner, Banker, RAT — those do not describe MAS and mean you have a repackaged copy.
What MAS does not do
- No installed service
- No persistent background process (except the optional Online KMS renewal task, visible in Task Scheduler)
- No telemetry, no account, no phone-home beyond activation infrastructure
- No modification of system files outside the licensing store
Where the risk actually is
Clones. Because the code copies in seconds, look-alike sites offer "massgrave" as an EXE, an installer, or a password-locked archive. That is where miners and info-stealers appear, bolted onto otherwise working script code.
The tells are consistent: EXE instead of script, a password from a video description, instructions to disable antivirus before downloading, or a "download manager" pushed first.
The five-minute verification
- Use the one-liner
irm https://get.activated.win | iex— no archive in the chain. - If you use the archive, open
MAS_AIO.cmdand read it. - Hash it and compare with the published value.
- Multi-engine scan; expect AutoKMS hits, be suspicious of anything else.
- Watch the network after activation. Sustained outbound traffic is not normal.
Do those and the technical question is settled.
Get the script
Open Terminal (Admin) or PowerShell (Admin) and run:
irm https://get.activated.win | iex
Prefer offline? Grab the archive from the download page and run MAS_AIO.cmd as administrator. More help: MAS script overview · Massgrave Windows guide · troubleshooting · error decoder.