Security and verification

This page explains how to check for yourself that the scripts you are about to run came from the official project. It deliberately publishes no checksums, no scan results and no safety guarantees, because this site cannot verify those on your behalf.

1. Get the files from a source you can trace

Everything the project publishes is reachable from the official repository and its mirrors:

A copy from anywhere else — a forum attachment, a file locker, a video description, a lookalike domain — cannot be traced back to the project and should be treated as untrusted.

2. Compare a download against the repository yourself

The scripts are plain batch files, so you can read them. Compute the hash of what you downloaded and compare it with the same file fetched directly from the repository:

Get-FileHash .\MAS_AIO.cmd -Algorithm SHA256

Then download the same file straight from the official repository, hash that copy, and compare the two strings. If they differ, the copy you obtained elsewhere was modified. We do not publish reference hashes here: a hash printed on a third-party site proves nothing that fetching the file from the project itself does not prove better.

3. Check the PowerShell one-liner before running it

The common install line pipes a remote script into the interpreter. Fetch it and read it first rather than executing it blind:

irm https://get.activated.win | Out-File mas.ps1
notepad mas.ps1

Altered variants of this one-liner, pointing at a different host, are the most common way malware is passed off as MAS. Check the domain character by character.

4. Verify who owns the repository

A convincing fork is easy to make; an account history is not. On the repository page, check that the owner is massgravel and not a lookalike such as massgrave1 or massgravei, that the repository is not marked as a fork of something else, and that its commit history goes back years rather than days. Cross-check the same owner name from a second independent place — the official website, the Azure DevOps mirror and the self-hosted Git mirror should all point at each other.

5. Inspect release provenance

For a given release on the releases page, look at what the platform itself records rather than what the description claims:

Which tag the release was built from, and whether that tag exists in the repository history.
Who published it, and whether that account publishes the other releases too.
Whether the asset list matches the files you were given — an extra installer or .exe is a red flag.
Whether the release date lines up with the commits it claims to contain.

6. Compare hashes when the project publishes them

If, and only if, the upstream project publishes a checksum for a release, compare it against your copy. Take the value from the official release or repository page — never from the site that gave you the file:

Get-FileHash .\MAS_AIO.cmd -Algorithm SHA256

Compare the string character by character. A mismatch means the file was modified. This site publishes no reference hashes of its own, because a hash we generated proves only what we downloaded.

7. Avoiding unofficial mirrors

Type the official domain yourself rather than following a search advert or a shortened link.
Treat file lockers, forum attachments, Telegram channels and video descriptions as unverifiable.
Be suspicious of any copy packaged as an installer, an .exe, or an archive with a password.
Read the domain one character at a time; homoglyph domains are the standard trick in this niche.
Ignore "100% clean" claims, scan-result badges and download counters — none of them are evidence.

8. Reporting a suspicious copy

If you find a copy that behaves differently from the repository version, report it where it can act on: open an issue on the official repository with the URL and what differs, report the host to its abuse contact, and report a lookalike domain to its registrar. If you found the bad copy linked from a page on this site, tell us and we will remove the link.

9. Why antivirus software reacts

Activation tooling manipulates licensing components, so scanners commonly classify it as riskware, HackTool or "not-a-virus". A detection of that class is expected behaviour for this category of software and is not, on its own, evidence of malware — nor is the absence of a detection evidence that a particular copy is clean. That judgement is yours to make, on a copy whose origin you have verified.

10. What this site will not tell you

That any download is "100% safe" or "zero malware" — no one can verify that for your copy.
Reference hashes or signatures we did not generate from an official artifact.
Scan results, ratings or download counts as evidence of trustworthiness.