github.com / massgravel

massgravel/Microsoft-Activation-Scripts

Batchfile·15 files·commit 6401d2f·scanned 4d ago·cached ✓

15/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 15 — 188,201+ stars — findings likely false positives

verdict accurate?

188,201 stars

threat-state: lowlive

FINDINGS ░▒▓

warningSuspicious Windows batch commandBatch file contains commands commonly used to download and execute remote payloads (powershell, certutil, bitsadmin, curl to pipe, etc.).MAS/Separate-Files-Version/Activators/HWID_Activation.cmd

::  Check PowerShell

::pstst $ExecutionContext.SessionState.LanguageMode :pstst

echo:
echo Windows Vista RTM is not supported because Powershell cannot be installed.
echo Upgrade to Windows Vista SP1 or SP2.
)

echo:
echo Windows Vista RTM is not supported because Powershell cannot be installed.
echo Upgrade to Windows Vista SP1 or SP2.
)

infoSuspicious file in repoExecutable file (MAS_AIO.cmd) in repositoryMAS/All-In-One-Version-KL/MAS_AIO.cmd+2

infoSuspicious file in repoVery large source file (744KB) — could contain obfuscated payloadMAS/All-In-One-Version-KL/MAS_AIO.cmd+2

infoSuspicious file in repoExecutable file (HWID_Activation.cmd) in repositoryMAS/Separate-Files-Version/Activators/HWID_Activation.cmd+2

infoAuthor has no other public repositoriesGitHub user "Lyssa" has no other public repositories, common for burner accounts used in scams.+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

8 files scanned @ 6401d2f | 8/25/2026 | heuristic scan — always review manually

risk by category

code execution25

network & exfiltration0

file system access0

obfuscation0

supply chain15

owasp / injection0

telemetry

files 8/15rules hit 7engine v5commit 6401d2f

github

massgravel/Microsoft-Activation-Scripts

Open-source Windows and Office activator featuring HWID, Ohook, TSforge, and Online KMS activation methods, along with advanced troubleshooting.

Batchfile

188201

17982

2421d

15 files

8 scanned(53%)

6401d2f

architecture░▒▓

No architecture graph available. This usually happens when the repo contains no scannable JS/TS/Python files or only a single file was analyzed.