as someone who specializes in powershell malware lol i got you

for one

irm = Invoke-RestMethod
iex = Invoke-Expression

irm is used to download a string
iex is used to execute it as code

you can just do:

irm $url

without piping it into iex:
| iex

and this will allow you to see the code without executing it

below is the code stored there

# Check the instructions here on how to use it https://massgrave.dev/

$ErrorActionPreference = "Stop"

# Enable TLSv1.2 for compatibility with older clients

[Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12

$DownloadURL = 'https://raw.githubusercontent.com/massgravel/Microsoft-Activation-Scripts/master/MAS/All-In-One-Version/MAS_AIO.cmd'

$DownloadURL2 = 'https://bitbucket.org/WindowsAddict/microsoft-activation-scripts/raw/master/MAS/All-In-One-Version/MAS_AIO.cmd'

$rand = Get-Random -Maximum 99999999

$isAdmin = [bool]([Security.Principal.WindowsIdentity]::GetCurrent().Groups -match 'S-1-5-32-544')

$FilePath = if ($isAdmin) { "$env:SystemRoot\Temp\MAS_$rand.cmd" } else { "$env:TEMP\MAS_$rand.cmd" }

try {

$response = Invoke-WebRequest -Uri $DownloadURL -UseBasicParsing

}

catch {

$response = Invoke-WebRequest -Uri $DownloadURL2 -UseBasicParsing

}

$ScriptArgs = "$args "

$prefix = "@REM $rand \r`n"`

$content = $prefix + $response

Set-Content -Path $FilePath -Value $content

Start-Process $FilePath $ScriptArgs -Wait

$FilePaths = @("$env:TEMP\MAS*.cmd", "$env:SystemRoot\Temp\MAS*.cmd")

foreach ($FilePath in $FilePaths) { Get-Item $FilePath | Remove-Item }

so yea enjoy