From ef411e14ca2e46177decfe3c2b01db7f535b01ba Mon Sep 17 00:00:00 2001
From: WindowsAddict
Date: Wed, 2 Jul 2025 23:35:17 +0530
Subject: Evade AV detection

---
 MAS/Separate-Files-Version/Extract_OEM_Folder.cmd | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'MAS/Separate-Files-Version/Extract_OEM_Folder.cmd')

diff --git a/MAS/Separate-Files-Version/Extract_OEM_Folder.cmd b/MAS/Separate-Files-Version/Extract_OEM_Folder.cmd
index 43664f2..d13e77e 100644
--- a/MAS/Separate-Files-Version/Extract_OEM_Folder.cmd
+++ b/MAS/Separate-Files-Version/Extract_OEM_Folder.cmd
@@ -206,7 +206,7 @@ goto done2
 
 ::pstst $ExecutionContext.SessionState.LanguageMode :pstst
 
-for /f "delims=" %%a in ('%psc% "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[io.file]::ReadAllText('!_batp!') -split ':pstst';iex ($f[1])}" %nul6%') do (set tstresult=%%a)
+for /f "delims=" %%a in ('%psc% "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[System.IO.File]::ReadAllText('!_batp!') -split ':pstst';& ([scriptblock]::Create($f[1]))}" %nul6%') do (set tstresult=%%a)
 
 if /i not "%tstresult%"=="FullLanguage" (
 %eline%
@@ -818,7 +818,7 @@ exit /b
 
 :export
 
-%psc% "$f=[io.file]::ReadAllText('!_batp!') -split \":%~1\:.*`r`n\"; [io.file]::WriteAllText('!_pdesk!\$OEM$\$$\Setup\Scripts\SetupComplete.cmd',$f[1].Trim(),[System.Text.Encoding]::ASCII);"
+%psc% "$f=[System.IO.File]::ReadAllText('!_batp!') -split \":%~1\:.*`r`n\"; [io.file]::WriteAllText('!_pdesk!\$OEM$\$$\Setup\Scripts\SetupComplete.cmd',$f[1].Trim(),[System.Text.Encoding]::ASCII);"
 exit /b
 
 ::========================================================================================================================================
-- 
cgit v1.2.3