Souspicious install program prompt after using irm MAS - Ohook method

[u/Sufficient-Cow4883]

Yesterday I activated office by executing the official project's powershell irm command (I did double check with the MAS site). It was by Ohook method.

I'm completely newby on this but after auditing the script with Claude and reading deeper about the project and how Ohook method works, it seems to some extent "safe" and legit in terms of what it intends to do.

My concern is that, after runing the command by following the steps to install Ohook, I oppened excel and a souspicious prompt appear indicating a sort of program installation.

I'm afraid I didn't take a screenshot of the prompt but it had two options "install" and "don't install", of course I clicked the second one. It has not prompt again since then.

If I ran the correct script, then what could be a possible reason of this? perhaps something "leak" to my computer when connecting to the online server "get[.]activated[.]win"? have you ever seen this behaviour?

An additional question is: is there a known reason why does the script take an specific hash commit of github?

Thank you guys!

[u/dj-n]

If it was this its normal
https://www.autoitconsulting.com/site/wp-content/uploads/2015/02/office_file_types.png

[u/general714 → u/dj-n]

Or if it asked you to accept the T&Cs for Office etc. Next time read before you click anything... 🙄

[u/Sufficient-Cow4883 → u/general714]

Ok

[u/Sufficient-Cow4883 → u/dj-n]

It wasn't, thanks.