Portal.kms Tools Free -

The most sophisticated threat involves "portal.kms tools" that act as a dropper. Initially, they activate Windows successfully (to gain your trust), but after 30–90 days, they download additional malicious modules from a command-and-control server.