the fake KMS activation tool displays a fake Windows activation interface, installs the malware loader, and disables Windows Defender in the background before delivering the final RAT payload.