You cannot tell the difference. The "portable" version is worse because it doesn't install an identifiable program—it just runs, injects code, and vanishes. Your AV log will show "Keys7.exe attempted to modify LSASS.exe" (a classic sign of credential dumping).
Attackers can use such tools to extract hardcoded cryptographic keys from Siemens PLCs, potentially compromising entire industrial control lines. 🔍 Analysis of "keys7.exe" Common Purpose keys7exe download portable