ScriptBlockText:Get\-Keystrokes* OR (ScriptBlockText:Get\-ProcAddress\ user32.dll\ GetAsyncKeyState* ScriptBlockText:Get\-ProcAddress\ user32.dll\ GetForegroundWindow*)