Look for WH_KEYBOARD as well
Allow cuckoo to detect the runtime injection performed by FinFisher