> ...or it could just monitor the keystrokes itself with SetWindowsHookEx() like this process.

...which any AV will immediately flag. This allows malware to keylog in a much less detectable way by piggybacking off trusted HP software