Assuming that they're the standard SHA-1/30sec TOTP and the keylogger is smart enough to store it, at least two 6-digit codes and their approximate time (https:

Assuming that they're the standard SHA-1/30sec TOTP and the keylogger is smart enough to store it, at least two 6-digit codes and their approximate time (https://www.unix-ninja.com/p/attacking_google_authenticator https://www.unix-ninja.com/p/attacking_google_authenticator).