SetWindowsHookEx

• Installs a hook procedure for windowing / message events (keyboard, mouse, etc.).
• When a process in the hook's scope processes a matching event, Windows maps the hook DLL into that process and calls the procedure.
• Effect: your DLL is loaded into many GUI processes without an explicit remote thread.
• Classic keylogger vector (WH_KEYBOARD_LL).
• Requires the target to have a message queue (GUI processes).