Thanks, I need to reread it, because I'm not sure who invokes the syscall. Quite possibly it's automated via an innocuous looking DDE invocation. Basically, I'm

Thanks, I need to reread it, because I'm not sure who invokes the syscall. Quite possibly it's automated via an innocuous looking DDE invocation. Basically, I'm wondering what piece of code writes to the table and then makes some other aimed for application run the code from the table. If it's a piece of code that's already running as the same user, then the aim must be to make a higher privileged application to execute the code from the table. Need to brush up my Win32 knowledge to make sense of it, I guess.