Wab.exe

Windows address book manager

Execute

Execute dll file. Bypass defensive counter measures

wab.exe

Change HKLM\Software\Microsoft\WAB\DLLPath and execute DLL of choice — MITRE: T1218 — Privileges: Administrator