Windows address book manager
wab.exe
Change HKLM\Software\Microsoft\WAB\DLLPath and execute DLL of choice
Execute dll file. Bypass defensive counter measures
C:\Program Files\Windows Mail\wab.exe, C:\Program Files (x86)\Windows Mail\wab.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/registry/registry_set/registry_set_wab_dllpath_reg_change.yml, IOC: WAB.exe should normally never be used
Adam (@Hexacorn)