WAB stands for Windows Address Book. It’s also a name of a tool typically located inside these two file paths:<\/p>\n
In the past the program was used to manipulate .wab files, but\u00a0 nowadays it is a legacy tool and is not used that much anymore.<\/p>\n
Still, we can use it to do one more thing for us…<\/p>\n
When launched, it tries to load a wab32.dll library. The actual location and the name of a DLL is determined by the following Registry key:<\/p>\n
which typically points to:<\/p>\n
By changing this path you can load any DLL of your choice.<\/p>\n
Only if the DLLPath Registry path is not resolved the tool will try to load the wab32.dll from a current directory. So yet another opportunity for side-loading…<\/p>\n
Last, but not least – on older systems it could act as a persistence mechanism.<\/p>\n","protected":false},"excerpt":{"rendered":"
WAB stands for Windows Address Book. It’s also a name of a tool typically located inside these two file paths: c:\\Program Files (x86)\\Windows Mail\\wab.exe c:\\Program Files\\Windows Mail\\wab.exe In the past the program was used to manipulate .wab files, but\u00a0 nowadays … Continue reading