Expand is a Windows utility used to expand one or more compressed CAB files. It has been used by BBSRAT to decompress a CAB file into executable content.
Expand can be used to decompress a local or remote CAB file into an executable.
Expand can be used to download or copy a file into an alternate data stream.
Expand can be used to download or upload a file over a network share.