Expand.exe used to extract embedded .cab file

Renata Cardoso@rcardososec

•updated Aug 10, 2026•1•0•1

Detects execution of expand.exe to extract an embedded Microsoft Cabinet (.cab) file, consistent with multi-stage malware payload extraction