ShadowDumper LSASS Minidump Written to C:\Users\Public\ with Non-Standard Extension

Ethan Andrews@eandrews

•updated Jun 30, 2026•1•0•3

Detects the creation of files with non-standard extensions (.elf, .raw, .file, .sense) in the 'C:\Users\Public\' directory. This activity is indicative of the ShadowDumper tool, which generates LSASS memory dumps and writes them to publicly accessible paths using atypical file extensions to evade signature-based detection.