Creating a process memory dump retrieval task

You can get a process memory dump file from the selected Kaspersky Endpoint Agent for Windows hosts. To do so, you must create a process memory dump retrieval task.

To create a process memory dump retrieval task:

1. Select the Tasks section in the program web interface window.

   This opens the task table.

2. Click the Add button and select Process memory dump in the Get data drop-down list.

   This opens the task creation window.

3. Configure the following settings:
   1. Process ID is the ID of the process for which you want to get a memory dump.
   2. MD5/SHA256 is the MD5 or SHA256 hash of the file of the process of which you want to get a memory dump. This field is optional.
   3. Description—Task description. This field is optional.
   4. Hostis the name or IP address of the host to which you want to assign the task.

      You can specify only one host.

      The process memory dump task can only be assigned to hosts with Kaspersky Endpoint Agent for Windows version 3.13 or later.

4. Click Add.

The process memory dump retrieval task is created. The task runs automatically after it is created.

The task creates a ZIP archive in Storage, which contains a file with information about the process and a process memory dump file. You can download the archive to your local computer.

If the task results in an error, the archive file contains the description of the error.

If you are using the

distributed solution

Two-level hierarchy of servers with Central Node components installed. This hierarchy allocates a primary control server (Primary Central Node (PCN)) and secondary servers (Secondary Central Nodes (SCN)).

multitenancy mode

Operation mode in which Kaspersky Anti Targeted Attack Platform is used to protect the infrastructure of multiple organizations or branch offices of the same organization simultaneously.

Users with the Security auditor role cannot create this task.

Users with the Security officer role do not have access to tasks.