Can someone confirm a possible Windows Defender bug?

[NotNull]

This test very likely requires a reboot, so do not try if that is an issue
(ES.exe must be installed and Everything riunning)

TEST:

• Open Task Manager's Details Tab
• Make sure the Memory (active private working set) is visible
• Make note of it's value for MsMpEng.exe
• Start Command Prompt ( CMD.exe )
• Type or paste the following command and press ENTER:

  Code: Select all

  for /L %i in (1,1,64000) do @echo %i &@es.exe count:1

• Watch the memory usage of MsMpEng.exe

Here memory usage keeps growing, until I stopped it (press 'CTRL + C' in the Command Prompt window) at around 2GB RAM usage.
Usually a program gives memory back after a short period, but not in this case.
And as the msmpeng.exe process can't be stopped these days (protected), the only way to get your memory back is to reboot ...




Windows Version 21H2 (OS Build 19044.1645)

Defender:
Antimalware Client Version: 4.18.2203.5
Engine Version: 1.1.19200.5
Antivirus Version: 1.363.824.0
Antispyware Version: 1.363.824.0

[void]

Windows 10 21H1 (OS Build 19043.1586)
Antimalware Client Version: 4.18.2203.5

After 10,000 iterations: (~5 minutes)

Peak working set: 800,360 K
Memory (private working set): 272,716 K


MsMpEng.exe reached the peak of 800 MB within the first minute, then dropped down to around 200 MB.
Memory usage would keep going up a few MB / second to about 400 MB and then there would be some sort of 'trim' back down to 200-300 MB



Does this only occur for ES.exe?

[NotNull]

Thank you for taking the time to test this!

I did some more re-tests and sometimes memory usage caps out at 1.2 GB and then returns to more acceptable values, although still higher than usual. Sometimes mem usage keeps growing. Haven't found a pattern yet.

Does this only occur for ES.exe?

Although I first noticed it when using ES.exe (in a very inefficient/non-optimized way), other console applications behave the same. For example this one:

Code: Select all

for /l %X in (1,1,32000) DO c:\Tools\cygwin64\bin\touch.exe file%X.deleteme