pastebin - collaborative debugging tool
nrubsig.kpaste.net RSS


MsMpEng.exe kernel crash
Posted by Anonymous on Thu 8th May 2025 16:31
raw | new post

  1. 3: kd> !analyze -v
  2. *******************************************************************************
  3. *                                                                             *
  4. *                        Bugcheck Analysis                                    *
  5. *                                                                             *
  6. *******************************************************************************
  7.  
  8. MEMORY_MANAGEMENT (1a)
  9.     # Any other values for parameter 1 must be individually examined.
  10. Arguments:
  11. Arg1: 0000000000041791, The subtype of the bugcheck.
  12. Arg2: fffff880062b6fe0
  13. Arg3: ffffa28ec6056250
  14. Arg4: 0e000230002464ab
  15.  
  16. Debugging Details:
  17. ------------------
  18.  
  19.  
  20. KEY_VALUES_STRING: 1
  21.  
  22.     Key  : Analysis.CPU.Sec
  23.     Value: 4
  24.  
  25.     Key  : Analysis.DebugAnalysisProvider.CPP
  26.     Value: Create: 8007007e on WINGRENDEL02
  27.  
  28.     Key  : Analysis.DebugData
  29.     Value: CreateObject
  30.  
  31.     Key  : Analysis.DebugModel
  32.     Value: CreateObject
  33.  
  34.     Key  : Analysis.Elapsed.Sec
  35.     Value: 17
  36.  
  37.     Key  : Analysis.Memory.CommitPeak.Mb
  38.     Value: 123
  39.  
  40.     Key  : Analysis.System
  41.     Value: CreateObject
  42.  
  43.  
  44. BUGCHECK_CODE:  1a
  45.  
  46. BUGCHECK_P1: 41791
  47.  
  48. BUGCHECK_P2: fffff880062b6fe0
  49.  
  50. BUGCHECK_P3: ffffa28ec6056250
  51.  
  52. BUGCHECK_P4: e000230002464ab
  53.  
  54. BLACKBOXBSD: 1 (!blackboxbsd)
  55.  
  56.  
  57. BLACKBOXNTFS: 1 (!blackboxntfs)
  58.  
  59.  
  60. BLACKBOXWINLOGON: 1
  61.  
  62. PROCESS_NAME:  MsMpEng.exe
  63.  
  64. STACK_TEXT:  
  65. ffff8d82`d96e4478 fffff805`4d04c249 : 00000000`0000001a 00000000`00041791 fffff880`062b6fe0 ffffa28e`c6056250 : nt!KeBugCheckEx
  66. ffff8d82`d96e4480 fffff805`4d3ff9a6 : ffff8d82`d96e46c0 00000000`00000103 ffff8d82`00000002 00000000`00000000 : nt!MmUnlockPages+0xd89
  67. ffff8d82`d96e4570 fffff805`4d3fe703 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmCopyVirtualMemory+0x7d6
  68. ffff8d82`d96e49c0 fffff805`4d3fe59b : ffffe608`33ae1080 00000042`ac07d908 00000149`2c401fb0 00000042`ac07da20 : nt!MiReadWriteVirtualMemory+0x153
  69. ffff8d82`d96e4a50 fffff805`4d211e05 : 00000000`00000000 00000000`00000000 00000000`00000000 ffff9200`11379180 : nt!NtReadVirtualMemory+0x1b
  70. ffff8d82`d96e4a90 00007ffd`0bdedcd4 : 00007ffd`095eeaf5 00000042`ac07d9f8 00007ffc`b7a5d446 00000149`00000000 : nt!KiSystemServiceCopyEnd+0x25
  71. 00000042`ac07d8e8 00007ffd`095eeaf5 : 00000042`ac07d9f8 00007ffc`b7a5d446 00000149`00000000 00000149`57b68f80 : ntdll!NtReadVirtualMemory+0x14
  72. 00000042`ac07d8f0 00007ffc`b7b945ee : 000001c9`98aa0000 00000000`00010000 000001c9`98ab0000 00000000`00000040 : KERNELBASE!ReadProcessMemory+0x15
  73. 00000042`ac07d940 00007ffc`b7a5d1d6 : 00000149`57b68f80 00000042`ac07d9f8 00000042`ac07da70 000001c9`98aa0000 : mpengine!ReadProcessMemoryInternal+0x11e
  74. 00000042`ac07d9a0 00007ffc`b7a5ce41 : 000001c9`00000040 00000042`ac07da70 00000000`00010000 00000149`00000001 : mpengine!CSMSProcess::ScanRange+0x176
  75. 00000042`ac07da40 00007ffc`b834f3e2 : 00000149`57b68f80 00000000`00000001 00000000`00000002 00000000`00000000 : mpengine!CSMSProcess::Scan1Worker+0x2d5
  76. 00000042`ac07daf0 00007ffc`b7afbcd0 : 00000149`57b68f02 00000000`00000002 00000042`00000000 00000000`00000002 : mpengine!CSMSProcess::Scan+0x476
  77. 00000042`ac07dbd0 00007ffc`b8102f8f : 00000149`00000002 00000149`54da12b0 00000042`ac07ddf0 01dbc02c`9df4fe80 : mpengine!CEMSContext::EmsScan+0x344
  78. 00000042`ac07dca0 00007ffc`b8103659 : 00000149`2f9c1640 00000149`2f9c1640 00000149`58f50060 00000149`2f9c0bd0 : mpengine!RunEMS+0x41b
  79. 00000042`ac07de60 00007ffc`b81030b7 : 00000149`58f50060 00000149`392fde40 00000149`2f9c1700 00007ffc`00000009 : mpengine!CResmgrems::ScanImpl+0x21d
  80. 00000042`ac07df20 00007ffc`b7a70618 : 00000000`00000000 00000000`00000000 00000000`0000008e 00007ffc`b7942532 : mpengine!CResmgrems::Scan+0x17
  81. 00000042`ac07e070 00007ffc`b7fbd75f : 00000149`27854c70 00000042`ac07e380 00000000`00000000 00000149`28a754f0 : mpengine!ResmgrProcessResource+0x97c
  82. 00000042`ac07e240 00007ffc`b7fafbfd : 00000149`2d36faf0 00000000`00000000 00000000`00000000 00000149`2d36faf0 : mpengine!ResScan+0x8fb
  83. 00000042`ac07e690 00007ffc`b7a10ce4 : 00000149`39181370 00000000`00000000 00000149`2d36faf0 00007ffc`b8994500 : mpengine!ScanOpenWithContext+0x1af9
  84. 00000042`ac07ea90 00007ffc`b79cb02c : 00000149`39181370 00000000`00000000 00000000`00000000 00000000`00000078 : mpengine!UberScanOpen+0xad0
  85. 00000042`ac07eba0 00007ffc`b79ca209 : 00000042`ac07ee60 00000042`ac07ee60 00000000`00000002 00000000`00000002 : mpengine!ksignal+0xd4c
  86. 00000042`ac07ee40 00007ffc`b79fca6f : 00000000`00000000 00000042`ac07f780 00000149`47a27640 00000149`39181370 : mpengine!DispatchSignalHelper+0x71
  87. 00000042`ac07eea0 00007ffc`fcf5b072 : 00000000`00004026 00000149`47b24eb0 00000042`ac07f780 0000000f`89f37e01 : mpengine!DispatchSignalOnHandle+0x1a7
  88. 00000042`ac07f6a0 00007ffc`fd1c9e94 : 00000149`00000000 00000149`47b24eb0 00000149`39181370 00007ffc`fd394ee0 : mpsvc!rsignal_wrapper+0x1d2
  89. 00000042`ac07f730 00007ffc`fd1c1582 : 00000149`39108560 00000149`39108560 00000149`265b0120 00007ffc`fd394420 : mpsvc!OnDemandScanWorker+0x554
  90. 00000042`ac07f7b0 00007ffc`fd1c1425 : 00000149`39108560 00000149`39108570 00000000`000003a0 00000149`25f10cc0 : mpsvc!MpService::CMpSvcScanWorkItem::Run+0xae
  91. 00000042`ac07f810 00007ffc`fcfe8ebd : 00000149`39108560 00000149`39108570 00000149`265522a0 00000000`00000000 : mpsvc!MpService::CMpSvcScansQueue::Dispatch+0x35
  92. 00000042`ac07f850 00007ffc`fce35831 : 00000042`ac07f8c8 00000000`00000000 00000149`265c2a70 00006c22`3b2fa3d2 : mpsvc!MpService::CMpSvcScanWorkItem::OnAction+0x1d
  93. 00000042`ac07f880 00007ffc`fce3571f : 00000149`265522a0 00000149`265522b0 00000149`265522a0 00000149`265522b0 : MpClient!CommonUtil::CMpSimpleThreadPool::Call+0x59
  94. 00000042`ac07f8d0 00007ffd`0bdb3720 : 00000149`265b1610 00000149`265b16d8 00000149`47a279e0 00000149`265c2a70 : MpClient!CommonUtil::CMpSimpleThreadPool::AsyncDequeue+0xdf
  95. 00000042`ac07f940 00007ffd`0bd9d79a : 00000000`00000000 00000000`00000000 00000149`265c2a70 00000000`00000000 : ntdll!TppWorkpExecuteCallback+0x130
  96. 00000042`ac07f990 00007ffd`0b567374 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!TppWorkerThread+0x68a
  97. 00000042`ac07fc90 00007ffd`0bd9cc91 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : KERNEL32!BaseThreadInitThunk+0x14
  98. 00000042`ac07fcc0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21
  99.  
  100.  
  101. SYMBOL_NAME:  nt!MmUnlockPages+d89
  102.  
  103. MODULE_NAME: nt
  104.  
  105. STACK_COMMAND:  .thread ; .cxr ; kb
  106.  
  107. IMAGE_NAME:  memory_corruption
  108.  
  109. BUCKET_ID_FUNC_OFFSET:  d89
  110.  
  111. FAILURE_BUCKET_ID:  0x1a_41791_nt!MmUnlockPages
  112.  
  113. OS_VERSION:  10.0.19041.1
  114.  
  115. BUILDLAB_STR:  vb_release
  116.  
  117. OSPLATFORM_TYPE:  x64
  118.  
  119. OSNAME:  Windows 10
  120.  
  121. FAILURE_ID_HASH:  {257cd050-e4e1-a6f4-7c65-0c6aaef71f68}
  122.  
  123. Followup:     MachineOwner
  124. ---------

Submit a correction or amendment below (click here to make a fresh posting)
After submitting an amendment, you'll be able to view the differences between the old and new posts easily.

Syntax highlighting:

To highlight particular lines, prefix each line with {%HIGHLIGHT}




All content is user-submitted.
The administrators of this site (kpaste.net) are not responsible for their content.
Abuse reports should be emailed to us at