Windows 10: BSOD caused by PAGE_FAULT_IN_NONPAGED_AREA50 and MsMpEng.exe

My computer will run into BSOD almost always after continual running 7 days. I am wondering which part could cause this problem? Software or hardware? I saw that the problem could be caused by memory so I reinstalled my memory and verified it is correctly installed but the problem still pops up again. Here are the memory dump file analysis by windbg.exe for reference. Thanks!



Microsoft R Windows Debugger Version 10.0.18362.1 AMD64

Copyright c Microsoft Corporation. All rights reserved.





Loading Dump File [C:\Windows\MEMORY.DMP]

Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.





************* Path validation summary **************

Response Time ms Location

Deferred SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols

Symbol search path is: SRV*C:\Symbols*http://msdl.microsoft.com/download/symbols

Executable search path is:

Windows 10 Kernel Version 18362 MP 24 procs Free x64

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 18362.1.amd64fre.19h1_release.190318-1202

Machine Name:

Kernel base = 0xfffff800`52c00000 PsLoadedModuleList = 0xfffff800`53048170

Debug session time: Fri May 22 07:18:20.595 2020 UTC - 4:00

System Uptime: 0 days 20:01:35.269

Loading Kernel Symbols

...............................................................

................................................................

...............................................................

Loading User Symbols

PEB is paged out Peb.Ldr = 00000065`31483018. Type ".hh dbgerr001" for details

Loading unloaded module list

.......

For analysis of this file, run !analyze -v

9: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************



PAGE_FAULT_IN_NONPAGED_AREA 50

Invalid system memory was referenced. This cannot be protected by try-except.

Typically the address is just plain bad or it is pointing at freed memory.

Arguments:

Arg1: ffff8109a4967c08, memory referenced.

Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.

Arg3: fffff800532b411b, If non-zero, the instruction address which referenced the bad memory

address.

Arg4: 0000000000000002, reserved



Debugging Details:

------------------





KEY_VALUES_STRING: 1





PROCESSES_ANALYSIS: 1



SERVICE_ANALYSIS: 1



STACKHASH_ANALYSIS: 1



TIMELINE_ANALYSIS: 1





DUMP_CLASS: 1



DUMP_QUALIFIER: 401



BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202



SYSTEM_MANUFACTURER: System manufacturer



SYSTEM_PRODUCT_NAME: System Product Name



SYSTEM_SKU: SKU



SYSTEM_VERSION: System Version



BIOS_VENDOR: American Megatrends Inc.



BIOS_VERSION: 1302



BIOS_DATE: 01/20/2020



BASEBOARD_MANUFACTURER: ASUSTeK COMPUTER INC.



BASEBOARD_PRODUCT: ROG CROSSHAIR VIII HERO WI-FI



BASEBOARD_VERSION: Rev X.0x



DUMP_TYPE: 1



BUGCHECK_P1: ffff8109a4967c08



BUGCHECK_P2: 0



BUGCHECK_P3: fffff800532b411b



BUGCHECK_P4: 2



READ_ADDRESS: ffff8109a4967c08



FAULTING_IP:

nt!ObpCreateHandle+87b

fffff800`532b411b 488b4608 mov rax,qword ptr [rsi+8]



MM_INTERNAL_CODE: 2



CPU_COUNT: 18



CPU_MHZ: ed1



CPU_VENDOR: AuthenticAMD



CPU_FAMILY: 17



CPU_MODEL: 71



CPU_STEPPING: 0



DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT



BUGCHECK_STR: AV



PROCESS_NAME: MsMpEng.exe



CURRENT_IRQL: 0



ANALYSIS_SESSION_HOST: DESKTOP-UK5AERM



ANALYSIS_SESSION_TIME: 05-22-2020 10:36:51.0393



ANALYSIS_VERSION: 10.0.18362.1 amd64fre



TRAP_FRAME: ffff9388df8ed140 -- .trap 0xffff9388df8ed140

NOTE: The trap frame does not contain all registers.

Some register values may be zeroed or incorrect.

rax=ffffa80c04b7e080 rbx=0000000000000000 rcx=0000000000000000

rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000

rip=fffff800532b411b rsp=ffff9388df8ed2d0 rbp=ffff9388df8ed3f0

r8=0000000000000000 r9=0000000000000000 r10=0000000000000001

r11=ffff9388df8ed840 r12=0000000000000000 r13=0000000000000000

r14=0000000000000000 r15=0000000000000000

iopl=0 nv up ei ng nz na po cy

nt!ObpCreateHandle+0x87b:

fffff800`532b411b 488b4608 mov rax,qword ptr [rsi+8] ds:00000000`00000008=????????????????

Resetting default scope



LAST_CONTROL_TRANSFER: from fffff80052e2dd34 to fffff80052dc2390



STACK_TEXT:

ffff9388`df8ece98 fffff800`52e2dd34 : 00000000`00000050 ffff8109`a4967c08 00000000`00000000 ffff9388`df8ed140 : nt!KeBugCheckEx

ffff9388`df8ecea0 fffff800`52cc91af : a80c04e7`0090fffe 00000000`00000000 00000000`00000000 ffff8109`a4967c08 : nt!MiSystemFault+0x195c94

ffff9388`df8ecfa0 fffff800`52dd041e : 00000000`00000000 00000000`df8ed840 00000000`00000000 ffffa80c`04e700a0 : nt!MmAccessFault+0x34f

ffff9388`df8ed140 fffff800`532b411b : ffff9388`df8ed3f0 00000000`00000001 00000000`00000000 ffff8109`a4967c20 : nt!KiPageFault+0x35e

ffff9388`df8ed2d0 fffff800`532aa75c : ffff9388`df8ed820 ffffa80c`04e64080 00000000`00000000 00000000`00000000 : nt!ObpCreateHandle+0x87b

ffff9388`df8ed500 fffff800`5329d78e : ffffa80c`04b7e080 ffff9388`df8edb80 00000000`00000000 00000000`00000000 : nt!ObOpenObjectByPointer+0xec

ffff9388`df8ed760 fffff800`5329d573 : 00000065`336fd528 00000000`00000066 00000000`00000000 00000000`000003e3 : nt!PsOpenThread+0x20e

ffff9388`df8edac0 fffff800`52dd3c18 : ffffa80c`04b7e080 ffff9388`00000000 ffff9388`df8edb80 00000222`08707890 : nt!NtOpenThread+0x23

ffff9388`df8edb00 00007ffb`df3de584 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28

00000065`336fd0a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffb`df3de584





THREAD_SHA1_HASH_MOD_FUNC: e7308cb5b2bce3259fcb2a2d82b2a4ae62d0edb9



THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 6e415a18470408776de4bd4e59a14db327878c3e



THREAD_SHA1_HASH_MOD: 9f457f347057f10e1df248e166a3e95e6570ecfe



FOLLOWUP_IP:

nt!ObpCreateHandle+87b

fffff800`532b411b 488b4608 mov rax,qword ptr [rsi+8]



FAULT_INSTR_CODE: 8468b48



SYMBOL_STACK_INDEX: 4



SYMBOL_NAME: nt!ObpCreateHandle+87b



FOLLOWUP_NAME: MachineOwner



MODULE_NAME: nt



IMAGE_NAME: ntkrnlmp.exe



DEBUG_FLR_IMAGE_TIMESTAMP: 0



STACK_COMMAND: .thread ; .cxr ; kb



BUCKET_ID_FUNC_OFFSET: 87b



FAILURE_BUCKET_ID: AV_R_INVALID_nt!ObpCreateHandle



BUCKET_ID: AV_R_INVALID_nt!ObpCreateHandle



PRIMARY_PROBLEM_CLASS: AV_R_INVALID_nt!ObpCreateHandle



TARGET_TIME: 2020-05-22T11:18:20.000Z



OSBUILD: 18362



OSSERVICEPACK: 0



SERVICEPACK_NUMBER: 0



OS_REVISION: 0



SUITE_MASK: 272



PRODUCT_TYPE: 1



OSPLATFORM_TYPE: x64



OSNAME: Windows 10



OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS



OS_LOCALE:



USER_LCID: 0



OSBUILD_TIMESTAMP: unknown_date



BUILDDATESTAMP_STR: 190318-1202



BUILDLAB_STR: 19h1_release



BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202



ANALYSIS_SESSION_ELAPSED_TIME: 25e4



ANALYSIS_SOURCE: KM



FAILURE_ID_HASH_STRING: km:av_r_invalid_nt!obpcreatehandle



FAILURE_ID_HASH: {27f6cfdc-4604-91eb-121d-57c0a4aaf233}



Followup: MachineOwner

---------

:)

 

BSOD Hardware Caused???

they do weird things like that, which all seem like something else is failing.
One of the worst things to diagnose, they seem to only quit when they want to.

Memtest is a good next step, if you rule out RAM and Power Supply make sure you disconnect all unnecessary peripherals and try to start the system with as little hardware as possible, if it works then, you can narrow down the culprit by trial and error.

the follow was taken from some website:

It's very difficult to determine if a failure is caused by the CPU because many other components can cause the same symptom when they fail.

1. System fails to boot
2. System re-boots intermittently
3. General Protection Fault
4. Illegal Operation
5. Stop Error, or BSoD (Blue Screen OfDeath)

Actually, CPUs rarely fail, and about the only way to determine if the CPU is causing the failure is to swap it out with a known working CPU of the same type and speed. Since this is difficult, the best bet is to first rule out every other possibility.

Before suspecting the CPU, rule out all the possibilities listed below.

1. The Operating System
2. A peripheral port device
3. A bad memory module
4. The hard disk drive
5. The power supply
6. The motherboard

If you have ruled out out all the other possibilities, investigate the items listed below.

1. Overheating
2. A short circuit
3. ESD

 

Random BSOD while browsing internet


BitDefender is nothing special. mwac.sys causes BSODs anywhere.
A tiny documentation can be found here: Solved Random BSODs - Windows 10 Forums
In that very thread, the suggested action apparently worked.

The storage and network filters of any third party antivirus can cause BSODs. Neither MBAM nor BitDefender is any special. For a regular antivirus, it may be shifted to an alternative; but MBAM has no alternative. So a clean install of the said program is the most feasible first step.
As far as the first step is not failing, it is better to not think for the second step. Because the BSODs are not universal, failure at the first step is not universal; and success at the second step is also not universal.
That is why I posted that my suggestion may work, or may not. Let us see where it goes.

 

BSOD Hardware Caused???

It is not overheating - CPU runs 60*C in games.
Short Circuit - EXTREAMLY UNLIKELY