\device\namedpipe\lsass

Onliy see lsarpc

No see lsass

But long long ago ,D+ can protect it

[attachment deleted by admin]