Windows security, making sure its you... (2fa)

1- Sandboxie version 5.30 and Windows version 10 x64 bit 1903) 
2 - Chrome Version 75.0.3770.100 /Firefox 67.0.3 (64-bit)
3 - Norton Security.
4 - Steps for reproducing the issue: Logging into a google account, with two factor authentication. Sandboxie when enabled does not allow for "Windows security making sure its you" window to pop up, and cannot sign into google any further.
5 - Does it occur in a new sandbox with default settings? Yes
6 - Full error message and screenshots of it if applicable: There are no messages or warnings.

My issue with sandboxie is when trying to log into a google account with two factor authentication-- in my case a security key-- sandboxie blocks the window for signing in with the second factor which is a window that pops up as "Windows security, making sure its you.." I've tried the browsers without the sandboxie enabled, and it works fine. So some how when enabled sandboxie is interfering with second factor window in popping up to sign in. I get no messages from sandboxie about the issue at all. 

 

A photo below of when sandboxie is disable, this is the second factor window that pops up to sign in:

Parents
  • Hi John,

    I don't have a way to test this, as I don't have a security key. 

     

    Let's have you run Res. Acc Mon to see if there are any hints there:
    Access this page to learn how to launch Res. Acc. Mon  Resource Access Monitor.

    Steps:
    Close all your Sandboxed apps
    Start Res. Acc. Monitor
    Immediately reproduce the issue in a new Sandbox with default settings (don't run anything else in the Sandbox while doing this, just the affected scenario)
    Close Res. Acc. Mon as soon as you repro. 
    Paste the output here. 

    Thanks!

    Barb@Sophos
    Community Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.

     

  • I ran the process on chrome with the Resource Acess Monitor 3 seperate times to see if there would be something similar or different in the results. Hopefully you can get something out of these logs.

    This might be a wild guess, not even sure, but after this last big windows security patch it didn't have a pop up window to sign in with the security key till now. I'm kind of thinking it might be because of "Webauthn", a new authenticating standard/service through the browser. It is explained here more, https://www.zdnet.com/article/windows-10-says-hello-to-no-passwords-with-fido2-certification/ or https://www.yubico.com/solutions/webauthn/ . I just realized the issue doesn't only occur with my google account but with my dropbox too.

    Output 1:

    (Drive) \Device\HarddiskVolume3
    Clsid -------------------------------
    Clsid {148BD52A-A2AB-11CE-B11F-00AA00530503} Scheduling Agent Service Class
    Clsid {3CE74DE4-53D3-4D74-8B83-431B3828BA53} TF_DisplayAttributeMgr
    Clsid {529A9E6B-6587-4F23-AB9E-9C7D683E3C50} TF_ThreadMgr
    Clsid {69486DD6-C19F-42E8-B508-A53F9F8E67B8} Offline Files Service Control
    Clsid {6CA50344-051A-4DED-9779-A43305165E35} ?
    Clsid {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} Windows Search Manager
    Clsid {A4B544A1-438D-4B41-9325-869523E2D6C7} TF_CategoryMgr
    Clsid {BCDE0395-E52F-467C-8E3D-C4579291692E} MMDeviceEnumerator class
    Clsid {C2F03A33-21F5-47FA-B4BB-156362A2F239} Immersive Shell
    Clsid {E2B3C97F-6AE1-41AC-817A-F6F92166D7DD} HNetCfg.FwPolicy2
    Clsid {E77CC89B-7401-4C04-8CED-149DB35ADD04} ?
    Clsid O {8BC3F05E-D86B-11D0-A075-00C04FB68820} Windows Management and Instrumentation
    File/Key -------------------------------
    Image -------------------------------
    Ipc -------------------------------
    Ipc ?
    Ipc \BaseNamedObjects\[CoreUI]-PID(14360)-TID(12592) 01e56869-3f05-4796-97db-afe365f20ddc
    Ipc \BaseNamedObjects\[CoreUI]-PID(8948)-TID(3828) 859e17a7-4dce-4410-b320-f9b4a1f12fcf
    Ipc \BaseNamedObjects\__ComCatalogCache__
    Ipc \BaseNamedObjects\{A3BD3259-3E4F-428a-84C8-F0463A9D3EB5}
    Ipc \BaseNamedObjects\{A64C7F33-DA35-459b-96CA-63B51FB0CDB9}
    Ipc \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{5C2DE0FC-64A5-4C06-8FA8-1A88FDDE355F}.2.ver0x0000000000000002.db
    Ipc \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db
    Ipc \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db
    Ipc \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro
    Ipc \BaseNamedObjects\RotHintTable
    Ipc \BaseNamedObjects\SC_AutoStartComplete
    Ipc \BaseNamedObjects\windows_shell_global_counters
    Ipc \RPC Control\actkernel
    Ipc \RPC Control\epmapper
    Ipc \RPC Control\keysvc
    Ipc \RPC Control\LRPC-0d277784c67a6c39c5
    Ipc \RPC Control\OLE1C85EFD2AAD6246BF67C12E57B54
    Ipc \RPC Control\OLE2B42D660EC881F2A60EB99B163B7
    Ipc \RPC Control\OLEF6B38006A5E152E177AD11CC16C6
    Ipc \RPC Control\protected_storage
    Ipc \SBIE_DummyJob_chrome.exe_1
    Ipc \SBIE_DummyJob_chrome.exe_10
    Ipc \SBIE_DummyJob_chrome.exe_11
    Ipc \SBIE_DummyJob_chrome.exe_12
    Ipc \SBIE_DummyJob_chrome.exe_13
    Ipc \SBIE_DummyJob_chrome.exe_14
    Ipc \SBIE_DummyJob_chrome.exe_15
    Ipc \SBIE_DummyJob_chrome.exe_16
    Ipc \SBIE_DummyJob_chrome.exe_17
    Ipc \SBIE_DummyJob_chrome.exe_18
    Ipc \SBIE_DummyJob_chrome.exe_19
    Ipc \SBIE_DummyJob_chrome.exe_2
    Ipc \SBIE_DummyJob_chrome.exe_3
    Ipc \SBIE_DummyJob_chrome.exe_4
    Ipc \SBIE_DummyJob_chrome.exe_5
    Ipc \SBIE_DummyJob_chrome.exe_6
    Ipc \SBIE_DummyJob_chrome.exe_7
    Ipc \SBIE_DummyJob_chrome.exe_8
    Ipc \SBIE_DummyJob_chrome.exe_9
    Ipc \SBIE_DummyJob_software_reporter_tool.exe_1
    Ipc \SBIE_DummyJob_software_reporter_tool.exe_2
    Ipc \Sessions\1\BaseNamedObjects\__ComCatalogCache__
    Ipc \Sessions\1\BaseNamedObjects\__OMADM_NAMED_MUTEX__
    Ipc \Sessions\1\BaseNamedObjects\{A3BD3259-3E4F-428a-84C8-F0463A9D3EB5}
    Ipc \Sessions\1\BaseNamedObjects\{A64C7F33-DA35-459b-96CA-63B51FB0CDB9}
    Ipc \Sessions\1\BaseNamedObjects\{A946A6A9-917E-4949-B9BC-6BADA8C7FD63}
    Ipc \Sessions\1\BaseNamedObjects\3818HWNDInterface:1005e4
    Ipc \Sessions\1\BaseNamedObjects\3818HWNDInterface:1105e4
    Ipc \Sessions\1\BaseNamedObjects\3818HWNDInterface:24049e
    Ipc \Sessions\1\BaseNamedObjects\3818HWNDInterface:2d04a6
    Ipc \Sessions\1\BaseNamedObjects\3818HWNDInterface:330494
    Ipc \Sessions\1\BaseNamedObjects\c:!program files (x86)!google!chrome!application!chrome.exe
    Ipc \Sessions\1\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{5C2DE0FC-64A5-4C06-8FA8-1A88FDDE355F}.2.ver0x0000000000000002.db
    Ipc \Sessions\1\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db
    Ipc \Sessions\1\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db
    Ipc \Sessions\1\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro
    Ipc \Sessions\1\BaseNamedObjects\C:*Users*********AppData*Local*Microsoft*Windows*Caches*{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000000c.db
    Ipc \Sessions\1\BaseNamedObjects\C:*Users*********AppData*Local*Microsoft*Windows*Caches*{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000002.db
    Ipc \Sessions\1\BaseNamedObjects\C:*Users*********AppData*Local*Microsoft*Windows*Caches*cversions.1.ro
    Ipc \Sessions\1\BaseNamedObjects\C:*Users*********AppData*Local*Microsoft*Windows*Caches*cversions.3.ro
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!025a78
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!1e06d8
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterEvent
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer
    Ipc \Sessions\1\BaseNamedObjects\ChromeProcessSingletonStartup!
    Ipc \Sessions\1\BaseNamedObjects\ComPlusCOMRegTable
    Ipc \Sessions\1\BaseNamedObjects\RotHintTable
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_10644
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_11868
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_12476
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_12484
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_12736
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_1320
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_13772
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_13924
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_14360
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_14564
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_14884
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_15204
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_15344
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_15680
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_15840
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_16256
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_16476
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_16684
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_1684
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_16932
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_17004
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_17756
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_18264
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_2856
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_4608
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_5620
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_5852
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_7728
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_8056
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_8172
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_8836
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_9396
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_RPCSS_SXS_READY
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceCrypto_Mutex1
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_cryptsvc
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_DcomLaunch
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_Mutex1
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_RpcEptMapper
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_RpcSs
    Ipc \Sessions\1\BaseNamedObjects\SBIE_WindowsInstallerInUse
    Ipc \Sessions\1\BaseNamedObjects\SboxSession
    Ipc \Sessions\1\BaseNamedObjects\SC_AutoStartComplete
    Ipc \Sessions\1\BaseNamedObjects\ScmCreatedEvent
    Ipc \Sessions\1\BaseNamedObjects\SM0:11868:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:11868:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:11868:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:11868:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:11868:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:11868:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:13924:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:13924:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:13924:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:13924:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:13924:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:13924:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:14360:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:14360:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:14360:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:14360:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:14360:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:14360:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:15204:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:15204:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:15204:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:15840:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:15840:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:15840:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:15840:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:15840:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:15840:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:16256:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:16256:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:16256:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:16256:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:16256:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:16256:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:16932:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:16932:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:16932:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:16932:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:16932:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:16932:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:17756:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:17756:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:17756:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:17756:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:17756:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:17756:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:2856:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:2856:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:2856:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:4608:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:4608:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:4608:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:4608:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:4608:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:4608:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:5620:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:5620:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:5620:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:7728:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:7728:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:7728:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:8056:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:8056:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:8056:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:8056:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:8056:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:8056:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:8172:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:8172:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:8172:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:8172:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:8172:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:8172:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:8836:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:8836:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:8836:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:8836:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:8836:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:8836:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:9396:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:9396:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:9396:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SyncRootManager
    Ipc \Sessions\1\BaseNamedObjects\windows_shell_global_counters
    Ipc O \BaseNamedObjects\CoreMessagingRegistrar
    Ipc O \BaseNamedObjects\FontCachePort
    Ipc O \BaseNamedObjects\msctf.serverDefault1
    Ipc O \KernelObjects\LowMemoryCondition
    Ipc O \KernelObjects\MaximumCommitCondition
    Ipc O \KnownDlls\advapi32.dll
    Ipc O \KnownDlls\bcrypt.dll
    Ipc O \KnownDlls\bcryptPrimitives.dll
    Ipc O \KnownDlls\cfgmgr32.dll
    Ipc O \KnownDlls\clbcatq.dll
    Ipc O \KnownDlls\combase.dll
    Ipc O \KnownDlls\COMDLG32.dll
    Ipc O \KnownDlls\CRYPT32.dll
    Ipc O \KnownDlls\cryptsp.dll
    Ipc O \KnownDlls\gdi32.dll
    Ipc O \KnownDlls\gdi32full.dll
    Ipc O \KnownDlls\IMAGEHLP.dll
    Ipc O \KnownDlls\IMM32.dll
    Ipc O \KnownDlls\kernel.appcore.dll
    Ipc O \KnownDlls\kernel32.dll
    Ipc O \KnownDlls\KERNELBASE.dll
    Ipc O \KnownDlls\MSASN1.dll
    Ipc O \KnownDlls\MSCTF.dll
    Ipc O \KnownDlls\msvcp_win.dll
    Ipc O \KnownDlls\MSVCRT.dll
    Ipc O \KnownDlls\NSI.dll
    Ipc O \KnownDlls\ole32.dll
    Ipc O \KnownDlls\OLEAUT32.dll
    Ipc O \KnownDlls\powrprof.dll
    Ipc O \KnownDlls\profapi.dll
    Ipc O \KnownDlls\PSAPI.DLL
    Ipc O \KnownDlls\rpcrt4.dll
    Ipc O \KnownDlls\sechost.dll
    Ipc O \KnownDlls\Setupapi.dll
    Ipc O \KnownDlls\SHCORE.dll
    Ipc O \KnownDlls\SHELL32.dll
    Ipc O \KnownDlls\SHLWAPI.dll
    Ipc O \KnownDlls\ucrtbase.dll
    Ipc O \KnownDlls\UMPDC.dll
    Ipc O \KnownDlls\user32.dll
    Ipc O \KnownDlls\win32u.dll
    Ipc O \KnownDlls\windows.storage.dll
    Ipc O \KnownDlls\WINTRUST.dll
    Ipc O \KnownDlls\WS2_32.dll
    Ipc O \RPC Control\AudioClientRpc
    Ipc O \RPC Control\Audiosrv
    Ipc O \RPC Control\dhcpcsvc
    Ipc O \RPC Control\dhcpcsvc6
    Ipc O \RPC Control\LRPC-0d277784c67a6c39c5
    Ipc O \RPC Control\lsapolicylookup
    Ipc O \RPC Control\LSARPC_ENDPOINT
    Ipc O \RPC Control\lsasspirpc
    Ipc O \RPC Control\nlaapi
    Ipc O \RPC Control\samss lpc
    Ipc O \RPC Control\SbieSvcPort
    Ipc O \Security\LSA_AUTHENTICATION_INITIALIZED
    Ipc O \Sessions\1\BaseNamedObjects\__DDrawCheckExclMode__
    Ipc O \Sessions\1\BaseNamedObjects\__DDrawExclMode__
    Ipc O \Sessions\1\BaseNamedObjects\CicLoadWinStaWinSta0
    Ipc O \Sessions\1\BaseNamedObjects\CTF.AsmListCache.FMPDefault1
    Ipc O \Sessions\1\BaseNamedObjects\MSCTF.Asm.MutexDefault1
    Ipc O \Sessions\1\BaseNamedObjects\MSCTF.CtfMonitorInstMutexDefault1
    Ipc O \Sessions\1\Windows\ApiPort
    Ipc O \Sessions\1\Windows\DwmApiPort
    Ipc O \Sessions\1\Windows\SharedSection
    Ipc O \Sessions\1\Windows\Theme1259923593
    Ipc O \Sessions\1\Windows\ThemeSection
    Ipc O \ThemeApiPort
    Ipc O \Windows\Theme3000190212
    Pipe -------------------------------
    Pipe ?
    Pipe \Device\ccSet_{0C55C096-0F1D-4F28-AAA2-85EF591126E7}
    Pipe \Device\CNG
    Pipe \Device\Harddisk0\DR0
    Pipe \Device\HarddiskVolume1
    Pipe \Device\HarddiskVolume3
    Pipe \Device\HarddiskVolume4
    Pipe \Device\HarddiskVolume5
    Pipe \Device\HarddiskVolume6
    Pipe \Device\KsecDD
    Pipe \Device\MountPointManager
    Pipe \device\namedpipe\_sandbox_john_new_session_1\crashpad_14360_fzhotomkhycgxrzx
    Pipe \device\namedpipe\_sandbox_john_new_session_1\crashpad_9396_dmrseoadlcxmuubg
    Pipe \Device\NamedPipe\crashpad_14360_FZHOTOMKHYCGXRZX
    Pipe \device\namedpipe\crashpad_14360_fzhotomkhycgxrzx
    Pipe \Device\NamedPipe\crashpad_14360_FZHOTOMKHYCGXRZX
    Pipe \device\namedpipe\crashpad_14360_fzhotomkhycgxrzx
    Pipe \Device\NamedPipe\crashpad_14360_FZHOTOMKHYCGXRZX
    Pipe \device\namedpipe\crashpad_14360_fzhotomkhycgxrzx
    Pipe \Device\NamedPipe\crashpad_9396_DMRSEOADLCXMUUBG
    Pipe \device\namedpipe\crashpad_9396_dmrseoadlcxmuubg
    Pipe \Device\NamedPipe\crashpad_9396_DMRSEOADLCXMUUBG
    Pipe \device\namedpipe\crashpad_9396_dmrseoadlcxmuubg
    Pipe \device\namedpipe\mojo.14360.10648.10229292234463847269
    Pipe \Device\NamedPipe\mojo.14360.10648.10229292234463847269
    Pipe \device\namedpipe\mojo.14360.10648.10229292234463847269
    Pipe \Device\NamedPipe\mojo.14360.10648.10284641530229887609
    Pipe \device\namedpipe\mojo.14360.10648.10284641530229887609
    Pipe \Device\NamedPipe\mojo.14360.10648.10284641530229887609
    Pipe \device\namedpipe\mojo.14360.10648.10284641530229887609
    Pipe \Device\NamedPipe\mojo.14360.10648.10653616118260120914
    Pipe \device\namedpipe\mojo.14360.10648.10653616118260120914
    Pipe \Device\NamedPipe\mojo.14360.10648.10878677300655999047
    Pipe \device\namedpipe\mojo.14360.10648.10878677300655999047
    Pipe \Device\NamedPipe\mojo.14360.10648.115078325134741930
    Pipe \device\namedpipe\mojo.14360.10648.115078325134741930
    Pipe \Device\NamedPipe\mojo.14360.10648.11931622032957734742
    Pipe \device\namedpipe\mojo.14360.10648.11931622032957734742
    Pipe \device\namedpipe\mojo.14360.10648.11980965466274234994
    Pipe \Device\NamedPipe\mojo.14360.10648.11980965466274234994
    Pipe \device\namedpipe\mojo.14360.10648.11980965466274234994
    Pipe \Device\NamedPipe\mojo.14360.10648.12195664353337999321
    Pipe \device\namedpipe\mojo.14360.10648.12195664353337999321
    Pipe \Device\NamedPipe\mojo.14360.10648.12350236578006235227
    Pipe \device\namedpipe\mojo.14360.10648.12350236578006235227
    Pipe \Device\NamedPipe\mojo.14360.10648.12467028242757142471
    Pipe \device\namedpipe\mojo.14360.10648.12467028242757142471
    Pipe \device\namedpipe\mojo.14360.10648.12731140237260509677
    Pipe \Device\NamedPipe\mojo.14360.10648.12731140237260509677
    Pipe \device\namedpipe\mojo.14360.10648.12731140237260509677
    Pipe \device\namedpipe\mojo.14360.10648.13085232112218748075
    Pipe \Device\NamedPipe\mojo.14360.10648.13085232112218748075
    Pipe \device\namedpipe\mojo.14360.10648.13085232112218748075
    Pipe \device\namedpipe\mojo.14360.10648.13322782817605538795
    Pipe \Device\NamedPipe\mojo.14360.10648.13322782817605538795
    Pipe \device\namedpipe\mojo.14360.10648.13322782817605538795
    Pipe \device\namedpipe\mojo.14360.10648.13598269308383599246
    Pipe \Device\NamedPipe\mojo.14360.10648.13598269308383599246
    Pipe \device\namedpipe\mojo.14360.10648.13598269308383599246
    Pipe \device\namedpipe\mojo.14360.10648.1359912646826628930
    Pipe \Device\NamedPipe\mojo.14360.10648.1359912646826628930
    Pipe \device\namedpipe\mojo.14360.10648.1359912646826628930
    Pipe \Device\NamedPipe\mojo.14360.10648.14002585914105434586
    Pipe \device\namedpipe\mojo.14360.10648.14002585914105434586
    Pipe \Device\NamedPipe\mojo.14360.10648.14500430239488100605
    Pipe \device\namedpipe\mojo.14360.10648.14500430239488100605
    Pipe \Device\NamedPipe\mojo.14360.10648.15845414245299050296
    Pipe \device\namedpipe\mojo.14360.10648.15845414245299050296
    Pipe \device\namedpipe\mojo.14360.10648.15956484427516790539
    Pipe \Device\NamedPipe\mojo.14360.10648.15956484427516790539
    Pipe \device\namedpipe\mojo.14360.10648.15956484427516790539
    Pipe \device\namedpipe\mojo.14360.10648.16080028251345667337
    Pipe \Device\NamedPipe\mojo.14360.10648.16080028251345667337
    Pipe \device\namedpipe\mojo.14360.10648.16080028251345667337
    Pipe \Device\NamedPipe\mojo.14360.10648.16080028251345667337
    Pipe \device\namedpipe\mojo.14360.10648.16080028251345667337
    Pipe \device\namedpipe\mojo.14360.10648.16698985363087722933
    Pipe \Device\NamedPipe\mojo.14360.10648.16698985363087722933
    Pipe \device\namedpipe\mojo.14360.10648.16698985363087722933
    Pipe \Device\NamedPipe\mojo.14360.10648.17212373491008182597
    Pipe \device\namedpipe\mojo.14360.10648.17212373491008182597
    Pipe \device\namedpipe\mojo.14360.10648.2652413979572257784
    Pipe \Device\NamedPipe\mojo.14360.10648.2652413979572257784
    Pipe \device\namedpipe\mojo.14360.10648.2652413979572257784
    Pipe \Device\NamedPipe\mojo.14360.10648.2799902672176631599
    Pipe \device\namedpipe\mojo.14360.10648.2799902672176631599
    Pipe \Device\NamedPipe\mojo.14360.10648.3812178146558046799
    Pipe \device\namedpipe\mojo.14360.10648.3812178146558046799
    Pipe \device\namedpipe\mojo.14360.10648.4182752737438941020
    Pipe \Device\NamedPipe\mojo.14360.10648.4182752737438941020
    Pipe \device\namedpipe\mojo.14360.10648.4182752737438941020
    Pipe \Device\NamedPipe\mojo.14360.10648.4182752737438941020
    Pipe \device\namedpipe\mojo.14360.10648.4182752737438941020
    Pipe \Device\NamedPipe\mojo.14360.10648.4182790932392000889
    Pipe \device\namedpipe\mojo.14360.10648.4182790932392000889
    Pipe \Device\NamedPipe\mojo.14360.10648.4314433546997844062
    Pipe \device\namedpipe\mojo.14360.10648.4314433546997844062
    Pipe \Device\NamedPipe\mojo.14360.10648.5170912270803982550
    Pipe \device\namedpipe\mojo.14360.10648.5170912270803982550
    Pipe \Device\NamedPipe\mojo.14360.10648.5170912270803982550
    Pipe \device\namedpipe\mojo.14360.10648.5170912270803982550
    Pipe \Device\NamedPipe\mojo.14360.10648.5753304974736755863
    Pipe \device\namedpipe\mojo.14360.10648.5753304974736755863
    Pipe \Device\NamedPipe\mojo.14360.10648.5817755776517105224
    Pipe \device\namedpipe\mojo.14360.10648.5817755776517105224
    Pipe \Device\NamedPipe\mojo.14360.10648.5817755776517105224
    Pipe \device\namedpipe\mojo.14360.10648.5817755776517105224
    Pipe \Device\NamedPipe\mojo.14360.10648.6366776774491422165
    Pipe \device\namedpipe\mojo.14360.10648.6366776774491422165
    Pipe \Device\NamedPipe\mojo.14360.10648.6451684832851228015
    Pipe \device\namedpipe\mojo.14360.10648.6451684832851228015
    Pipe \Device\NamedPipe\mojo.14360.10648.6500960993544375335
    Pipe \device\namedpipe\mojo.14360.10648.6500960993544375335
    Pipe \Device\NamedPipe\mojo.14360.10648.6500960993544375335
    Pipe \device\namedpipe\mojo.14360.10648.6500960993544375335
    Pipe \Device\NamedPipe\mojo.14360.10648.6597896622423053953
    Pipe \device\namedpipe\mojo.14360.10648.6597896622423053953
    Pipe \Device\NamedPipe\mojo.14360.10648.663760447996899841
    Pipe \device\namedpipe\mojo.14360.10648.663760447996899841
    Pipe \Device\NamedPipe\mojo.14360.10648.663760447996899841
    Pipe \device\namedpipe\mojo.14360.10648.663760447996899841
    Pipe \device\namedpipe\mojo.14360.10648.6647434126430034738
    Pipe \Device\NamedPipe\mojo.14360.10648.6647434126430034738
    Pipe \device\namedpipe\mojo.14360.10648.6647434126430034738
    Pipe \Device\NamedPipe\mojo.14360.10648.6664235610901238833
    Pipe \device\namedpipe\mojo.14360.10648.6664235610901238833
    Pipe \Device\NamedPipe\mojo.14360.10648.6664235610901238833
    Pipe \device\namedpipe\mojo.14360.10648.6664235610901238833
    Pipe \Device\NamedPipe\mojo.14360.10648.7029682214162504810
    Pipe \device\namedpipe\mojo.14360.10648.7029682214162504810
    Pipe \Device\NamedPipe\mojo.14360.10648.7029682214162504810
    Pipe \device\namedpipe\mojo.14360.10648.7029682214162504810
    Pipe \device\namedpipe\mojo.14360.10648.7405516701554595905
    Pipe \Device\NamedPipe\mojo.14360.10648.7405516701554595905
    Pipe \device\namedpipe\mojo.14360.10648.7405516701554595905
    Pipe \Device\NamedPipe\mojo.14360.10648.7405853442487218143
    Pipe \device\namedpipe\mojo.14360.10648.7405853442487218143
    Pipe \Device\NamedPipe\mojo.14360.10648.7405853442487218143
    Pipe \device\namedpipe\mojo.14360.10648.7405853442487218143
    Pipe \Device\NamedPipe\mojo.14360.10648.7488351785397539556
    Pipe \device\namedpipe\mojo.14360.10648.7488351785397539556
    Pipe \Device\NamedPipe\mojo.14360.10648.768651550315654568
    Pipe \device\namedpipe\mojo.14360.10648.768651550315654568
    Pipe \Device\NamedPipe\mojo.14360.10648.768651550315654568
    Pipe \device\namedpipe\mojo.14360.10648.768651550315654568
    Pipe \Device\NamedPipe\mojo.14360.10648.7979462838147706955
    Pipe \device\namedpipe\mojo.14360.10648.7979462838147706955
    Pipe \Device\NamedPipe\mojo.14360.10648.7979462838147706955
    Pipe \device\namedpipe\mojo.14360.10648.7979462838147706955
    Pipe \device\namedpipe\mojo.14360.10648.8261673342477476966
    Pipe \Device\NamedPipe\mojo.14360.10648.8261673342477476966
    Pipe \device\namedpipe\mojo.14360.10648.8261673342477476966
    Pipe \device\namedpipe\mojo.14360.10648.8339335173007334420
    Pipe \Device\NamedPipe\mojo.14360.10648.8339335173007334420
    Pipe \device\namedpipe\mojo.14360.10648.8339335173007334420
    Pipe \Device\NamedPipe\mojo.14360.10648.9454033553049780580
    Pipe \device\namedpipe\mojo.14360.10648.9454033553049780580
    Pipe \Device\NamedPipe\mojo.14360.10648.9589960456583924567
    Pipe \device\namedpipe\mojo.14360.10648.9589960456583924567
    Pipe \device\namedpipe\mojo.14360.10648.9825338931228687256
    Pipe \Device\NamedPipe\mojo.14360.10648.9825338931228687256
    Pipe \device\namedpipe\mojo.14360.10648.9825338931228687256
    Pipe \device\namedpipe\mojo.14360.12592.10362603069110219834
    Pipe \Device\NamedPipe\mojo.14360.12592.10362603069110219834
    Pipe \device\namedpipe\mojo.14360.12592.10362603069110219834
    Pipe \device\namedpipe\mojo.14360.12592.1059541191031491794
    Pipe \Device\NamedPipe\mojo.14360.12592.1059541191031491794
    Pipe \device\namedpipe\mojo.14360.12592.1059541191031491794
    Pipe \device\namedpipe\mojo.14360.12592.11281349320835601145
    Pipe \Device\NamedPipe\mojo.14360.12592.11281349320835601145
    Pipe \device\namedpipe\mojo.14360.12592.11281349320835601145
    Pipe \Device\NamedPipe\mojo.14360.12592.13527526203799731740
    Pipe \device\namedpipe\mojo.14360.12592.13527526203799731740
    Pipe \Device\NamedPipe\mojo.14360.12592.18414360887605648371
    Pipe \device\namedpipe\mojo.14360.12592.18414360887605648371
    Pipe \device\namedpipe\mojo.14360.12592.2325485162564056580
    Pipe \Device\NamedPipe\mojo.14360.12592.2325485162564056580
    Pipe \device\namedpipe\mojo.14360.12592.2325485162564056580
    Pipe \Device\NamedPipe\mojo.14360.12592.2479198188120673275
    Pipe \device\namedpipe\mojo.14360.12592.2479198188120673275
    Pipe \Device\NamedPipe\mojo.14360.12592.2479198188120673275
    Pipe \device\namedpipe\mojo.14360.12592.2479198188120673275
    Pipe \device\namedpipe\mojo.14360.12592.3250433268028008229
    Pipe \Device\NamedPipe\mojo.14360.12592.3250433268028008229
    Pipe \device\namedpipe\mojo.14360.12592.3250433268028008229
    Pipe \Device\NamedPipe\mojo.14360.12592.3668736526109238762
    Pipe \device\namedpipe\mojo.14360.12592.3668736526109238762
    Pipe \Device\NamedPipe\mojo.14360.12592.3668736526109238762
    Pipe \device\namedpipe\mojo.14360.12592.3668736526109238762
    Pipe \Device\NamedPipe\mojo.14360.12592.5075565749253561774
    Pipe \device\namedpipe\mojo.14360.12592.5075565749253561774
    Pipe \device\namedpipe\mojo.14360.12592.6987984274397714188
    Pipe \Device\NamedPipe\mojo.14360.12592.6987984274397714188
    Pipe \device\namedpipe\mojo.14360.12592.6987984274397714188
    Pipe \Device\NamedPipe\mojo.14360.12592.8259927604908980587
    Pipe \device\namedpipe\mojo.14360.12592.8259927604908980587
    Pipe \device\namedpipe\mojo.9396.5908.10182328571958283718
    Pipe \Device\NamedPipe\mojo.9396.5908.10182328571958283718
    Pipe \device\namedpipe\mojo.9396.5908.10182328571958283718
    Pipe \device\namedpipe\mojo.9396.5908.17343892288836197841
    Pipe \Device\NamedPipe\mojo.9396.5908.17343892288836197841
    Pipe \device\namedpipe\mojo.9396.5908.17343892288836197841
    Pipe \Device\NamedPipe\mojo.9396.6832.12976771630488783484
    Pipe \device\namedpipe\mojo.9396.6832.12976771630488783484
    Pipe \Device\NamedPipe\mojo.9396.6832.12976771630488783484
    Pipe \device\namedpipe\mojo.9396.6832.12976771630488783484
    Pipe \Device\NamedPipe\mojo.9396.6832.17228184048086812926
    Pipe \device\namedpipe\mojo.9396.6832.17228184048086812926
    Pipe \device\namedpipe\wkssvc
    Pipe \Device\Ndis
    Pipe \Device\NDMP10
    Pipe \Device\NDMP11
    Pipe \Device\NDMP12
    Pipe \Device\NDMP13
    Pipe \Device\NDMP14
    Pipe \Device\NDMP3
    Pipe \Device\NDMP4
    Pipe \Device\NDMP5
    Pipe \Device\NDMP6
    Pipe \Device\NDMP7
    Pipe \Device\NDMP8
    Pipe \Device\NDMP9
    Pipe \Device\NvAdminDevice
    Pipe \Device\SYMEFASI
    Pipe O \Device\Afd
    Pipe O \Device\NetBT_Tcpip_{0675877A-AA83-4350-B365-7BC8D988E8AF}
    Pipe O \Device\NetBT_Tcpip_{335A9FBC-4084-4D7F-9C35-F5D3B1D0E287}
    Pipe O \Device\NetBT_Tcpip_{3772B5A7-B93D-4159-B946-7A0E0FA34367}
    Pipe O \Device\NetBT_Tcpip_{90B10FB4-D509-4A04-B300-D3485E78C7C0}
    Pipe O \Device\NetBT_Tcpip_{AE45094B-908E-46B5-934B-45FC09D33F41}
    Pipe O \Device\NetBT_Tcpip_{D6FE7B8A-B625-4488-A40C-F83CAEA73E0F}
    Pipe O \Device\Nsi
    WinCls -------------------------------
    WinCls O Shell_TrayWnd
    WinCls X ApplicationManager_DesktopShellWindow
    WinCls X Chrome_MessageWindow

     

    Output 2:

    (Drive) \Device\HarddiskVolume3
    Clsid -------------------------------
    Clsid {148BD52A-A2AB-11CE-B11F-00AA00530503} Scheduling Agent Service Class
    Clsid {3CE74DE4-53D3-4D74-8B83-431B3828BA53} TF_DisplayAttributeMgr
    Clsid {529A9E6B-6587-4F23-AB9E-9C7D683E3C50} TF_ThreadMgr
    Clsid {6CA50344-051A-4DED-9779-A43305165E35} ?
    Clsid {A4B544A1-438D-4B41-9325-869523E2D6C7} TF_CategoryMgr
    Clsid {BCDE0395-E52F-467C-8E3D-C4579291692E} MMDeviceEnumerator class
    Clsid {C2F03A33-21F5-47FA-B4BB-156362A2F239} Immersive Shell
    Clsid {E2B3C97F-6AE1-41AC-817A-F6F92166D7DD} HNetCfg.FwPolicy2
    Clsid {E77CC89B-7401-4C04-8CED-149DB35ADD04} ?
    Clsid O {8BC3F05E-D86B-11D0-A075-00C04FB68820} Windows Management and Instrumentation
    File/Key -------------------------------
    Image -------------------------------
    Ipc -------------------------------
    Ipc \BaseNamedObjects\[CoreUI]-PID(4708)-TID(17308) d080d8b5-df54-4e4f-9ad5-9cd42f26f302
    Ipc \BaseNamedObjects\[CoreUI]-PID(8948)-TID(3828) 859e17a7-4dce-4410-b320-f9b4a1f12fcf
    Ipc \BaseNamedObjects\__ComCatalogCache__
    Ipc \BaseNamedObjects\{A3BD3259-3E4F-428a-84C8-F0463A9D3EB5}
    Ipc \BaseNamedObjects\{A64C7F33-DA35-459b-96CA-63B51FB0CDB9}
    Ipc \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{5C2DE0FC-64A5-4C06-8FA8-1A88FDDE355F}.2.ver0x0000000000000002.db
    Ipc \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db
    Ipc \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db
    Ipc \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro
    Ipc \BaseNamedObjects\RotHintTable
    Ipc \BaseNamedObjects\SC_AutoStartComplete
    Ipc \BaseNamedObjects\windows_shell_global_counters
    Ipc \RPC Control\actkernel
    Ipc \RPC Control\epmapper
    Ipc \RPC Control\keysvc
    Ipc \RPC Control\LRPC-0d277784c67a6c39c5
    Ipc \RPC Control\OLE07D0ED8E2A6F7A515F60C9A794FF
    Ipc \RPC Control\OLEE330BF4B8C9443D395092A11081C
    Ipc \RPC Control\protected_storage
    Ipc \SBIE_DummyJob_chrome.exe_1
    Ipc \SBIE_DummyJob_chrome.exe_10
    Ipc \SBIE_DummyJob_chrome.exe_11
    Ipc \SBIE_DummyJob_chrome.exe_12
    Ipc \SBIE_DummyJob_chrome.exe_13
    Ipc \SBIE_DummyJob_chrome.exe_14
    Ipc \SBIE_DummyJob_chrome.exe_15
    Ipc \SBIE_DummyJob_chrome.exe_16
    Ipc \SBIE_DummyJob_chrome.exe_17
    Ipc \SBIE_DummyJob_chrome.exe_18
    Ipc \SBIE_DummyJob_chrome.exe_19
    Ipc \SBIE_DummyJob_chrome.exe_2
    Ipc \SBIE_DummyJob_chrome.exe_20
    Ipc \SBIE_DummyJob_chrome.exe_21
    Ipc \SBIE_DummyJob_chrome.exe_22
    Ipc \SBIE_DummyJob_chrome.exe_23
    Ipc \SBIE_DummyJob_chrome.exe_3
    Ipc \SBIE_DummyJob_chrome.exe_4
    Ipc \SBIE_DummyJob_chrome.exe_5
    Ipc \SBIE_DummyJob_chrome.exe_6
    Ipc \SBIE_DummyJob_chrome.exe_7
    Ipc \SBIE_DummyJob_chrome.exe_8
    Ipc \SBIE_DummyJob_chrome.exe_9
    Ipc \SBIE_DummyJob_software_reporter_tool.exe_1
    Ipc \SBIE_DummyJob_software_reporter_tool.exe_2
    Ipc \Sessions\1\BaseNamedObjects\__ComCatalogCache__
    Ipc \Sessions\1\BaseNamedObjects\__OMADM_NAMED_MUTEX__
    Ipc \Sessions\1\BaseNamedObjects\{A3BD3259-3E4F-428a-84C8-F0463A9D3EB5}
    Ipc \Sessions\1\BaseNamedObjects\{A64C7F33-DA35-459b-96CA-63B51FB0CDB9}
    Ipc \Sessions\1\BaseNamedObjects\{A946A6A9-917E-4949-B9BC-6BADA8C7FD63}
    Ipc \Sessions\1\BaseNamedObjects\1264HWNDInterface:160540
    Ipc \Sessions\1\BaseNamedObjects\1264HWNDInterface:2e04b6
    Ipc \Sessions\1\BaseNamedObjects\1264HWNDInterface:34041e
    Ipc \Sessions\1\BaseNamedObjects\1264HWNDInterface:4a050e
    Ipc \Sessions\1\BaseNamedObjects\c:!program files (x86)!google!chrome!application!chrome.exe
    Ipc \Sessions\1\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{5C2DE0FC-64A5-4C06-8FA8-1A88FDDE355F}.2.ver0x0000000000000002.db
    Ipc \Sessions\1\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db
    Ipc \Sessions\1\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db
    Ipc \Sessions\1\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro
    Ipc \Sessions\1\BaseNamedObjects\C:*Users*********AppData*Local*Microsoft*Windows*Caches*{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000000c.db
    Ipc \Sessions\1\BaseNamedObjects\C:*Users*********AppData*Local*Microsoft*Windows*Caches*{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000002.db
    Ipc \Sessions\1\BaseNamedObjects\C:*Users*********AppData*Local*Microsoft*Windows*Caches*cversions.1.ro
    Ipc \Sessions\1\BaseNamedObjects\C:*Users*********AppData*Local*Microsoft*Windows*Caches*cversions.3.ro
    Ipc \Sessions\1\BaseNamedObjects\ChromeProcessSingletonStartup!
    Ipc \Sessions\1\BaseNamedObjects\ComPlusCOMRegTable
    Ipc \Sessions\1\BaseNamedObjects\RotHintTable
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_11168
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_12056
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_128
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_1320
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_13740
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_14192
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_14580
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_15328
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_15424
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_15532
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_15708
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_15844
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_16352
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_1648
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_16804
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_16936
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_17828
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_17872
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_18004
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_18332
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_248
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_2568
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_2732
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_2968
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_3692
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_4116
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_4668
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_4708
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_5928
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_6316
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_6888
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_7580
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_8056
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_8336
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_8528
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_RPCSS_SXS_READY
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceCrypto_Mutex1
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_cryptsvc
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_DcomLaunch
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_Mutex1
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_RpcEptMapper
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_RpcSs
    Ipc \Sessions\1\BaseNamedObjects\SBIE_WindowsInstallerInUse
    Ipc \Sessions\1\BaseNamedObjects\SboxSession
    Ipc \Sessions\1\BaseNamedObjects\SC_AutoStartComplete
    Ipc \Sessions\1\BaseNamedObjects\ScmCreatedEvent
    Ipc \Sessions\1\BaseNamedObjects\SM0:12056:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:12056:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:12056:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:12056:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:12056:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:12056:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:128:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:128:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:128:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:13740:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:13740:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:13740:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:15424:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:15424:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:15424:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:15708:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:15708:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:15708:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:15708:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:15708:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:15708:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:15844:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:15844:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:15844:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:15844:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:15844:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:15844:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:16352:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:16352:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:16352:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:16804:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:16804:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:16804:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:16804:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:16804:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:16804:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:17872:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:17872:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:17872:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:2568:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:2568:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:2568:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:2732:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:2732:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:2732:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:3692:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:3692:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:3692:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:3692:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:3692:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:3692:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:4116:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:4116:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:4116:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:4116:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:4116:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:4116:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:4668:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:4668:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:4668:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:4708:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:4708:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:4708:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:4708:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:4708:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:4708:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:5928:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:5928:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:5928:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:6316:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:6316:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:6316:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:6316:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:6316:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:6316:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:6888:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:6888:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:6888:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:6888:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:6888:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:6888:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:8336:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:8336:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:8336:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:8336:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:8336:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:8336:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SyncRootManager
    Ipc \Sessions\1\BaseNamedObjects\windows_shell_global_counters
    Ipc O \BaseNamedObjects\CoreMessagingRegistrar
    Ipc O \BaseNamedObjects\FontCachePort
    Ipc O \BaseNamedObjects\msctf.serverDefault1
    Ipc O \KernelObjects\LowMemoryCondition
    Ipc O \KernelObjects\MaximumCommitCondition
    Ipc O \KnownDlls\advapi32.dll
    Ipc O \KnownDlls\bcrypt.dll
    Ipc O \KnownDlls\bcryptPrimitives.dll
    Ipc O \KnownDlls\cfgmgr32.dll
    Ipc O \KnownDlls\clbcatq.dll
    Ipc O \KnownDlls\combase.dll
    Ipc O \KnownDlls\COMDLG32.dll
    Ipc O \KnownDlls\CRYPT32.dll
    Ipc O \KnownDlls\cryptsp.dll
    Ipc O \KnownDlls\gdi32.dll
    Ipc O \KnownDlls\gdi32full.dll
    Ipc O \KnownDlls\IMAGEHLP.dll
    Ipc O \KnownDlls\IMM32.dll
    Ipc O \KnownDlls\kernel.appcore.dll
    Ipc O \KnownDlls\kernel32.dll
    Ipc O \KnownDlls\KERNELBASE.dll
    Ipc O \KnownDlls\MSASN1.dll
    Ipc O \KnownDlls\MSCTF.dll
    Ipc O \KnownDlls\msvcp_win.dll
    Ipc O \KnownDlls\MSVCRT.dll
    Ipc O \KnownDlls\NSI.dll
    Ipc O \KnownDlls\ole32.dll
    Ipc O \KnownDlls\OLEAUT32.dll
    Ipc O \KnownDlls\powrprof.dll
    Ipc O \KnownDlls\profapi.dll
    Ipc O \KnownDlls\PSAPI.DLL
    Ipc O \KnownDlls\rpcrt4.dll
    Ipc O \KnownDlls\sechost.dll
    Ipc O \KnownDlls\Setupapi.dll
    Ipc O \KnownDlls\SHCORE.dll
    Ipc O \KnownDlls\SHELL32.dll
    Ipc O \KnownDlls\SHLWAPI.dll
    Ipc O \KnownDlls\ucrtbase.dll
    Ipc O \KnownDlls\UMPDC.dll
    Ipc O \KnownDlls\user32.dll
    Ipc O \KnownDlls\win32u.dll
    Ipc O \KnownDlls\windows.storage.dll
    Ipc O \KnownDlls\WINTRUST.dll
    Ipc O \KnownDlls\WS2_32.dll
    Ipc O \RPC Control\AudioClientRpc
    Ipc O \RPC Control\Audiosrv
    Ipc O \RPC Control\dhcpcsvc
    Ipc O \RPC Control\dhcpcsvc6
    Ipc O \RPC Control\LRPC-0d277784c67a6c39c5
    Ipc O \RPC Control\lsapolicylookup
    Ipc O \RPC Control\LSARPC_ENDPOINT
    Ipc O \RPC Control\lsasspirpc
    Ipc O \RPC Control\nlaapi
    Ipc O \RPC Control\samss lpc
    Ipc O \RPC Control\SbieSvcPort
    Ipc O \Security\LSA_AUTHENTICATION_INITIALIZED
    Ipc O \Sessions\1\BaseNamedObjects\__DDrawCheckExclMode__
    Ipc O \Sessions\1\BaseNamedObjects\__DDrawExclMode__
    Ipc O \Sessions\1\BaseNamedObjects\CicLoadWinStaWinSta0
    Ipc O \Sessions\1\BaseNamedObjects\CTF.AsmListCache.FMPDefault1
    Ipc O \Sessions\1\BaseNamedObjects\MSCTF.Asm.MutexDefault1
    Ipc O \Sessions\1\BaseNamedObjects\MSCTF.CtfMonitorInstMutexDefault1
    Ipc O \Sessions\1\Windows\ApiPort
    Ipc O \Sessions\1\Windows\DwmApiPort
    Ipc O \Sessions\1\Windows\SharedSection
    Ipc O \Sessions\1\Windows\Theme1259923593
    Ipc O \Sessions\1\Windows\ThemeSection
    Ipc O \ThemeApiPort
    Ipc O \Windows\Theme3000190212
    Pipe -------------------------------
    Pipe ?
    Pipe \Device\CNG
    Pipe \Device\Harddisk0\DR0
    Pipe \Device\HarddiskVolume1
    Pipe \Device\HarddiskVolume3
    Pipe \Device\HarddiskVolume4
    Pipe \Device\HarddiskVolume5
    Pipe \Device\HarddiskVolume6
    Pipe \Device\KsecDD
    Pipe \Device\MountPointManager
    Pipe \device\namedpipe\_sandbox_john_new_session_1\crashpad_4708_mxqfvesdtedvztvz
    Pipe \device\namedpipe\_sandbox_john_new_session_1\crashpad_5928_wuqfqyqagqednrwh
    Pipe \device\namedpipe\crashpad_4708_mxqfvesdtedvztvz
    Pipe \Device\NamedPipe\crashpad_4708_MXQFVESDTEDVZTVZ
    Pipe \device\namedpipe\crashpad_4708_mxqfvesdtedvztvz
    Pipe \Device\NamedPipe\crashpad_4708_MXQFVESDTEDVZTVZ
    Pipe \device\namedpipe\crashpad_4708_mxqfvesdtedvztvz
    Pipe \Device\NamedPipe\crashpad_4708_MXQFVESDTEDVZTVZ
    Pipe \device\namedpipe\crashpad_4708_mxqfvesdtedvztvz
    Pipe \Device\NamedPipe\crashpad_4708_MXQFVESDTEDVZTVZ
    Pipe \device\namedpipe\crashpad_4708_mxqfvesdtedvztvz
    Pipe \device\namedpipe\crashpad_5928_wuqfqyqagqednrwh
    Pipe \Device\NamedPipe\crashpad_5928_WUQFQYQAGQEDNRWH
    Pipe \device\namedpipe\crashpad_5928_wuqfqyqagqednrwh
    Pipe \Device\NamedPipe\mojo.4708.12920.11031472535897963655
    Pipe \device\namedpipe\mojo.4708.12920.11031472535897963655
    Pipe \Device\NamedPipe\mojo.4708.12920.11412149717549067036
    Pipe \device\namedpipe\mojo.4708.12920.11412149717549067036
    Pipe \Device\NamedPipe\mojo.4708.12920.11412149717549067036
    Pipe \device\namedpipe\mojo.4708.12920.11412149717549067036
    Pipe \Device\NamedPipe\mojo.4708.12920.1159799873163945135
    Pipe \device\namedpipe\mojo.4708.12920.1159799873163945135
    Pipe \Device\NamedPipe\mojo.4708.12920.11852338616793080245
    Pipe \device\namedpipe\mojo.4708.12920.11852338616793080245
    Pipe \Device\NamedPipe\mojo.4708.12920.12030180617929569338
    Pipe \device\namedpipe\mojo.4708.12920.12030180617929569338
    Pipe \Device\NamedPipe\mojo.4708.12920.12131917641424342219
    Pipe \device\namedpipe\mojo.4708.12920.12131917641424342219
    Pipe \Device\NamedPipe\mojo.4708.12920.12170003647053465907
    Pipe \device\namedpipe\mojo.4708.12920.12170003647053465907
    Pipe \Device\NamedPipe\mojo.4708.12920.12170003647053465907
    Pipe \device\namedpipe\mojo.4708.12920.12170003647053465907
    Pipe \device\namedpipe\mojo.4708.12920.12505021496272058812
    Pipe \Device\NamedPipe\mojo.4708.12920.12505021496272058812
    Pipe \device\namedpipe\mojo.4708.12920.12505021496272058812
    Pipe \Device\NamedPipe\mojo.4708.12920.12764198306825371393
    Pipe \device\namedpipe\mojo.4708.12920.12764198306825371393
    Pipe \Device\NamedPipe\mojo.4708.12920.12764198306825371393
    Pipe \device\namedpipe\mojo.4708.12920.12764198306825371393
    Pipe \Device\NamedPipe\mojo.4708.12920.12779440496959112919
    Pipe \device\namedpipe\mojo.4708.12920.12779440496959112919
    Pipe \Device\NamedPipe\mojo.4708.12920.13058319108304218422
    Pipe \device\namedpipe\mojo.4708.12920.13058319108304218422
    Pipe \Device\NamedPipe\mojo.4708.12920.13058319108304218422
    Pipe \device\namedpipe\mojo.4708.12920.13058319108304218422
    Pipe \Device\NamedPipe\mojo.4708.12920.13330514369090445675
    Pipe \device\namedpipe\mojo.4708.12920.13330514369090445675
    Pipe \Device\NamedPipe\mojo.4708.12920.13330514369090445675
    Pipe \device\namedpipe\mojo.4708.12920.13330514369090445675
    Pipe \device\namedpipe\mojo.4708.12920.13714421549832811403
    Pipe \Device\NamedPipe\mojo.4708.12920.13714421549832811403
    Pipe \device\namedpipe\mojo.4708.12920.13714421549832811403
    Pipe \device\namedpipe\mojo.4708.12920.14021510151354368942
    Pipe \Device\NamedPipe\mojo.4708.12920.14021510151354368942
    Pipe \device\namedpipe\mojo.4708.12920.14021510151354368942
    Pipe \device\namedpipe\mojo.4708.12920.14314474368656369134
    Pipe \Device\NamedPipe\mojo.4708.12920.14314474368656369134
    Pipe \device\namedpipe\mojo.4708.12920.14314474368656369134
    Pipe \device\namedpipe\mojo.4708.12920.14439362466743273523
    Pipe \Device\NamedPipe\mojo.4708.12920.14439362466743273523
    Pipe \device\namedpipe\mojo.4708.12920.14439362466743273523
    Pipe \Device\NamedPipe\mojo.4708.12920.14740279975813978788
    Pipe \device\namedpipe\mojo.4708.12920.14740279975813978788
    Pipe \Device\NamedPipe\mojo.4708.12920.14740279975813978788
    Pipe \device\namedpipe\mojo.4708.12920.14740279975813978788
    Pipe \device\namedpipe\mojo.4708.12920.14781783464284587509
    Pipe \Device\NamedPipe\mojo.4708.12920.14781783464284587509
    Pipe \device\namedpipe\mojo.4708.12920.14781783464284587509
    Pipe \device\namedpipe\mojo.4708.12920.14825960440441463573
    Pipe \Device\NamedPipe\mojo.4708.12920.14825960440441463573
    Pipe \device\namedpipe\mojo.4708.12920.14825960440441463573
    Pipe \device\namedpipe\mojo.4708.12920.16835923565691681653
    Pipe \Device\NamedPipe\mojo.4708.12920.16835923565691681653
    Pipe \device\namedpipe\mojo.4708.12920.16835923565691681653
    Pipe \Device\NamedPipe\mojo.4708.12920.168999878364065693
    Pipe \device\namedpipe\mojo.4708.12920.168999878364065693
    Pipe \device\namedpipe\mojo.4708.12920.17161895026917479811
    Pipe \Device\NamedPipe\mojo.4708.12920.17161895026917479811
    Pipe \device\namedpipe\mojo.4708.12920.17161895026917479811
    Pipe \Device\NamedPipe\mojo.4708.12920.17161895026917479811
    Pipe \device\namedpipe\mojo.4708.12920.17161895026917479811
    Pipe \Device\NamedPipe\mojo.4708.12920.17555268183974384886
    Pipe \device\namedpipe\mojo.4708.12920.17555268183974384886
    Pipe \Device\NamedPipe\mojo.4708.12920.17995007859229168199
    Pipe \device\namedpipe\mojo.4708.12920.17995007859229168199
    Pipe \Device\NamedPipe\mojo.4708.12920.18128278247511620702
    Pipe \device\namedpipe\mojo.4708.12920.18128278247511620702
    Pipe \Device\NamedPipe\mojo.4708.12920.18351234200846317471
    Pipe \device\namedpipe\mojo.4708.12920.18351234200846317471
    Pipe \Device\NamedPipe\mojo.4708.12920.18351234200846317471
    Pipe \device\namedpipe\mojo.4708.12920.18351234200846317471
    Pipe \device\namedpipe\mojo.4708.12920.2909869448669382799
    Pipe \Device\NamedPipe\mojo.4708.12920.2909869448669382799
    Pipe \device\namedpipe\mojo.4708.12920.2909869448669382799
    Pipe \Device\NamedPipe\mojo.4708.12920.2919145272328832296
    Pipe \device\namedpipe\mojo.4708.12920.2919145272328832296
    Pipe \device\namedpipe\mojo.4708.12920.2960518617019747470
    Pipe \Device\NamedPipe\mojo.4708.12920.2960518617019747470
    Pipe \device\namedpipe\mojo.4708.12920.2960518617019747470
    Pipe \Device\NamedPipe\mojo.4708.12920.3395572367878140884
    Pipe \device\namedpipe\mojo.4708.12920.3395572367878140884
    Pipe \Device\NamedPipe\mojo.4708.12920.3395572367878140884
    Pipe \device\namedpipe\mojo.4708.12920.3395572367878140884
    Pipe \device\namedpipe\mojo.4708.12920.3485296258691402258
    Pipe \Device\NamedPipe\mojo.4708.12920.3485296258691402258
    Pipe \device\namedpipe\mojo.4708.12920.3485296258691402258
    Pipe \Device\NamedPipe\mojo.4708.12920.3794962490127607711
    Pipe \device\namedpipe\mojo.4708.12920.3794962490127607711
    Pipe \Device\NamedPipe\mojo.4708.12920.3794962490127607711
    Pipe \device\namedpipe\mojo.4708.12920.3794962490127607711
    Pipe \device\namedpipe\mojo.4708.12920.4390349088057634096
    Pipe \Device\NamedPipe\mojo.4708.12920.4390349088057634096
    Pipe \device\namedpipe\mojo.4708.12920.4390349088057634096
    Pipe \device\namedpipe\mojo.4708.12920.4646290112262024959
    Pipe \Device\NamedPipe\mojo.4708.12920.4646290112262024959
    Pipe \device\namedpipe\mojo.4708.12920.4646290112262024959
    Pipe \device\namedpipe\mojo.4708.12920.500635615003541500
    Pipe \Device\NamedPipe\mojo.4708.12920.500635615003541500
    Pipe \device\namedpipe\mojo.4708.12920.500635615003541500
    Pipe \Device\NamedPipe\mojo.4708.12920.5284129914767619991
    Pipe \device\namedpipe\mojo.4708.12920.5284129914767619991
    Pipe \Device\NamedPipe\mojo.4708.12920.5284129914767619991
    Pipe \device\namedpipe\mojo.4708.12920.5284129914767619991
    Pipe \Device\NamedPipe\mojo.4708.12920.582554350558161044
    Pipe \device\namedpipe\mojo.4708.12920.582554350558161044
    Pipe \Device\NamedPipe\mojo.4708.12920.582554350558161044
    Pipe \device\namedpipe\mojo.4708.12920.582554350558161044
    Pipe \Device\NamedPipe\mojo.4708.12920.5850542320342341282
    Pipe \device\namedpipe\mojo.4708.12920.5850542320342341282
    Pipe \Device\NamedPipe\mojo.4708.12920.5969889325561587898
    Pipe \device\namedpipe\mojo.4708.12920.5969889325561587898
    Pipe \device\namedpipe\mojo.4708.12920.612292112818849496
    Pipe \Device\NamedPipe\mojo.4708.12920.612292112818849496
    Pipe \device\namedpipe\mojo.4708.12920.612292112818849496
    Pipe \Device\NamedPipe\mojo.4708.12920.6474397978776460316
    Pipe \device\namedpipe\mojo.4708.12920.6474397978776460316
    Pipe \Device\NamedPipe\mojo.4708.12920.6906759917662013787
    Pipe \device\namedpipe\mojo.4708.12920.6906759917662013787
    Pipe \Device\NamedPipe\mojo.4708.12920.6906759917662013787
    Pipe \device\namedpipe\mojo.4708.12920.6906759917662013787
    Pipe \device\namedpipe\mojo.4708.12920.7212077617673069411
    Pipe \Device\NamedPipe\mojo.4708.12920.7212077617673069411
    Pipe \device\namedpipe\mojo.4708.12920.7212077617673069411
    Pipe \Device\NamedPipe\mojo.4708.12920.7352265442853205868
    Pipe \device\namedpipe\mojo.4708.12920.7352265442853205868
    Pipe \Device\NamedPipe\mojo.4708.12920.7352265442853205868
    Pipe \device\namedpipe\mojo.4708.12920.7352265442853205868
    Pipe \device\namedpipe\mojo.4708.12920.7807198634967041980
    Pipe \Device\NamedPipe\mojo.4708.12920.7807198634967041980
    Pipe \device\namedpipe\mojo.4708.12920.7807198634967041980
    Pipe \Device\NamedPipe\mojo.4708.12920.7928157383764407328
    Pipe \device\namedpipe\mojo.4708.12920.7928157383764407328
    Pipe \Device\NamedPipe\mojo.4708.12920.8514178029579955630
    Pipe \device\namedpipe\mojo.4708.12920.8514178029579955630
    Pipe \Device\NamedPipe\mojo.4708.12920.8514178029579955630
    Pipe \device\namedpipe\mojo.4708.12920.8514178029579955630
    Pipe \device\namedpipe\mojo.4708.12920.8637513678168066086
    Pipe \Device\NamedPipe\mojo.4708.12920.8637513678168066086
    Pipe \device\namedpipe\mojo.4708.12920.8637513678168066086
    Pipe \Device\NamedPipe\mojo.4708.12920.8648581792164209474
    Pipe \device\namedpipe\mojo.4708.12920.8648581792164209474
    Pipe \Device\NamedPipe\mojo.4708.12920.8648581792164209474
    Pipe \device\namedpipe\mojo.4708.12920.8648581792164209474
    Pipe \Device\NamedPipe\mojo.4708.12920.9298846195299119964
    Pipe \device\namedpipe\mojo.4708.12920.9298846195299119964
    Pipe \Device\NamedPipe\mojo.4708.12920.9298846195299119964
    Pipe \device\namedpipe\mojo.4708.12920.9298846195299119964
    Pipe \Device\NamedPipe\mojo.4708.12920.9479964244240060860
    Pipe \device\namedpipe\mojo.4708.12920.9479964244240060860
    Pipe \Device\NamedPipe\mojo.4708.12920.969813565333722327
    Pipe \device\namedpipe\mojo.4708.12920.969813565333722327
    Pipe \Device\NamedPipe\mojo.4708.12920.9735787378837671124
    Pipe \device\namedpipe\mojo.4708.12920.9735787378837671124
    Pipe \Device\NamedPipe\mojo.4708.12920.9817221327393041706
    Pipe \device\namedpipe\mojo.4708.12920.9817221327393041706
    Pipe \Device\NamedPipe\mojo.4708.12920.985605199126161976
    Pipe \device\namedpipe\mojo.4708.12920.985605199126161976
    Pipe \device\namedpipe\mojo.4708.17308.11228524382758137501
    Pipe \Device\NamedPipe\mojo.4708.17308.11228524382758137501
    Pipe \device\namedpipe\mojo.4708.17308.11228524382758137501
    Pipe \device\namedpipe\mojo.4708.17308.11622160078032857439
    Pipe \Device\NamedPipe\mojo.4708.17308.11622160078032857439
    Pipe \device\namedpipe\mojo.4708.17308.11622160078032857439
    Pipe \device\namedpipe\mojo.4708.17308.11787578566255527782
    Pipe \Device\NamedPipe\mojo.4708.17308.11787578566255527782
    Pipe \device\namedpipe\mojo.4708.17308.11787578566255527782
    Pipe \Device\NamedPipe\mojo.4708.17308.14273711521119222753
    Pipe \device\namedpipe\mojo.4708.17308.14273711521119222753
    Pipe \Device\NamedPipe\mojo.4708.17308.14273711521119222753
    Pipe \device\namedpipe\mojo.4708.17308.14273711521119222753
    Pipe \device\namedpipe\mojo.4708.17308.2446777623629611533
    Pipe \Device\NamedPipe\mojo.4708.17308.2446777623629611533
    Pipe \device\namedpipe\mojo.4708.17308.2446777623629611533
    Pipe \device\namedpipe\mojo.4708.17308.2589706825008637501
    Pipe \Device\NamedPipe\mojo.4708.17308.2589706825008637501
    Pipe \device\namedpipe\mojo.4708.17308.2589706825008637501
    Pipe \device\namedpipe\mojo.4708.17308.2980470621710716988
    Pipe \Device\NamedPipe\mojo.4708.17308.2980470621710716988
    Pipe \device\namedpipe\mojo.4708.17308.2980470621710716988
    Pipe \device\namedpipe\mojo.4708.17308.3661331197444116998
    Pipe \Device\NamedPipe\mojo.4708.17308.3661331197444116998
    Pipe \device\namedpipe\mojo.4708.17308.3661331197444116998
    Pipe \device\namedpipe\mojo.4708.17308.4099871751638789402
    Pipe \Device\NamedPipe\mojo.4708.17308.4099871751638789402
    Pipe \device\namedpipe\mojo.4708.17308.4099871751638789402
    Pipe \Device\NamedPipe\mojo.4708.17308.4174859073846423600
    Pipe \device\namedpipe\mojo.4708.17308.4174859073846423600
    Pipe \Device\NamedPipe\mojo.4708.17308.607926385925242585
    Pipe \device\namedpipe\mojo.4708.17308.607926385925242585
    Pipe \Device\NamedPipe\mojo.4708.17308.7638636303602651646
    Pipe \device\namedpipe\mojo.4708.17308.7638636303602651646
    Pipe \device\namedpipe\mojo.5928.11816.3228962720084267936
    Pipe \Device\NamedPipe\mojo.5928.11816.3228962720084267936
    Pipe \device\namedpipe\mojo.5928.11816.3228962720084267936
    Pipe \Device\NamedPipe\mojo.5928.11816.6129179651417110275
    Pipe \device\namedpipe\mojo.5928.11816.6129179651417110275
    Pipe \Device\NamedPipe\mojo.5928.13404.444393234417990465
    Pipe \device\namedpipe\mojo.5928.13404.444393234417990465
    Pipe \Device\NamedPipe\mojo.5928.13404.511239581364503029
    Pipe \device\namedpipe\mojo.5928.13404.511239581364503029
    Pipe \device\namedpipe\wkssvc
    Pipe \Device\Ndis
    Pipe \Device\NDMP10
    Pipe \Device\NDMP11
    Pipe \Device\NDMP12
    Pipe \Device\NDMP13
    Pipe \Device\NDMP14
    Pipe \Device\NDMP3
    Pipe \Device\NDMP4
    Pipe \Device\NDMP5
    Pipe \Device\NDMP6
    Pipe \Device\NDMP7
    Pipe \Device\NDMP8
    Pipe \Device\NDMP9
    Pipe \Device\NvAdminDevice
    Pipe O \Device\Afd
    Pipe O \Device\NetBT_Tcpip_{0675877A-AA83-4350-B365-7BC8D988E8AF}
    Pipe O \Device\NetBT_Tcpip_{335A9FBC-4084-4D7F-9C35-F5D3B1D0E287}
    Pipe O \Device\NetBT_Tcpip_{3772B5A7-B93D-4159-B946-7A0E0FA34367}
    Pipe O \Device\NetBT_Tcpip_{90B10FB4-D509-4A04-B300-D3485E78C7C0}
    Pipe O \Device\NetBT_Tcpip_{AE45094B-908E-46B5-934B-45FC09D33F41}
    Pipe O \Device\NetBT_Tcpip_{D6FE7B8A-B625-4488-A40C-F83CAEA73E0F}
    Pipe O \Device\Nsi
    WinCls -------------------------------
    WinCls O Shell_TrayWnd
    WinCls X ApplicationManager_DesktopShellWindow
    WinCls X Chrome_MessageWindow

    Output 3:

    (Drive) \Device\HarddiskVolume3
    Clsid -------------------------------
    Clsid {148BD52A-A2AB-11CE-B11F-00AA00530503} Scheduling Agent Service Class
    Clsid {3CE74DE4-53D3-4D74-8B83-431B3828BA53} TF_DisplayAttributeMgr
    Clsid {529A9E6B-6587-4F23-AB9E-9C7D683E3C50} TF_ThreadMgr
    Clsid {69486DD6-C19F-42E8-B508-A53F9F8E67B8} Offline Files Service Control
    Clsid {6CA50344-051A-4DED-9779-A43305165E35} ?
    Clsid {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} Windows Search Manager
    Clsid {A4B544A1-438D-4B41-9325-869523E2D6C7} TF_CategoryMgr
    Clsid {BCDE0395-E52F-467C-8E3D-C4579291692E} MMDeviceEnumerator class
    Clsid {C2F03A33-21F5-47FA-B4BB-156362A2F239} Immersive Shell
    Clsid {E2B3C97F-6AE1-41AC-817A-F6F92166D7DD} HNetCfg.FwPolicy2
    Clsid {E77CC89B-7401-4C04-8CED-149DB35ADD04} ?
    Clsid O {8BC3F05E-D86B-11D0-A075-00C04FB68820} Windows Management and Instrumentation
    File/Key -------------------------------
    Image -------------------------------
    Ipc -------------------------------
    Ipc ?
    Ipc \BaseNamedObjects\[CoreUI]-PID(14328)-TID(8300) e0ed8732-070c-481f-9269-f95f4bb2aed9
    Ipc \BaseNamedObjects\[CoreUI]-PID(8948)-TID(3828) 859e17a7-4dce-4410-b320-f9b4a1f12fcf
    Ipc \BaseNamedObjects\__ComCatalogCache__
    Ipc \BaseNamedObjects\{A3BD3259-3E4F-428a-84C8-F0463A9D3EB5}
    Ipc \BaseNamedObjects\{A64C7F33-DA35-459b-96CA-63B51FB0CDB9}
    Ipc \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{5C2DE0FC-64A5-4C06-8FA8-1A88FDDE355F}.2.ver0x0000000000000002.db
    Ipc \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db
    Ipc \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db
    Ipc \BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro
    Ipc \BaseNamedObjects\RotHintTable
    Ipc \BaseNamedObjects\SC_AutoStartComplete
    Ipc \BaseNamedObjects\windows_shell_global_counters
    Ipc \RPC Control\actkernel
    Ipc \RPC Control\epmapper
    Ipc \RPC Control\keysvc
    Ipc \RPC Control\LRPC-0d277784c67a6c39c5
    Ipc \RPC Control\OLE3952C082498763A7B2624A804B93
    Ipc \RPC Control\OLE869B5359B646AA0A7B21406A926F
    Ipc \RPC Control\OLEFF8CEF79390260ACCF9116EC3767
    Ipc \RPC Control\protected_storage
    Ipc \SBIE_DummyJob_chrome.exe_1
    Ipc \SBIE_DummyJob_chrome.exe_10
    Ipc \SBIE_DummyJob_chrome.exe_11
    Ipc \SBIE_DummyJob_chrome.exe_12
    Ipc \SBIE_DummyJob_chrome.exe_13
    Ipc \SBIE_DummyJob_chrome.exe_14
    Ipc \SBIE_DummyJob_chrome.exe_15
    Ipc \SBIE_DummyJob_chrome.exe_16
    Ipc \SBIE_DummyJob_chrome.exe_17
    Ipc \SBIE_DummyJob_chrome.exe_18
    Ipc \SBIE_DummyJob_chrome.exe_19
    Ipc \SBIE_DummyJob_chrome.exe_2
    Ipc \SBIE_DummyJob_chrome.exe_3
    Ipc \SBIE_DummyJob_chrome.exe_4
    Ipc \SBIE_DummyJob_chrome.exe_5
    Ipc \SBIE_DummyJob_chrome.exe_6
    Ipc \SBIE_DummyJob_chrome.exe_7
    Ipc \SBIE_DummyJob_chrome.exe_8
    Ipc \SBIE_DummyJob_chrome.exe_9
    Ipc \SBIE_DummyJob_software_reporter_tool.exe_1
    Ipc \SBIE_DummyJob_software_reporter_tool.exe_2
    Ipc \Sessions\1\BaseNamedObjects\__ComCatalogCache__
    Ipc \Sessions\1\BaseNamedObjects\__OMADM_NAMED_MUTEX__
    Ipc \Sessions\1\BaseNamedObjects\{A3BD3259-3E4F-428a-84C8-F0463A9D3EB5}
    Ipc \Sessions\1\BaseNamedObjects\{A64C7F33-DA35-459b-96CA-63B51FB0CDB9}
    Ipc \Sessions\1\BaseNamedObjects\{A946A6A9-917E-4949-B9BC-6BADA8C7FD63}
    Ipc \Sessions\1\BaseNamedObjects\37f8HWNDInterface:1705f4
    Ipc \Sessions\1\BaseNamedObjects\37f8HWNDInterface:2102cc
    Ipc \Sessions\1\BaseNamedObjects\37f8HWNDInterface:220562
    Ipc \Sessions\1\BaseNamedObjects\37f8HWNDInterface:230562
    Ipc \Sessions\1\BaseNamedObjects\37f8HWNDInterface:560520
    Ipc \Sessions\1\BaseNamedObjects\c:!program files (x86)!google!chrome!application!chrome.exe
    Ipc \Sessions\1\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{5C2DE0FC-64A5-4C06-8FA8-1A88FDDE355F}.2.ver0x0000000000000002.db
    Ipc \Sessions\1\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db
    Ipc \Sessions\1\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db
    Ipc \Sessions\1\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro
    Ipc \Sessions\1\BaseNamedObjects\C:*Users*********AppData*Local*Microsoft*Windows*Caches*{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000000c.db
    Ipc \Sessions\1\BaseNamedObjects\C:*Users*********AppData*Local*Microsoft*Windows*Caches*{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000002.db
    Ipc \Sessions\1\BaseNamedObjects\C:*Users*********AppData*Local*Microsoft*Windows*Caches*cversions.1.ro
    Ipc \Sessions\1\BaseNamedObjects\C:*Users*********AppData*Local*Microsoft*Windows*Caches*cversions.3.ro
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!025a78
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!1e06d8
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterEvent
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer
    Ipc \Sessions\1\BaseNamedObjects\C::Users:*******:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer
    Ipc \Sessions\1\BaseNamedObjects\ChromeProcessSingletonStartup!
    Ipc \Sessions\1\BaseNamedObjects\ComPlusCOMRegTable
    Ipc \Sessions\1\BaseNamedObjects\RotHintTable
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_10368
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_10412
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_10564
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_10616
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_11948
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_12932
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_13396
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_13736
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_14328
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_14728
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_15080
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_16352
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_16960
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_17588
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_18040
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_18056
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_2312
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_3576
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_4360
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_4608
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_4708
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_6272
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_6328
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_6832
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_7072
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_8280
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_8356
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_8384
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_8760
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_8836
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_9052
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_DummyEvent_9952
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_RPCSS_SXS_READY
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceCrypto_Mutex1
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_cryptsvc
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_DcomLaunch
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_Mutex1
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_RpcEptMapper
    Ipc \Sessions\1\BaseNamedObjects\SBIE_BOXED_ServiceInitComplete_RpcSs
    Ipc \Sessions\1\BaseNamedObjects\SBIE_WindowsInstallerInUse
    Ipc \Sessions\1\BaseNamedObjects\SboxSession
    Ipc \Sessions\1\BaseNamedObjects\SC_AutoStartComplete
    Ipc \Sessions\1\BaseNamedObjects\ScmCreatedEvent
    Ipc \Sessions\1\BaseNamedObjects\SM0:10368:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:10368:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:10368:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:10368:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:10368:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:10368:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:10412:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:10412:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:10412:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:10412:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:10412:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:10412:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:10616:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:10616:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:10616:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:11948:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:11948:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:11948:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:11948:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:11948:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:11948:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:12932:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:12932:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:12932:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:12932:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:12932:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:12932:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:13396:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:13396:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:13396:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:13396:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:13396:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:13396:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:14328:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:14328:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:14328:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:14328:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:14328:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:14328:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:14728:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:14728:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:14728:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:15080:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:15080:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:15080:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:17588:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:17588:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:17588:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:17588:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:17588:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:17588:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:4360:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:4360:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:4360:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:4360:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:4360:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:4360:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:6328:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:6328:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:6328:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:7072:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:7072:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:7072:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:8280:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:8280:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:8280:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:8280:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:8280:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:8280:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:8384:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:8384:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:8384:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:8384:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:8384:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:8384:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:8836:120:WilError_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:8836:120:WilError_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:8836:120:WilError_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SM0:8836:304:WilStaging_02
    Ipc \Sessions\1\BaseNamedObjects\SM0:8836:304:WilStaging_02_p0
    Ipc \Sessions\1\BaseNamedObjects\SM0:8836:304:WilStaging_02_p0h
    Ipc \Sessions\1\BaseNamedObjects\SyncRootManager
    Ipc \Sessions\1\BaseNamedObjects\windows_shell_global_counters
    Ipc O \BaseNamedObjects\CoreMessagingRegistrar
    Ipc O \BaseNamedObjects\FontCachePort
    Ipc O \BaseNamedObjects\msctf.serverDefault1
    Ipc O \KernelObjects\LowMemoryCondition
    Ipc O \KernelObjects\MaximumCommitCondition
    Ipc O \KnownDlls\advapi32.dll
    Ipc O \KnownDlls\bcrypt.dll
    Ipc O \KnownDlls\bcryptPrimitives.dll
    Ipc O \KnownDlls\cfgmgr32.dll
    Ipc O \KnownDlls\clbcatq.dll
    Ipc O \KnownDlls\combase.dll
    Ipc O \KnownDlls\COMDLG32.dll
    Ipc O \KnownDlls\CRYPT32.dll
    Ipc O \KnownDlls\cryptsp.dll
    Ipc O \KnownDlls\gdi32.dll
    Ipc O \KnownDlls\gdi32full.dll
    Ipc O \KnownDlls\IMAGEHLP.dll
    Ipc O \KnownDlls\IMM32.dll
    Ipc O \KnownDlls\kernel.appcore.dll
    Ipc O \KnownDlls\kernel32.dll
    Ipc O \KnownDlls\KERNELBASE.dll
    Ipc O \KnownDlls\MSASN1.dll
    Ipc O \KnownDlls\MSCTF.dll
    Ipc O \KnownDlls\msvcp_win.dll
    Ipc O \KnownDlls\MSVCRT.dll
    Ipc O \KnownDlls\NSI.dll
    Ipc O \KnownDlls\ole32.dll
    Ipc O \KnownDlls\OLEAUT32.dll
    Ipc O \KnownDlls\powrprof.dll
    Ipc O \KnownDlls\profapi.dll
    Ipc O \KnownDlls\PSAPI.DLL
    Ipc O \KnownDlls\rpcrt4.dll
    Ipc O \KnownDlls\sechost.dll
    Ipc O \KnownDlls\Setupapi.dll
    Ipc O \KnownDlls\SHCORE.dll
    Ipc O \KnownDlls\SHELL32.dll
    Ipc O \KnownDlls\SHLWAPI.dll
    Ipc O \KnownDlls\ucrtbase.dll
    Ipc O \KnownDlls\UMPDC.dll
    Ipc O \KnownDlls\user32.dll
    Ipc O \KnownDlls\win32u.dll
    Ipc O \KnownDlls\windows.storage.dll
    Ipc O \KnownDlls\WINTRUST.dll
    Ipc O \KnownDlls\WS2_32.dll
    Ipc O \RPC Control\AudioClientRpc
    Ipc O \RPC Control\Audiosrv
    Ipc O \RPC Control\dhcpcsvc
    Ipc O \RPC Control\dhcpcsvc6
    Ipc O \RPC Control\LRPC-0d277784c67a6c39c5
    Ipc O \RPC Control\lsapolicylookup
    Ipc O \RPC Control\LSARPC_ENDPOINT
    Ipc O \RPC Control\lsasspirpc
    Ipc O \RPC Control\nlaapi
    Ipc O \RPC Control\samss lpc
    Ipc O \RPC Control\SbieSvcPort
    Ipc O \Security\LSA_AUTHENTICATION_INITIALIZED
    Ipc O \Sessions\1\BaseNamedObjects\__DDrawCheckExclMode__
    Ipc O \Sessions\1\BaseNamedObjects\__DDrawExclMode__
    Ipc O \Sessions\1\BaseNamedObjects\CicLoadWinStaWinSta0
    Ipc O \Sessions\1\BaseNamedObjects\CTF.AsmListCache.FMPDefault1
    Ipc O \Sessions\1\BaseNamedObjects\MSCTF.Asm.MutexDefault1
    Ipc O \Sessions\1\BaseNamedObjects\MSCTF.CtfMonitorInstMutexDefault1
    Ipc O \Sessions\1\Windows\ApiPort
    Ipc O \Sessions\1\Windows\DwmApiPort
    Ipc O \Sessions\1\Windows\SharedSection
    Ipc O \Sessions\1\Windows\Theme1259923593
    Ipc O \Sessions\1\Windows\ThemeSection
    Ipc O \ThemeApiPort
    Ipc O \Windows\Theme3000190212
    Pipe -------------------------------
    Pipe ?
    Pipe \Device\ccSet_{0C55C096-0F1D-4F28-AAA2-85EF591126E7}
    Pipe \Device\CNG
    Pipe \Device\Harddisk0\DR0
    Pipe \Device\HarddiskVolume1
    Pipe \Device\HarddiskVolume3
    Pipe \Device\HarddiskVolume4
    Pipe \Device\HarddiskVolume5
    Pipe \Device\HarddiskVolume6
    Pipe \Device\KsecDD
    Pipe \Device\MountPointManager
    Pipe \device\namedpipe\_sandbox_john_new_session_1\crashpad_14328_seiishsudzqexmma
    Pipe \device\namedpipe\_sandbox_john_new_session_1\crashpad_15080_qjvsbqtahregxufp
    Pipe \Device\NamedPipe\crashpad_14328_SEIISHSUDZQEXMMA
    Pipe \device\namedpipe\crashpad_14328_seiishsudzqexmma
    Pipe \Device\NamedPipe\crashpad_14328_SEIISHSUDZQEXMMA
    Pipe \device\namedpipe\crashpad_14328_seiishsudzqexmma
    Pipe \Device\NamedPipe\crashpad_14328_SEIISHSUDZQEXMMA
    Pipe \device\namedpipe\crashpad_14328_seiishsudzqexmma
    Pipe \device\namedpipe\crashpad_15080_qjvsbqtahregxufp
    Pipe \Device\NamedPipe\crashpad_15080_QJVSBQTAHREGXUFP
    Pipe \device\namedpipe\crashpad_15080_qjvsbqtahregxufp
    Pipe \Device\NamedPipe\mojo.14328.6524.10189412657478413445
    Pipe \device\namedpipe\mojo.14328.6524.10189412657478413445
    Pipe \device\namedpipe\mojo.14328.6524.10254890921952274233
    Pipe \Device\NamedPipe\mojo.14328.6524.10254890921952274233
    Pipe \device\namedpipe\mojo.14328.6524.10254890921952274233
    Pipe \Device\NamedPipe\mojo.14328.6524.10678833372633662877
    Pipe \device\namedpipe\mojo.14328.6524.10678833372633662877
    Pipe \Device\NamedPipe\mojo.14328.6524.10678833372633662877
    Pipe \device\namedpipe\mojo.14328.6524.10678833372633662877
    Pipe \Device\NamedPipe\mojo.14328.6524.11354140727421310936
    Pipe \device\namedpipe\mojo.14328.6524.11354140727421310936
    Pipe \Device\NamedPipe\mojo.14328.6524.11354140727421310936
    Pipe \device\namedpipe\mojo.14328.6524.11354140727421310936
    Pipe \Device\NamedPipe\mojo.14328.6524.11488502325406517921
    Pipe \device\namedpipe\mojo.14328.6524.11488502325406517921
    Pipe \device\namedpipe\mojo.14328.6524.11870892686471568891
    Pipe \Device\NamedPipe\mojo.14328.6524.11870892686471568891
    Pipe \device\namedpipe\mojo.14328.6524.11870892686471568891
    Pipe \device\namedpipe\mojo.14328.6524.12191899109123215289
    Pipe \Device\NamedPipe\mojo.14328.6524.12191899109123215289
    Pipe \device\namedpipe\mojo.14328.6524.12191899109123215289
    Pipe \device\namedpipe\mojo.14328.6524.12341031152154866386
    Pipe \Device\NamedPipe\mojo.14328.6524.12341031152154866386
    Pipe \device\namedpipe\mojo.14328.6524.12341031152154866386
    Pipe \device\namedpipe\mojo.14328.6524.1241467378622430925
    Pipe \Device\NamedPipe\mojo.14328.6524.1241467378622430925
    Pipe \device\namedpipe\mojo.14328.6524.1241467378622430925
    Pipe \device\namedpipe\mojo.14328.6524.12786948556544163282
    Pipe \Device\NamedPipe\mojo.14328.6524.12786948556544163282
    Pipe \device\namedpipe\mojo.14328.6524.12786948556544163282
    Pipe \device\namedpipe\mojo.14328.6524.13082893476136153943
    Pipe \Device\NamedPipe\mojo.14328.6524.13082893476136153943
    Pipe \device\namedpipe\mojo.14328.6524.13082893476136153943
    Pipe \device\namedpipe\mojo.14328.6524.13397891381296130294
    Pipe \Device\NamedPipe\mojo.14328.6524.13397891381296130294
    Pipe \device\namedpipe\mojo.14328.6524.13397891381296130294
    Pipe \device\namedpipe\mojo.14328.6524.1434729649926290570
    Pipe \Device\NamedPipe\mojo.14328.6524.1434729649926290570
    Pipe \device\namedpipe\mojo.14328.6524.1434729649926290570
    Pipe \Device\NamedPipe\mojo.14328.6524.14772437408556922707
    Pipe \device\namedpipe\mojo.14328.6524.14772437408556922707
    Pipe \device\namedpipe\mojo.14328.6524.14888408054090318571
    Pipe \Device\NamedPipe\mojo.14328.6524.14888408054090318571
    Pipe \device\namedpipe\mojo.14328.6524.14888408054090318571
    Pipe \Device\NamedPipe\mojo.14328.6524.15194165221720161747
    Pipe \device\namedpipe\mojo.14328.6524.15194165221720161747
    Pipe \device\namedpipe\mojo.14328.6524.15364874055446587160
    Pipe \Device\NamedPipe\mojo.14328.6524.15364874055446587160
    Pipe \device\namedpipe\mojo.14328.6524.15364874055446587160
    Pipe \Device\NamedPipe\mojo.14328.6524.15469938361113776305
    Pipe \device\namedpipe\mojo.14328.6524.15469938361113776305
    Pipe \Device\NamedPipe\mojo.14328.6524.15469938361113776305
    Pipe \device\namedpipe\mojo.14328.6524.15469938361113776305
    Pipe \device\namedpipe\mojo.14328.6524.15776116848417324077
    Pipe \Device\NamedPipe\mojo.14328.6524.15776116848417324077
    Pipe \device\namedpipe\mojo.14328.6524.15776116848417324077
    Pipe \Device\NamedPipe\mojo.14328.6524.15856073974998318289
    Pipe \device\namedpipe\mojo.14328.6524.15856073974998318289
    Pipe \Device\NamedPipe\mojo.14328.6524.15856073974998318289
    Pipe \device\namedpipe\mojo.14328.6524.15856073974998318289
    Pipe \Device\NamedPipe\mojo.14328.6524.15992928314128760630
    Pipe \device\namedpipe\mojo.14328.6524.15992928314128760630
    Pipe \Device\NamedPipe\mojo.14328.6524.15992928314128760630
    Pipe \device\namedpipe\mojo.14328.6524.15992928314128760630
    Pipe \device\namedpipe\mojo.14328.6524.1627659315736839558
    Pipe \Device\NamedPipe\mojo.14328.6524.1627659315736839558
    Pipe \device\namedpipe\mojo.14328.6524.1627659315736839558
    Pipe \device\namedpipe\mojo.14328.6524.16356075642613444384
    Pipe \Device\NamedPipe\mojo.14328.6524.16356075642613444384
    Pipe \device\namedpipe\mojo.14328.6524.16356075642613444384
    Pipe \device\namedpipe\mojo.14328.6524.16755586313827615798
    Pipe \Device\NamedPipe\mojo.14328.6524.16755586313827615798
    Pipe \device\namedpipe\mojo.14328.6524.16755586313827615798
    Pipe \Device\NamedPipe\mojo.14328.6524.16922891799341693725
    Pipe \device\namedpipe\mojo.14328.6524.16922891799341693725
    Pipe \Device\NamedPipe\mojo.14328.6524.16922891799341693725
    Pipe \device\namedpipe\mojo.14328.6524.16922891799341693725
    Pipe \Device\NamedPipe\mojo.14328.6524.16964883487829766142
    Pipe \device\namedpipe\mojo.14328.6524.16964883487829766142
    Pipe \Device\NamedPipe\mojo.14328.6524.17109447563210650594
    Pipe \device\namedpipe\mojo.14328.6524.17109447563210650594
    Pipe \Device\NamedPipe\mojo.14328.6524.17109447563210650594
    Pipe \device\namedpipe\mojo.14328.6524.17109447563210650594
    Pipe \device\namedpipe\mojo.14328.6524.17709230384788699416
    Pipe \Device\NamedPipe\mojo.14328.6524.17709230384788699416
    Pipe \device\namedpipe\mojo.14328.6524.17709230384788699416
    Pipe \Device\NamedPipe\mojo.14328.6524.18039452575348338607
    Pipe \device\namedpipe\mojo.14328.6524.18039452575348338607
    Pipe \Device\NamedPipe\mojo.14328.6524.1938955288967544217
    Pipe \device\namedpipe\mojo.14328.6524.1938955288967544217
    Pipe \Device\NamedPipe\mojo.14328.6524.2936041160644521823
    Pipe \device\namedpipe\mojo.14328.6524.2936041160644521823
    Pipe \Device\NamedPipe\mojo.14328.6524.2936041160644521823
    Pipe \device\namedpipe\mojo.14328.6524.2936041160644521823
    Pipe \Device\NamedPipe\mojo.14328.6524.3304180306487146254
    Pipe \device\namedpipe\mojo.14328.6524.3304180306487146254
    Pipe \Device\NamedPipe\mojo.14328.6524.3415145878825295269
    Pipe \device\namedpipe\mojo.14328.6524.3415145878825295269
    Pipe \Device\NamedPipe\mojo.14328.6524.4145862340947167831
    Pipe \device\namedpipe\mojo.14328.6524.4145862340947167831
    Pipe \Device\NamedPipe\mojo.14328.6524.4868930735543949553
    Pipe \device\namedpipe\mojo.14328.6524.4868930735543949553
    Pipe \Device\NamedPipe\mojo.14328.6524.4868930735543949553
    Pipe \device\namedpipe\mojo.14328.6524.4868930735543949553
    Pipe \device\namedpipe\mojo.14328.6524.5664994263342147191
    Pipe \Device\NamedPipe\mojo.14328.6524.5664994263342147191
    Pipe \device\namedpipe\mojo.14328.6524.5664994263342147191
    Pipe \device\namedpipe\mojo.14328.6524.5778596292057333718
    Pipe \Device\NamedPipe\mojo.14328.6524.5778596292057333718
    Pipe \device\namedpipe\mojo.14328.6524.5778596292057333718
    Pipe \device\namedpipe\mojo.14328.6524.5959614286319352026
    Pipe \Device\NamedPipe\mojo.14328.6524.5959614286319352026
    Pipe \device\namedpipe\mojo.14328.6524.5959614286319352026
    Pipe \device\namedpipe\mojo.14328.6524.5999752020435151628
    Pipe \Device\NamedPipe\mojo.14328.6524.5999752020435151628
    Pipe \device\namedpipe\mojo.14328.6524.5999752020435151628
    Pipe \device\namedpipe\mojo.14328.6524.703589606728712067
    Pipe \Device\NamedPipe\mojo.14328.6524.703589606728712067
    Pipe \device\namedpipe\mojo.14328.6524.703589606728712067
    Pipe \Device\NamedPipe\mojo.14328.6524.7772863630222940924
    Pipe \device\namedpipe\mojo.14328.6524.7772863630222940924
    Pipe \Device\NamedPipe\mojo.14328.6524.7842757856469642664
    Pipe \device\namedpipe\mojo.14328.6524.7842757856469642664
    Pipe \Device\NamedPipe\mojo.14328.6524.7842757856469642664
    Pipe \device\namedpipe\mojo.14328.6524.7842757856469642664
    Pipe \device\namedpipe\mojo.14328.6524.7924995799298948821
    Pipe \Device\NamedPipe\mojo.14328.6524.7924995799298948821
    Pipe \device\namedpipe\mojo.14328.6524.7924995799298948821
    Pipe \Device\NamedPipe\mojo.14328.6524.8177010580755374654
    Pipe \device\namedpipe\mojo.14328.6524.8177010580755374654
    Pipe \Device\NamedPipe\mojo.14328.6524.8177010580755374654
    Pipe \device\namedpipe\mojo.14328.6524.8177010580755374654
    Pipe \device\namedpipe\mojo.14328.6524.8210115380133701612
    Pipe \Device\NamedPipe\mojo.14328.6524.8210115380133701612
    Pipe \device\namedpipe\mojo.14328.6524.8210115380133701612
    Pipe \device\namedpipe\mojo.14328.6524.8306027225991803000
    Pipe \Device\NamedPipe\mojo.14328.6524.8306027225991803000
    Pipe \device\namedpipe\mojo.14328.6524.8306027225991803000
    Pipe \Device\NamedPipe\mojo.14328.6524.860566605027893839
    Pipe \device\namedpipe\mojo.14328.6524.860566605027893839
    Pipe \device\namedpipe\mojo.14328.6524.8628268352070531938
    Pipe \Device\NamedPipe\mojo.14328.6524.8628268352070531938
    Pipe \device\namedpipe\mojo.14328.6524.8628268352070531938
    Pipe \Device\NamedPipe\mojo.14328.6524.9113429253148266043
    Pipe \device\namedpipe\mojo.14328.6524.9113429253148266043
    Pipe \device\namedpipe\mojo.14328.8300.11614803888559480019
    Pipe \Device\NamedPipe\mojo.14328.8300.11614803888559480019
    Pipe \device\namedpipe\mojo.14328.8300.11614803888559480019
    Pipe \Device\NamedPipe\mojo.14328.8300.11717506959459058564
    Pipe \device\namedpipe\mojo.14328.8300.11717506959459058564
    Pipe \Device\NamedPipe\mojo.14328.8300.12428550494675321875
    Pipe \device\namedpipe\mojo.14328.8300.12428550494675321875
    Pipe \Device\NamedPipe\mojo.14328.8300.12428550494675321875
    Pipe \device\namedpipe\mojo.14328.8300.12428550494675321875
    Pipe \Device\NamedPipe\mojo.14328.8300.12937348258214319363
    Pipe \device\namedpipe\mojo.14328.8300.12937348258214319363
    Pipe \device\namedpipe\mojo.14328.8300.17393308482140110538
    Pipe \Device\NamedPipe\mojo.14328.8300.17393308482140110538
    Pipe \device\namedpipe\mojo.14328.8300.17393308482140110538
    Pipe \device\namedpipe\mojo.14328.8300.17448152284403117182
    Pipe \Device\NamedPipe\mojo.14328.8300.17448152284403117182
    Pipe \device\namedpipe\mojo.14328.8300.17448152284403117182
    Pipe \Device\NamedPipe\mojo.14328.8300.17674201889418344206
    Pipe \device\namedpipe\mojo.14328.8300.17674201889418344206
    Pipe \Device\NamedPipe\mojo.14328.8300.17922680753315103237
    Pipe \device\namedpipe\mojo.14328.8300.17922680753315103237
    Pipe \Device\NamedPipe\mojo.14328.8300.17922680753315103237
    Pipe \device\namedpipe\mojo.14328.8300.17922680753315103237
    Pipe \Device\NamedPipe\mojo.14328.8300.18032400002757401895
    Pipe \device\namedpipe\mojo.14328.8300.18032400002757401895
    Pipe \Device\NamedPipe\mojo.14328.8300.6842144704714578392
    Pipe \device\namedpipe\mojo.14328.8300.6842144704714578392
    Pipe \device\namedpipe\mojo.14328.8300.7230652190181995961
    Pipe \Device\NamedPipe\mojo.14328.8300.7230652190181995961
    Pipe \device\namedpipe\mojo.14328.8300.7230652190181995961
    Pipe \Device\NamedPipe\mojo.14328.8300.9601493183390769687
    Pipe \device\namedpipe\mojo.14328.8300.9601493183390769687
    Pipe \Device\NamedPipe\mojo.15080.10620.1799721458635636233
    Pipe \device\namedpipe\mojo.15080.10620.1799721458635636233
    Pipe \Device\NamedPipe\mojo.15080.10620.8483408908796259817
    Pipe \device\namedpipe\mojo.15080.10620.8483408908796259817
    Pipe \Device\NamedPipe\mojo.15080.8968.17164888975482602850
    Pipe \device\namedpipe\mojo.15080.8968.17164888975482602850
    Pipe \device\namedpipe\mojo.15080.8968.8608737609009036280
    Pipe \Device\NamedPipe\mojo.15080.8968.8608737609009036280
    Pipe \device\namedpipe\mojo.15080.8968.8608737609009036280
    Pipe \device\namedpipe\wkssvc
    Pipe \Device\Ndis
    Pipe \Device\NDMP10
    Pipe \Device\NDMP11
    Pipe \Device\NDMP12
    Pipe \Device\NDMP13
    Pipe \Device\NDMP14
    Pipe \Device\NDMP3
    Pipe \Device\NDMP4
    Pipe \Device\NDMP5
    Pipe \Device\NDMP6
    Pipe \Device\NDMP7
    Pipe \Device\NDMP8
    Pipe \Device\NDMP9
    Pipe \Device\NvAdminDevice
    Pipe \Device\SYMEFASI
    Pipe O \Device\Afd
    Pipe O \Device\NetBT_Tcpip_{0675877A-AA83-4350-B365-7BC8D988E8AF}
    Pipe O \Device\NetBT_Tcpip_{335A9FBC-4084-4D7F-9C35-F5D3B1D0E287}
    Pipe O \Device\NetBT_Tcpip_{3772B5A7-B93D-4159-B946-7A0E0FA34367}
    Pipe O \Device\NetBT_Tcpip_{90B10FB4-D509-4A04-B300-D3485E78C7C0}
    Pipe O \Device\NetBT_Tcpip_{AE45094B-908E-46B5-934B-45FC09D33F41}
    Pipe O \Device\NetBT_Tcpip_{D6FE7B8A-B625-4488-A40C-F83CAEA73E0F}
    Pipe O \Device\Nsi
    WinCls -------------------------------
    WinCls O Shell_TrayWnd
    WinCls X ApplicationManager_DesktopShellWindow
    WinCls X Chrome_MessageWindow

  • Hi John,

    Provided the message is not a metro related thing (which then it won't work in SBIE www.sandboxie.com/KnownConflicts, here are a few things for you to try:

    1 - Disable your AV software (or uninstall it), delete the contents of your Sandbox and retest
    2 - If that doesn't help, re-install/enable your AV and proceed with the next entry (if it did help, still reinstall/enable your AV and try creating exclusions for the Sandboxie installation folder).

    3) Try opening these COM classes one at a time, delete the contents of your Sandbox and retest as you make changes:

    Clsid {148BD52A-A2AB-11CE-B11F-00AA00530503} Scheduling Agent Service Class
    Clsid {3CE74DE4-53D3-4D74-8B83-431B3828BA53} TF_DisplayAttributeMgr
    Clsid {529A9E6B-6587-4F23-AB9E-9C7D683E3C50} TF_ThreadMgr
    Clsid {69486DD6-C19F-42E8-B508-A53F9F8E67B8} Offline Files Service Control
    Clsid {6CA50344-051A-4DED-9779-A43305165E35} ?
    Clsid {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} Windows Search Manager
    Clsid {A4B544A1-438D-4B41-9325-869523E2D6C7} TF_CategoryMgr
    Clsid {BCDE0395-E52F-467C-8E3D-C4579291692E} MMDeviceEnumerator class
    Clsid {C2F03A33-21F5-47FA-B4BB-156362A2F239} Immersive Shell
    Clsid {E2B3C97F-6AE1-41AC-817A-F6F92166D7DD} HNetCfg.FwPolicy2
    Clsid {E77CC89B-7401-4C04-8CED-149DB35ADD04} ?
    Clsid O {8BC3F05E-D86B-11D0-A075-00C04FB68820} Windows Management and Instrumentation

    To open a COM class, follow these steps: www.sandboxie.com/ResourceAccessSettings

    4) If the above doesn't help, revert the changes and try these IPCs one at a time (or any other IPCs that do not have an "O" at the beginning:
    Ipc \Sessions\1\BaseNamedObjects\__ComCatalogCache__
    Ipc \Sessions\1\BaseNamedObjects\__OMADM_NAMED_MUTEX__
    Ipc \Sessions\1\BaseNamedObjects\{A3BD3259-3E4F-428a-84C8-F0463A9D3EB5}
    Ipc \Sessions\1\BaseNamedObjects\{A64C7F33-DA35-459b-96CA-63B51FB0CDB9}
    Ipc \Sessions\1\BaseNamedObjects\{A946A6A9-917E-4949-B9BC-6BADA8C7FD63}

    To open an IPC follow these steps:
    www.sandboxie.com/ResourceAccessSettings
    You'll want to add from the BaseNamed Objects... so for example:
    \BaseNamedObjects\{A3BD3259-3E4F-428a-84C8-F0463A9D3EB5}

    Last but not least, you may want to try this particular IPC
    \BaseNamedObjects\[CoreUI]-PID*


    Every step listed involves punching holes in the Sandbox, so it is important that you test one at a time, and revert any changes if they don't help.

    Hope you can find it!

    Regards,

    Barb@Sophos
    Community Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.

     

  • I know you wanted me to revert the changes after adding each COM or IPCs which is very time consuming, but I was wondering is it possible to add all the COM class and IPC all at once to see if it gets it to work, then shorting down the list by deleting one at a time? I've tried the ones that were suggested and have not had any success.

    Another question is when adding the IPCs do you need to add "*" before \BaseNameOjects...

  • Hi John Wick,

    You can use an asterisk * to open everything, however it will most likely trigger issues, and, if you were to open everything, you'd be defeating the purpose of the Sandbox.

    Regarding the second question: yes, you need to add the asterisk  as shown on my previous steps. 

    Regards,

    Barb@Sophos
    Community Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.

     

  • I poked some big holes then I was able to narrow it down to two IPCs to get it working.

    Ipc \RPC Control\epmapper
    Ipc \RPC Control\keysvc

    Since you mentioned of it opening up holes in the sandbox, I was wondering if adding these two specific IPCs will create a security risk(exploit) in my sandbox?

     

    One other thing as I was messing around with the IPCs in making sure these were the two. I had remove the "keysvc" one on my IPC list to test it out, and had tried logging into google. Sandboxie came up with this error message:

    SBIE2101 Object name not found: \BaseNamedObjects\WebAuthNUICancellation_d7cef81e-7b79-4574-aef4-b47a484dbe81, error CreateEvent (C0000022) access=001F0003 initialized=1
    SBIE2314 Canceling process SandboxieCrypto.exe [53064 / 7]
    SBIE2314 Canceling process SandboxieCrypto.exe [53064 / 7]
    SBIE2314 Canceling process SandboxieCrypto.exe [53064 / 7]
    SBIE2314 Canceling process SandboxieCrypto.exe [53064 / 7]
    SBIE2314 Canceling process SandboxieCrypto.exe [53064 / 7]
    SBIE2314 Canceling process SandboxieCrypto.exe [53064 / 7]
    SBIE2314 Canceling process SandboxieCrypto.exe [53064 / 7]
    SBIE2314 Canceling process SandboxieCrypto.exe [53064 / 7]

    My pressumption was correct in it having to do with WebAuthn.

  • I thought I had a fix to this issue, but by adding those two IPCs I have lost all sound in my browser, which is so weird. By deleteing them off my IPC list, the sound works fine. 

  • Hi John Wick,

    You may try to open the IPCs for the browser only, instead of generally, and see if that helps.
    Right-click on your Sandbox--> Sandbox settings --> Resource Access --> IPC Access --> Direct Access
    Click "Add program"  and choose the browser
    Then, add the IPC under that browser's list. 

    Re-test. 

    Opening Ipc \RPC Control\epmapper may trigger issues such as slowness and crashes inside the Sandbox. There is currently a template (that will most likely trigger issues in Win 10) for Screen Readers, that, among other things (please don't use this template) , opens up that particular IPC:
    Right-click on your Sandbox--> Sandbox settings -->Applications --> All Applications --> Screen Readers (JAWS, NVDA...) , highlight it and click "View Code" to learn more about it.  

    Regarding security, opening an IPC allows a Sandboxed application to interact with some service/program on the host . If your OS is up-to-date, it is generally "safe" to open an IPC to workaround an issue for the sandboxed app.  However, you are still punching holes.
    It comes down to how much do you want to use a particular feature inside the Sandbox, and considering creating separate Sandboxes for extra layers of security. Also, restricting the IPC to a specific program may help with security (if it works). The rest will be handled by your OS security and your AV software. 
    At the end of the day, most templates for Sandboxie include opening (or sometimes closing) IPCs, COM classes, a specific file, etc...

    Regards,

    Barb@Sophos
    Community Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.

     

Reply
  • Hi John Wick,

    You may try to open the IPCs for the browser only, instead of generally, and see if that helps.
    Right-click on your Sandbox--> Sandbox settings --> Resource Access --> IPC Access --> Direct Access
    Click "Add program"  and choose the browser
    Then, add the IPC under that browser's list. 

    Re-test. 

    Opening Ipc \RPC Control\epmapper may trigger issues such as slowness and crashes inside the Sandbox. There is currently a template (that will most likely trigger issues in Win 10) for Screen Readers, that, among other things (please don't use this template) , opens up that particular IPC:
    Right-click on your Sandbox--> Sandbox settings -->Applications --> All Applications --> Screen Readers (JAWS, NVDA...) , highlight it and click "View Code" to learn more about it.  

    Regarding security, opening an IPC allows a Sandboxed application to interact with some service/program on the host . If your OS is up-to-date, it is generally "safe" to open an IPC to workaround an issue for the sandboxed app.  However, you are still punching holes.
    It comes down to how much do you want to use a particular feature inside the Sandbox, and considering creating separate Sandboxes for extra layers of security. Also, restricting the IPC to a specific program may help with security (if it works). The rest will be handled by your OS security and your AV software. 
    At the end of the day, most templates for Sandboxie include opening (or sometimes closing) IPCs, COM classes, a specific file, etc...

    Regards,

    Barb@Sophos
    Community Support Engineer | Sophos Technical Support
    Knowledge Base  |  @SophosSupport  | Sign up for SMS Alerts
    If a post solves your question use the 'This helped me' link.

     

Children
No Data