Is there a separate cache for loaded images? In my isolation filter, I noticed that non-Windows images when loading into a process will not trigger a IRP_MJ_READ more than once. I still see reads for Windows system files (ntdll, kernel32) but the non Windows don't seem to cause a read even though I can see the image load during the callback. So either my isolation filter is not working properly or there there is a separate cache. And if there is a separate cache, is there a way to force a read to occur? That's why I wrote an isolation filter to begin with.