in the case of Io coming through teh srv, like real SMB share IO requests,
or perhaps the localhost being redirected through smb (\\localhost\C$) the
create request to open a file comes to the minifilter as a kernel request
from SRV. Is there a way to find who the original requwestor was (assuming
it is a local use trying to use \\127.0.0.1\c$ or \\localhost\c$ to open
the c driver instead of a regular createFile?