IRP_MJ_CREATE

whenever there are certain actions say folder opening, file creation, etc there are a bunch of IRP_MJ_CREATE requests raised by various exe’s. I have found the process which generates it using the process id. Let us say some 20 IRO_MJ_CREATE requests have been raised for creating a new file, Now is there something common in those 20 IRP requests generated stating that it was meant for file creation.

Please stop asking the same question. yes lots and lots of things open files. Embrace it, understand it, spend a week looking at procmon output.

Read this page and search for disposition