What is C:\$Directory?

Question

When I run Process Monitor, I see ReadFile requests sent to C:\$Directory.

What exactly does this mean?

---

Update:

I also see $MapAttributeValue, which looks unfamiliar as well.

Answer 1

Update: I researched this issue further (since I've noticed the same behavior on my own computer, and was worried that this is some kind of malware), and now I believe my original answer was in fact incorrect. Here's what I found now:

1. Several different procesess read from this file, and from different offsets, but with the same length: 4K (exactly one memory page).
2. There are ReadFile operations, but no opening of the file, which makes little sense.
3. Looking at the stack trace, I see that all requests include a page fault in the trace, e.g. this file read is inside IoPageRead(), kernel function that reads pages from the paging file into memory.
4. These reads happen on C:\$Directory and V:\$Directory on my system, the two drives that hold paging files on them, and nowhere else.

Based on this research, I strongly believe that this "file read" is some kind of Process Monitor artifact, and the real read happens in the paging file. I have no idea why ProcMon lists the path as C:\$Directory.

I don't think now that this C:\$Directory is a real NTFS metafile. I don't think now that this could be some illegitimate activity (virus or other malware).