When I run Process Monitor, I see
ReadFile requests sent to
What exactly does this mean?
I also see
$MapAttributeValue, which looks unfamiliar as well.
Update: I researched this issue further (since I've noticed the same behavior on my own computer, and was worried that this is some kind of malware), and now I believe my original answer was in fact incorrect. Here's what I found now:
Based on this research, I strongly believe that this "file read" is some kind of Process Monitor artifact, and the real read happens in the paging file. I have no idea why ProcMon lists the path as C:\$Directory.
I don't think now that this C:\$Directory is a real NTFS metafile. I don't think now that this could be some illegitimate activity (virus or other malware).