When I run Process Monitor, I see
ReadFile requests sent to
What exactly does this mean?
I also see
$MapAttributeValue, which looks unfamiliar as well.
Update: I researched this issue further (since I've noticed the same behavior on my own computer, and was worried that this is some kind of malware), and now I believe my original answer was in fact incorrect. Here's what I found now:
Based on this research, I strongly believe that this "file read" is some kind of Process Monitor artifact, and the real read happens in the paging file. I have no idea why ProcMon lists the path as C:\$Directory.
I don't think now that this C:\$Directory is a real NTFS metafile. I don't think now that this could be some illegitimate activity (virus or other malware).
$Directory and $MapAttributeValue are most probably code-names for system areas on the NTFS disk, and these references come from programs opening or creating files.
These names probably pertain to Metafiles, defined by wikipedia as :
$Directory is most probably the Master File Table (MFT) that is the directory for all files and folders, where are stored as metadata the file name, creation date, access permissions (by the use of access control lists) and size. Any program that opens or creates a file or folder accesses this area of the disk.
$MapAttributeValue is most probably the Attribute lists area, described as :