That's indeed the case: The UUID of the attachment is used as the path inside "StorageDirectory".
To reduce the number of files in a single directory (which is something that can some OS do not like), a 3-level hierarchy of directories is created: The first two hexadecimal characters of the UUID give the first level path, the two next characters give the second level path.
However, pay attention to the fact that this is only true when using no database plugin for Orthanc (the PostgreSQL plugin can be configured to store the attachements inside a database). Furthermore, Orthanc can be configured to compress the attachments before writing them on the disk (cf. the "StorageCompression" option). Finally, by reading "StorageDirectory", you bypass all the locking mechanisms used by Orthanc.
As a consequence, it is HIGHLY recommended NOT to directly access "StorageDirectory" and the SQLite database. Use the REST API instead.
HTH,
Sébastien-