Ce site est optimisé pour être consulté depuis un navigateur moderne dans lequel JavaScript est activé.

Que fait the path '\REGISTRY\A\...' in Sysinternals Procmon log mean?

ayi

I use Sysinternals Procmon utility to monitor le registre access by some programs. Most log entries have the Path property starting from HKCU\… or HKLM\…, that corresponds to le registre hives HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE that can be seen using Regedit. But some entries have the Path starting from \REGISTRY\A\…:

Could you please explain what part of le registre it is? Can Je vois it using Regedit or some other utility? Puis-je access it programmatically?

I am running Windows 8.1 Enterprise x64.

MISE À JOUR : I've contacted Procmon developers and they pointed me to the following MSDN resources covering this question:

ayi

It is an application hive, which can be seen in volatility by no name!
Application hives are registry hives loaded by user-mode applications to store application-specific state data. An application calls the RegLoadAppKey function to load an application hive.

More info at https://msdn.microsoft.com/en-us/library/windows/hardware/jj673019%28v=vs.85%29.aspx