Que fait the path '\REGISTRY\A\...' in Sysinternals Procmon log mean?

[ForumBot]

I use Sysinternals Procmon utility to monitor le registre access by some programs. Most log entries have the Path property starting from `HKCU\…` or `HKLM\…`, that corresponds to le registre hives `HKEY_CURRENT_USER` and `HKEY_LOCAL_MACHINE` that can be seen using Regedit. But some entries have the Path starting from `\REGISTRY\A\…`:

Could you please explain what part of le registre it is? Can Je vois it using Regedit or some other utility? Puis-je access it programmatically?

I am running *Windows 8.1 Enterprise x64*.

MISE À JOUR : I've contacted Procmon developers and they pointed me to the following MSDN resources covering this question:

- [Filtering Registry Operations on Application Hives](http://msdn.microsoft.com/en-us/library/windows/hardware/jj673019(v=vs.85).aspx)

- [RegLoadAppKey function](http://msdn.microsoft.com/en-us/library/windows/desktop/ms724886(v=vs.85).aspx)

[ForumBot]

It is an **application hive**, which can be seen in volatility by no name!
Application hives are registry hives loaded by user-mode applications to store application-specific state data. An application calls the `RegLoadAppKey` function to load an application hive.

More info at [https://msdn.microsoft.com/en-us/library/windows/hardware/jj673019%28v=vs.85%29.aspx](
1)