Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I use Sysinternals Procmon utility to monitor the registry access by some programs. Most log entries have the Path property starting from HKCU\… or HKLM\…, that corresponds to the registry hives HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE that can be seen using Regedit. But some entries have the Path starting from \REGISTRY\A\…:

enter image description here

Could you please explain what part of the registry it is? Can I see it using Regedit or some other utility? Can I access it programmatically?

I am running Windows 8.1 Enterprise x64.

UPDATE: I've contacted Procmon developers and they pointed me to the following MSDN resources covering this question:

share|improve this question

migrated from Dec 17 '13 at 20:51

This question came from our site for professional and enthusiast programmers.

A related question:… – Vladimir Reshetnikov Dec 19 '13 at 17:24
Did you try right-clicking one and selecting Jump To? – Synetech Dec 22 '13 at 4:18
Yes, but it jumps to an unrelated key. – Vladimir Reshetnikov Dec 22 '13 at 22:47
Are you sure it’s unrelated? Did you try using jump-to to a similar key to see if it jumps to a similar key or to a completely different key? For example, if registry\a\foobar\1 jumps to hkcu\software\blah\a but registry\a\foobar\2 jumps to hklm\software\microsoft\internet explorer, then they do seem to be unrelated, but if the second one jumps to hkcu\software\blah\b, then they seem to be related in some way; there’s some sort of mapping. – Synetech Dec 22 '13 at 23:16
Hmm, I think I know how you can find out exactly what it is, but it’ll have to wait until tomorrow morning (my time) when I can test it… – Synetech Dec 22 '13 at 23:31
up vote 6 down vote accepted

\REGISTRY\A is a hidden registry hive for use by Windows Store apps (aka Metro-style apps).

share|improve this answer
A few issues: • This question has the registry hive in question but is on Windows 7, so it doesn’t look like it is connected Windows apps. • Even if you are correct, what and how exactly do Windows apps use it; that is, what does it provide that the regular registry does not? • The Wikipedia page you linked to does not mention the registry at all, so we have no way to confirm what you said or learn about it. – Synetech Dec 26 '13 at 22:15

What does the path '\REGISTRY\A\…' in Sysinternals Procmon log mean? Could you please explain what part of the registry it is? Can I see it using Regedit or some other utility? Can I access it programmatically?

I can’t reproduce what you are seeing on my system, but I can tell you how you can find out what it is on yours. You can see a list of all registry hives that are currently mounted under any name (including system-wide hives, user hives for users that are currently logged on, and any hives loaded manually or by software) at the following registry key. It will show both the internal registry path and the path to the hive file (figure 1).


You can use this command to see which services are being hosted by the specific instance of svchost.exe. I’ve used the pid (1240) that it was using at the time of your screenshot; replace it with the current PID.

tasklist /svc /fi "pid eq 1240"

Figure 1: Screenshot of registry-editor with hivelist key highlighted, showing mounted registry hives

Screenshot of registry-editor with hivelist key highlighted

share|improve this answer

It is application hive, which can be seen in volatilty by no name! pplication hives are registry hives loaded by user-mode applications to store application-specific state data. An application calls the RegLoadAppKey function to load an application hive.

more info on

share|improve this answer

My guess is that this is a loaded registry hive.
Since a registry hive is just a file, one can load any hive under any given name, such as A.

For more info see :
Registry Hives
Load or Unload Registry Hives

From your trace, it seems like this was done by a system service (svchost).
To identify which service it is, see this article :
7 Ways to Easily Identify SVCHOST.EXE Service Name.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .