I use Sysinternals Procmon utility to monitor the registry access by some programs. Most log entries have the Path property starting from HKCU\…
or HKLM\…
, that corresponds to the registry hives HKEY_CURRENT_USER
and HKEY_LOCAL_MACHINE
that can be seen using Regedit. But some entries have the Path starting from \REGISTRY\A\…
:
Could you please explain what part of the registry it is? Can I see it using Regedit or some other utility? Can I access it programmatically?
I am running Windows 8.1 Enterprise x64.
UPDATE: I've contacted Procmon developers and they pointed me to the following MSDN resources covering this question:
registry\a\foobar\1
jumps tohkcu\software\blah\a
butregistry\a\foobar\2
jumps tohklm\software\microsoft\internet explorer
, then they do seem to be unrelated, but if the second one jumps tohkcu\software\blah\b
, then they seem to be related in some way; there’s some sort of mapping.