Changes to the ASP.NET 4 Registry

When monitoring our production servers for unauthorized changes, I noticed that the next registry key changes regularly.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ASP.NET_4.0.30319\Names 

Can someone give me some idea of โ€‹โ€‹why this value keeps changing?

Regards, David

+1
source share
1 answer

Some quick debugs show that the values โ€‹โ€‹correspond to the active process identifiers associated with asp.net (w3wp.exe and aspnet_state.exe). I do not know what a base64 encoded key is, but a change in the value can be explained by a change in the processor identifiers (processing, rebooting, etc.).

+1
source

Source: https://habr.com/ru/post/1410922/


All Articles