0

First off, forgive me - this is less a problem and more of a personal curiosity, but hopefully it will pique the curiosity of my fellow enthusiasts here!

As a geek, I do love to get into the processes that are running on my computer, in this case Windows 10 Professional.

I use the sublime 'Sysinternals Process Explorer' to keep an eye on things. If I look at an individual or specific process, and examine the Strings tab, to see which printable characters are in memory, I often see the following two strings, whether it's a Microsoft file or a 3rd party one, they seem to be ubiquitous! They appear many times in the same image, in both forms. For example, I found it at least 50 times in the memory snapshot of the 'MMGASERVER.EXE' process. (Also brownie points if you can tell me what this MMGA is or does!)

They are:

UAVAWH

and:

WATAUAVAWH

I see these strings all over the place, but I've thus far been unable to discover what they actually represent! Does anyone have an idea of what they might be?

I'm getting to the point where I might start trying to write some small sample applications that are compiled instead of interpreted to see if I can recreate this string and track it down! Before that though, I thought I'd ask you Legends here - hopefully someone can stop me going crazy!

Thank you!

Cryogen
  • 103
  • 2
  • 2
    Googling WATAUAVAWH returns [this](https://www.hexacorn.com/blog/2013/05/16/uvwatauavawh-meet-the-pushy-string/) – gronostaj Nov 16 '20 at 13:44
  • 1
    "Also brownie points if you can tell me what this MMGA is or does!" Make Microsoft Great Again? – spikey_richie Nov 16 '20 at 13:44
  • I have absolutely **no** idea whatsoever why I didn't find that in Google - none at all!! But THANK YOU <3 I'm glad I'm not the only one who found this string! – Cryogen Nov 16 '20 at 15:14
  • Bit more digging, still not absolutely certain but it looks like MMGaServer has something to do either with exchange or email; I've saved a selection of exported function names over here -> https://pastebin.com/NhdKVKSR – Cryogen Nov 16 '20 at 15:22

1 Answers1

0

I guess it is Sysmon64.exe.
I found a lot of hits running the following command on Linux:

strings Sysmon64.exe | grep UAVAWH