mmgaserver.exe
MMGA Server file version info
Program on Windows 10 known copies with hashes
Is it the real mmgaserver.exe?
C:\Windows\system32\C:\Windows\SysWOW64\10 known copies
10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\mmgaserver.exe · signed by Microsoft Windows
b7a4ce221bbbee0228cca4fa240aeb1f7e369b516cfdb511a82ac3764dc85cbd10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\mmgaserver.exe · signed by Microsoft Windows
f12cafdf27f105d269f2bef2c67884baae0dd98945ad2805cca911979b3cddac10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\system32\mmgaserver.exe · signed by Microsoft Windows
352f2217ae1b5baabe77d8c9b74356cdbcd893799add6580b2960b19efb8800a10.0.19041.746 (WinBuild.160101.0800) · C:\Windows\SysWOW64\mmgaserver.exe · signed by Microsoft Windows
b8b344051418ab2aad0a8dd7bba11d3e2d8f3f046482b23f41840a316ad75ba510.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\mmgaserver.exe · signed by Microsoft Windows
9143d7977dbb84661ab4c5050cc69e7784bcdce26ffbc036b108c09a81318cb310.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\mmgaserver.exe · signed by Microsoft Windows
c4af20467472cd76f0d011a2ae9cecd265896d3a04935628298cab5937b41dae10.0.18362.145 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\mmgaserver.exe · signed by Microsoft Windows
51e3b57ff65d4c6c45fe0bb51c1bcb05aa7a249ddf927732076c015d8d17299710.0.18362.145 (WinBuild.160101.0800) · C:\WINDOWS\system32\mmgaserver.exe · signed by Microsoft Windows
68058c6e7c563a331e4d0e851c1d07c5ed4051b7ee6560391ff57cde2cb4ade810.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\mmgaserver.exe · signed by Microsoft Windows
4f0f1006bf048614f71803778e1eca54f737c10f61a6caf3732865eddc9c09a710.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\mmgaserver.exe · signed by Microsoft Windows
b8375160593c224f2cacdd8d3c97a5b320ac0a9ec6e75cfcb2d2fb76605f4a1fFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.