alg.exe
Summary
Windows' Application Layer Gateway service.
alg.exe is the 3679th most commonly executed Windows program in EchoTrail's dataset, observed 47 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by services.exe.
3679th
most commonly executed Windows program
47
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Windows\System32100%
Top Hashes (SHA256)
- dd0f60e96fac68fbd5b86382e541408c613bd0f871d0e0a1ef9ab6e7b26e545c39.13%
- 6425fa16f0cbf5f3008780095364830ebf1f073bd5109764fe9e88245afb936732.61%
- 0eefd2619d77d7bafed95197e0c0ef30147acaddcd81eb2761ee9893fd55f91b15.22%
- 896d685ef63b0041558a51096506fd915a99b3fe2d524e6834c1f996383134db4.35%
- a1c648efe12a5a3356bc0949372add0ff0ca2f5a8f992eb71c87e9c0d5c92bb24.35%
- 6abe94df833ec0e6d145429bba99fdca9ad3fcbb685a432b20c04f74de9a42a52.17%
- ea7486b4425a87fddd60542aaf0812a8db868f569886b894883702b362a05d2c2.17%
Process Ancestry
Top Grandparents
- wininit.exe100%
Top Parents
- services.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about alg.exe
Rocky answers questions about alg.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.