CmdID

CmdID / Files

alg.exe

Application Layer Gateway Service file version info

Program on Windows 7 known copies with hashes

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real alg.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionApplication Layer Gateway Service

7 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\alg.exe · signed by Microsoft Windows

8b5a0afdcb44819e8ec84f84ac63ba7d97ed7cad9c8a2ee14dc771c77b53e1ea

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\alg.exe · signed by Microsoft Windows

6abe94df833ec0e6d145429bba99fdca9ad3fcbb685a432b20c04f74de9a42a5

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\alg.exe · signed by Microsoft Windows

ac42e63ab0df0d5329506900d4cbe188bb3a24aebee368f9ff413a2c464ad656

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\alg.exe · signed by Microsoft Windows

896d685ef63b0041558a51096506fd915a99b3fe2d524e6834c1f996383134db

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\alg.exe · signed by Microsoft Windows

0eefd2619d77d7bafed95197e0c0ef30147acaddcd81eb2761ee9893fd55f91b

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\alg.exe · signed by Microsoft Windows

fe52f3dc280d208fddc75f6e3294b8d601e0d86f9bd3db1acc8fc296ac74c23b

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\alg.exe · not signed

dd0f60e96fac68fbd5b86382e541408c613bd0f871d0e0a1ef9ab6e7b26e545c

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.