Should I block it?

No, this file is 100% safe to run.

Additional versions

6.2.9200.16384 (win8_rtm.120725-1247)	11.69%
6.2.9200.16384 (win8_rtm.120725-1247)	1.30%
6.1.7601.17514 (win7sp1_rtm.101119-1850)	27.27%
6.1.7601.17514 (win7sp1_rtm.101119-1850)	29.87%
6.1.7600.16385 (win7_rtm.090713-1255)	1.30%
6.0.6002.18005 (lh_sp2rtm.090410-1830)	7.79%
5.01.1111	6.49%
5.01.1110	12.99%
5.01.1108	1.30%

Relationships

mqsvc.exe (Message Queuing Service by Microsoft)

PE file structure

Show functions

Import table

advapi32.dll

TraceMessage, RegCloseKey, RegConnectRegistryW, GetLengthSid, IsValidSid, GetTraceEnableFlags, GetTraceEnableLevel, GetTraceLoggerHandle, RegisterTraceGuidsW, UnregisterTraceGuids, SetSecurityDescriptorDacl, AddAccessAllowedAce, InitializeAcl, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, GetTokenInformation, InitializeSecurityDescriptor, OpenProcessToken, RegDeleteKeyW, RegOpenKeyExW, RegQueryValueExW, RegSetValueExW, RegEnumValueW, AddAccessDeniedAce, LookupAccountNameW, MakeSelfRelativeSD, ReportEventW, RegisterEventSourceW, StartServiceCtrlDispatcherW, RegisterServiceCtrlHandlerW, SetServiceStatus, RegCreateKeyExW

comsvcs.dll

CoLeaveServiceDomain, CoEnterServiceDomain

kernel32.dll

DeleteCriticalSection, InitializeCriticalSection, ResetEvent, SetThreadPriority, LocalFree, GetCurrentProcess, InterlockedDecrement, InterlockedIncrement, LeaveCriticalSection, GetVersion, VirtualQuery, GetModuleHandleW, GetProcAddress, VirtualAlloc, VirtualProtect, ReleaseSemaphore, CreateSemaphoreW, GetSystemInfo, CreateThread, CreateEventW, HeapSetInformation, FormatMessageW, LocalAlloc, GetQueuedCompletionStatus, GetLocalTime, ExpandEnvironmentStringsW, UnhandledExceptionFilter, TerminateProcess, GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, QueryPerformanceCounter, GetModuleHandleA, SetUnhandledExceptionFilter, OutputDebugStringA, InterlockedCompareExchange, InterlockedExchange, WideCharToMultiByte, MultiByteToWideChar, SetEvent, WaitForSingleObject, ResumeThread, CreateIoCompletionPort, Sleep, PostQueuedCompletionStatus, GetComputerNameW, GetTickCount, GetLastError, EnterCriticalSection, CloseHandle, CancelIo, ExitProcess, SetThreadStackGuarantee

mqrt.dll

MQCloseCursor, MQCloseQueue, MQCreateCursor, MQReceiveMessageByLookupId, MQPathNameToFormatName, MQOpenQueue, MQCreateQueue, MQReceiveMessage

mqsec.dll

MQSec_GetLocalSystemSid

msvcrt.dll

DllMain

ntdll.dll

RtlAllocateHeap, RtlFreeHeap, RtlImageNtHeader

ole32.dll

CLSIDFromProgID, CoUninitialize, CoCreateInstance, CoInitializeEx, CLSIDFromString, CoGetObjectContext, CoInitializeSecurity, OleRun

user32.dll

CharUpperW, CharLowerW

MQTGSVC.exe

Message Queuing Trigger Service by Microsoft

Remove MQTGSVC.exe

Version:	5.01.1108
MD5:	96c102d0b66d7a6aa3ef9b07df7ee025
SHA1:	80056304dfb773147ecfb61504f579b247021134
SHA256:	e25aff5eb279554dff172536a9b7db746a2ffcb00c3c4e1497ae806322dc276b

This is a Windows system installed file with Windows File Protection (WFP) enabled.

What is MQTGSVC.exe?

Microsoft Message Queuing or MSMQ is a Message Queue implementation. MSMQ is essentially a messaging protocol that allows applications running on separate servers/processes to communicate in a failsafe manner. A queue is a temporary storage location from which messages can be sent and received reliably, as and when conditions permit.

Overview

mqtgsvc.exe runs as a service under the name Message Queuing-Trigger (MSMQTriggers) with extensive SYSTEM privileges (full administrator access). The assembly utilizes the .NET run-time framework (which is required to be installed on the PC).

Details

File name:	mqtgsvc.exe
Publisher:	Microsoft Corporation
Product name:	Message Queuing Trigger Service
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\Windows\System32\mqtgsvc.exe
File version:	5.01.1108
Size:	114.5 KB (117,248 bytes)
Digital DNA
File packed:	No
Code language:	Microsoft Visual C# / Basic .NET
.NET CLR:	Yes
.NET NGENed:	No

More details

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'MSMQTriggers' (Message Queuing-Trigger)
MSMQTriggers

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00283489%	0.028634%
Kernel CPU:	0.00169357%	0.013761%
User CPU:	0.00114132%	0.014873%
Kernel CPU time:	63 ms/min	100,923,805ms/min
Memory
Private memory:	1.3 MB	21.59 MB
Private (maximum):	3.64 MB
Private (minimum):	3.64 MB
Non-paged memory:	1.3 MB	21.59 MB
Virtual memory:	33.64 MB	140.96 MB
Virtual memory (peak):	35.88 MB	169.69 MB
Working set:	3.64 MB	18.61 MB
Working set (peak):	3.64 MB	37.95 MB
Resource allocations
Threads:	9	12
Handles:	121	600
GUI GDI count:	5	103
GUI USER count:	1	49

Process properties

Integrety level:	Undefined
Platform:	32-bit
Command line:	C:\Windows\System32\mqtgsvc.exe
Owner:	SYSTEM
Windows Service
Service name:	MSMQTriggers
Display name:	Message Queuing-Trigger
Description:	“Bietet eine Regel-basierte Überwachung von Nachrichten an, die in einer Message Queuing-Warteschlange empfangen werden, und, falls die Bedingungen einer Regel erfüllt werden, eine COM-Komponente oder ein eigenständiges ausführbares Programm aufrufen, um die Nachricht zu verarbeiten.”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads