Should I block it?

No, this file is 100% safe to run.

Additional versions

6.3.9600.16384 (winblue_rtm.130821-1623)	3.96%
6.2.9200.16384 (win8_rtm.120725-1247)	16.74%
6.2.9200.16384 (win8_rtm.120725-1247)	1.32%
6.2.8400.0 (winmain_win8rc.120518-1423)	0.44%
6.1.7600.16385 (win7_rtm.090713-1255)	29.96%
6.1.7600.16385 (win7_rtm.090713-1255)	28.63%
6.0.6000.16386 (vista_rtm.061101-2205)	4.85%
5.01.1111	3.96%
5.01.1110	9.69%
5.01.1108	0.44%

Relationships

mqtgsvc.exe (Message Queuing Trigger Service by Microsoft)

PE file structure

Show functions

Import table

advapi32.dll

TraceMessage

kernel32.dll

UnhandledExceptionFilter, GetCurrentProcess, GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, GetTickCount, QueryPerformanceCounter, SetUnhandledExceptionFilter, InterlockedCompareExchange, Sleep, InterlockedExchange, TerminateProcess, GetModuleHandleA

msvcrt.dll

DllMain

ntdll.dll

RtlAllocateHeap, RtlImageNtHeader, RtlFreeHeap

MQSVC.exe

Message Queuing Service by Microsoft

Remove MQSVC.exe

Version:	5.01.1108
MD5:	72ef444e51025f389c6c232a28b7d736
SHA1:	7036c1d2f417d01ad8e689c214658ca2319819c0
SHA256:	a1d352a9e5f77085a15fe0097a5f89dbb3bf18dc3b1e037979175721e1d7dba1

This is a Windows system installed file with Windows File Protection (WFP) enabled.

What is MQSVC.exe?

Microsoft Message Queuing or MSMQ is a Message Queue implementation. MSMQ is essentially a messaging protocol that allows applications running on separate servers/processes to communicate in a failsafe manner. A queue is a temporary storage location from which messages can be sent and received reliably, as and when conditions permit.

Overview

mqsvc.exe runs as a service under the name Accodamento messaggi (MSMQ) with extensive SYSTEM privileges (full administrator access). The assembly utilizes the .NET run-time framework (which is required to be installed on the PC).

Details

File name:	mqsvc.exe
Publisher:	Microsoft Corporation
Product name:	Message Queuing Service
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\Windows\System32\mqsvc.exe
File version:	5.01.1108
Size:	4.5 KB (4,608 bytes)
Digital DNA
File packed:	No
Code language:	Microsoft Visual C# / Basic .NET
.NET CLR:	Yes
.NET NGENed:	No

More details

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'MSMQ' (Accodamento messaggi)
MSMQ

Network connections

[UDP] listens on port 3527

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00907900%	0.028634%
Kernel CPU:	0.00740175%	0.013761%
User CPU:	0.00167724%	0.014873%
Kernel CPU time:	250 ms/min	100,923,805ms/min
Context switches:	12/sec	284/sec
Memory
Private memory:	1.99 MB	21.59 MB
Private (maximum):	5.66 MB
Private (minimum):	5.66 MB
Non-paged memory:	1.99 MB	21.59 MB
Virtual memory:	40.67 MB	140.96 MB
Virtual memory (peak):	42.42 MB	169.69 MB
Working set:	5.66 MB	18.61 MB
Working set (peak):	5.7 MB	37.95 MB
Resource allocations
Threads:	25	12
Handles:	205	600
GUI GDI count:	8	103
GUI USER count:	4	49

Process properties

Integrety level:	Undefined
Platform:	32-bit
Command line:	C:\Windows\System32\mqsvc.exe
Owner:	SYSTEM
Windows Service
Service name:	MSMQ
Display name:	Accodamento messaggi
Description:	“Fornisce una infrastruttura di messaggistica e uno strumento di sviluppo per la creazione di applicazioni di messaggistica distribuita per reti e programmi Windows. Se il servizio viene arrestato, i messaggi distribuiti non saranno disponibili. Se il servizio viene disabilitato, i servizi da esso esplicitamente dipendenti non verranno avviati.”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads