Should I block it?

No, this file is 100% safe to run.

Additional versions

6.3.9600.16384 (winblue_rtm.130821-1623)	3.96%
6.2.9200.16384 (win8_rtm.120725-1247)	16.74%
6.2.9200.16384 (win8_rtm.120725-1247)	1.32%
6.2.8400.0 (winmain_win8rc.120518-1423)	0.44%
6.1.7600.16385 (win7_rtm.090713-1255)	29.96%
6.1.7600.16385 (win7_rtm.090713-1255)	28.63%
6.0.6000.16386 (vista_rtm.061101-2205)	4.85%
5.01.1111	3.96%
5.01.1110	9.69%
5.01.1108	0.44%

Relationships

mqtgsvc.exe (Message Queuing Trigger Service by Microsoft)

PE file structure

Show functions

Import table

advapi32.dll

TraceMessage

kernel32.dll

UnhandledExceptionFilter, GetCurrentProcess, GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, GetTickCount, QueryPerformanceCounter, SetUnhandledExceptionFilter, InterlockedCompareExchange, Sleep, InterlockedExchange, TerminateProcess, GetModuleHandleA

msvcrt.dll

DllMain

ntdll.dll

RtlAllocateHeap, RtlImageNtHeader, RtlFreeHeap

MQSVC.exe

Message Queuing Service by Microsoft

Remove MQSVC.exe

Version:	5.01.1111
MD5:	e9b5f354ae80325283fd5c1c05217b01
SHA1:	e4a12f830b8dfd7b5dc90453a59f429435fedbd7
SHA256:	387e01d40ce3a32ccabfb8f34057b2b5159f3c2bdfb97f43ea85eec337fa3dc1

This is a Windows system installed file with Windows File Protection (WFP) enabled.

What is MQSVC.exe?

Microsoft Message Queuing or MSMQ is a Message Queue implementation. MSMQ is essentially a messaging protocol that allows applications running on separate servers/processes to communicate in a failsafe manner. A queue is a temporary storage location from which messages can be sent and received reliably, as and when conditions permit.

Overview

mqsvc.exe runs as a service under the name Accodamento messaggi (MSMQ) with extensive SYSTEM privileges (full administrator access). The assembly utilizes the .NET run-time framework (which is required to be installed on the PC).

Details

File name:	mqsvc.exe
Publisher:	Microsoft Corporation
Product name:	Message Queuing Service
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\Windows\System32\mqsvc.exe
File version:	5.01.1111
Size:	4.5 KB (4,608 bytes)
Digital DNA
File packed:	No
Code language:	Microsoft Visual C# / Basic .NET
.NET CLR:	Yes
.NET NGENed:	No

More details

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'MSMQ' (Accodamento messaggi)
MSMQ

Network connections

[UDP] listens on port 3527

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00078328%	0.028634%
Kernel CPU:	0.00041651%	0.013761%
User CPU:	0.00036676%	0.014873%
Kernel CPU time:	266,844 ms/min	100,923,805ms/min
Context switches:	10/sec	284/sec
Memory
Private memory:	3.11 MB	21.59 MB
Private (maximum):	7.74 MB
Private (minimum):	3.3 MB
Non-paged memory:	3.11 MB	21.59 MB
Virtual memory:	43.58 MB	140.96 MB
Virtual memory (peak):	45.33 MB	169.69 MB
Working set:	3.45 MB	18.61 MB
Working set (peak):	7.8 MB	37.95 MB
Page faults:	52,760/min	2,039/min
I/O
I/O read transfer:	416 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O write transfer:	2 Bytes/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	60 Bytes/sec	448.09 KB/min
I/O other operations:	5/sec	1,671/min
Resource allocations
Threads:	25	12
Handles:	225	600
GUI GDI count:	7	103
GUI USER count:	4	49

Process properties

Integrety level:	Undefined
Platform:	32-bit
Command line:	C:\Windows\System32\mqsvc.exe
Owner:	SYSTEM
Windows Service
Service name:	MSMQ
Display name:	Accodamento messaggi
Description:	“Fornisce una infrastruttura di messaggistica e uno strumento di sviluppo per la creazione di applicazioni di messaggistica distribuita per reti e programmi Windows. Se il servizio viene arrestato, i messaggi distribuiti non saranno disponibili. Se il servizio viene disabilitato, i servizi da esso esplicitamente dipendenti non verranno avviati.”
Type:	Win32OwnProcess
Parent process:	services.exe (by Microsoft)

Threads