Should I block it?

No, this file is 100% safe to run.

Additional versions

6.2.9200.16384 (win8_rtm.120725-1247)	11.69%
6.2.9200.16384 (win8_rtm.120725-1247)	1.30%
6.1.7601.17514 (win7sp1_rtm.101119-1850)	27.27%
6.1.7601.17514 (win7sp1_rtm.101119-1850)	29.87%
6.1.7600.16385 (win7_rtm.090713-1255)	1.30%
6.0.6002.18005 (lh_sp2rtm.090410-1830)	7.79%
5.01.1111	6.49%
5.01.1110	12.99%
5.01.1108	1.30%

Relationships

mqsvc.exe (Message Queuing Service by Microsoft)

PE file structure

Show functions

Import table

advapi32.dll

TraceMessage, RegCloseKey, RegConnectRegistryW, GetLengthSid, IsValidSid, GetTraceEnableFlags, GetTraceEnableLevel, GetTraceLoggerHandle, RegisterTraceGuidsW, UnregisterTraceGuids, SetSecurityDescriptorDacl, AddAccessAllowedAce, InitializeAcl, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, GetTokenInformation, InitializeSecurityDescriptor, OpenProcessToken, RegDeleteKeyW, RegOpenKeyExW, RegQueryValueExW, RegSetValueExW, RegEnumValueW, AddAccessDeniedAce, LookupAccountNameW, MakeSelfRelativeSD, ReportEventW, RegisterEventSourceW, StartServiceCtrlDispatcherW, RegisterServiceCtrlHandlerW, SetServiceStatus, RegCreateKeyExW

comsvcs.dll

CoLeaveServiceDomain, CoEnterServiceDomain

kernel32.dll

DeleteCriticalSection, InitializeCriticalSection, ResetEvent, SetThreadPriority, LocalFree, GetCurrentProcess, InterlockedDecrement, InterlockedIncrement, LeaveCriticalSection, GetVersion, VirtualQuery, GetModuleHandleW, GetProcAddress, VirtualAlloc, VirtualProtect, ReleaseSemaphore, CreateSemaphoreW, GetSystemInfo, CreateThread, CreateEventW, HeapSetInformation, FormatMessageW, LocalAlloc, GetQueuedCompletionStatus, GetLocalTime, ExpandEnvironmentStringsW, UnhandledExceptionFilter, TerminateProcess, GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, QueryPerformanceCounter, GetModuleHandleA, SetUnhandledExceptionFilter, OutputDebugStringA, InterlockedCompareExchange, InterlockedExchange, WideCharToMultiByte, MultiByteToWideChar, SetEvent, WaitForSingleObject, ResumeThread, CreateIoCompletionPort, Sleep, PostQueuedCompletionStatus, GetComputerNameW, GetTickCount, GetLastError, EnterCriticalSection, CloseHandle, CancelIo, ExitProcess, SetThreadStackGuarantee

mqrt.dll

MQCloseCursor, MQCloseQueue, MQCreateCursor, MQReceiveMessageByLookupId, MQPathNameToFormatName, MQOpenQueue, MQCreateQueue, MQReceiveMessage

mqsec.dll

MQSec_GetLocalSystemSid

msvcrt.dll

DllMain

ntdll.dll

RtlAllocateHeap, RtlFreeHeap, RtlImageNtHeader

ole32.dll

CLSIDFromProgID, CoUninitialize, CoCreateInstance, CoInitializeEx, CLSIDFromString, CoGetObjectContext, CoInitializeSecurity, OleRun

user32.dll

CharUpperW, CharLowerW

MQTGSVC.exe

Message Queuing Trigger Service by Microsoft

Remove MQTGSVC.exe

Version:	6.2.9200.16384 (win8_rtm.120725-1247)
MD5:	0defc7d48ea9a433ef92e36fa63b1ef6
SHA1:	ab709c504410caf825f536a69259571cafd41434
SHA256:	cab8eef937f93d5ad97a0fc359de5bf9848deff72e7d0aaca3471ba7de5ebdea

This is a Windows system installed file with Windows File Protection (WFP) enabled.

What is MQTGSVC.exe?

Microsoft Message Queuing or MSMQ is a Message Queue implementation. MSMQ is essentially a messaging protocol that allows applications running on separate servers/processes to communicate in a failsafe manner. A queue is a temporary storage location from which messages can be sent and received reliably, as and when conditions permit.

Overview

mqtgsvc.exe runs as a service under the name Message Queuing-Trigger (MSMQTriggers) with minimal NETWORK SERVICE privileges on the local PC and acts as the computer on the network. The assembly utilizes the .NET run-time framework (which is required to be installed on the PC). This version is installed on Windows 8 and is compiled as a 64 bit program.

Details

File name:	mqtgsvc.exe
Publisher:	Microsoft Corporation
Product name:	Message Queuing Trigger Service
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\Windows\System32\mqtgsvc.exe
File version:	6.2.9200.16384 (win8_rtm.120725-1247)
Product version:	6.2.9200.16384
Size:	165 KB (168,960 bytes)
Digital DNA
File packed:	No
Code language:	Microsoft Visual C# / Basic .NET
.NET CLR:	Yes
.NET NGENed:	No

More details

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'MSMQTriggers' (Message Queuing-Trigger)
MSMQTriggers

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00002755%	0.028634%
Kernel CPU:	0.00002115%	0.013761%
User CPU:	0.00000640%	0.014873%
Kernel CPU time:	78,008 ms/min	100,923,805ms/min
CPU cycles:	5,628/sec	17,470,203/sec
Memory
Private memory:	1.98 MB	21.59 MB
Private (maximum):	4.28 MB
Private (minimum):	2.95 MB
Non-paged memory:	1.98 MB	21.59 MB
Virtual memory:	37.79 MB	140.96 MB
Virtual memory (peak):	38.32 MB	169.69 MB
Working set:	3.09 MB	18.61 MB
Working set (peak):	5.22 MB	37.95 MB
Page faults:	1,517/min	2,039/min
I/O
I/O other transfer:	0 Bytes/sec	448.09 KB/min
I/O other operations:	1/sec	1,671/min
Resource allocations
Threads:	10	12
Handles:	176	600

Process properties

Integrety level:	System
Platform:	64-bit
Command line:	C:\Windows\System32\mqtgsvc.exe
Owner:	NETWORK SERVICE
Windows Service
Service name:	MSMQTriggers
Display name:	Message Queuing-Trigger
Description:	“Bietet eine Regel-basierte Überwachung von Nachrichten an, die in einer Message Queuing-Warteschlange empfangen werden, und, falls die Bedingungen einer Regel erfüllt werden, eine COM-Komponente oder ein eigenständiges ausführbares Programm aufrufen, um die Nachricht zu verarbeiten.”
Type:	Win32OwnProcess
Parent process:	services.exe (by Microsoft)

Threads