Should I block it?

No, this file is 100% safe to run.

Additional versions

6.2.9200.16384 (win8_rtm.120725-1247)	11.69%
6.2.9200.16384 (win8_rtm.120725-1247)	1.30%
6.1.7601.17514 (win7sp1_rtm.101119-1850)	27.27%
6.1.7601.17514 (win7sp1_rtm.101119-1850)	29.87%
6.1.7600.16385 (win7_rtm.090713-1255)	1.30%
6.0.6002.18005 (lh_sp2rtm.090410-1830)	7.79%
5.01.1111	6.49%
5.01.1110	12.99%
5.01.1108	1.30%

Relationships

mqsvc.exe (Message Queuing Service by Microsoft)

PE file structure

Show functions

Import table

advapi32.dll

TraceMessage, RegCloseKey, RegConnectRegistryW, GetLengthSid, IsValidSid, GetTraceEnableFlags, GetTraceEnableLevel, GetTraceLoggerHandle, RegisterTraceGuidsW, UnregisterTraceGuids, SetSecurityDescriptorDacl, AddAccessAllowedAce, InitializeAcl, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, GetTokenInformation, InitializeSecurityDescriptor, OpenProcessToken, RegDeleteKeyW, RegOpenKeyExW, RegQueryValueExW, RegSetValueExW, RegEnumValueW, AddAccessDeniedAce, LookupAccountNameW, MakeSelfRelativeSD, ReportEventW, RegisterEventSourceW, StartServiceCtrlDispatcherW, RegisterServiceCtrlHandlerW, SetServiceStatus, RegCreateKeyExW

comsvcs.dll

CoLeaveServiceDomain, CoEnterServiceDomain

kernel32.dll

DeleteCriticalSection, InitializeCriticalSection, ResetEvent, SetThreadPriority, LocalFree, GetCurrentProcess, InterlockedDecrement, InterlockedIncrement, LeaveCriticalSection, GetVersion, VirtualQuery, GetModuleHandleW, GetProcAddress, VirtualAlloc, VirtualProtect, ReleaseSemaphore, CreateSemaphoreW, GetSystemInfo, CreateThread, CreateEventW, HeapSetInformation, FormatMessageW, LocalAlloc, GetQueuedCompletionStatus, GetLocalTime, ExpandEnvironmentStringsW, UnhandledExceptionFilter, TerminateProcess, GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, QueryPerformanceCounter, GetModuleHandleA, SetUnhandledExceptionFilter, OutputDebugStringA, InterlockedCompareExchange, InterlockedExchange, WideCharToMultiByte, MultiByteToWideChar, SetEvent, WaitForSingleObject, ResumeThread, CreateIoCompletionPort, Sleep, PostQueuedCompletionStatus, GetComputerNameW, GetTickCount, GetLastError, EnterCriticalSection, CloseHandle, CancelIo, ExitProcess, SetThreadStackGuarantee

mqrt.dll

MQCloseCursor, MQCloseQueue, MQCreateCursor, MQReceiveMessageByLookupId, MQPathNameToFormatName, MQOpenQueue, MQCreateQueue, MQReceiveMessage

mqsec.dll

MQSec_GetLocalSystemSid

msvcrt.dll

DllMain

ntdll.dll

RtlAllocateHeap, RtlFreeHeap, RtlImageNtHeader

ole32.dll

CLSIDFromProgID, CoUninitialize, CoCreateInstance, CoInitializeEx, CLSIDFromString, CoGetObjectContext, CoInitializeSecurity, OleRun

user32.dll

CharUpperW, CharLowerW

MQTGSVC.exe

Message Queuing Trigger Service by Microsoft

Remove MQTGSVC.exe

Version:	6.2.9200.16384 (win8_rtm.120725-1247)
MD5:	81c675a68ea7c1707d40e01dd2a0dd54
SHA1:	4171e4d11c693579ff1d48df9d965cfd0d94d0d5
SHA256:	3e3dcb2519104dd4d119df47e3053d4a5e6d7c66121bca91c70004fa967afdd0

This is a Windows system installed file with Windows File Protection (WFP) enabled.

What is MQTGSVC.exe?

Microsoft Message Queuing or MSMQ is a Message Queue implementation. MSMQ is essentially a messaging protocol that allows applications running on separate servers/processes to communicate in a failsafe manner. A queue is a temporary storage location from which messages can be sent and received reliably, as and when conditions permit.

Overview

mqtgsvc.exe runs as a service under the name Message Queuing-Trigger (MSMQTriggers) with minimal NETWORK SERVICE privileges on the local PC and acts as the computer on the network. The assembly utilizes the .NET run-time framework (which is required to be installed on the PC). This version is installed on Windows 8 and is compiled as a 32 bit program.

Details

File name:	mqtgsvc.exe
Publisher:	Microsoft Corporation
Product name:	Message Queuing Trigger Service
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\Windows\System32\mqtgsvc.exe
File version:	6.2.9200.16384 (win8_rtm.120725-1247)
Product version:	6.2.9200.16384
Size:	126 KB (129,024 bytes)
Digital DNA
File packed:	No
Code language:	Microsoft Visual C# / Basic .NET
.NET CLR:	Yes
.NET NGENed:	No

More details

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'MSMQTriggers' (Message Queuing-Trigger)
MSMQTriggers

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00004521%	0.028634%
Kernel CPU:	0.00003190%	0.013761%
User CPU:	0.00001331%	0.014873%
Kernel CPU time:	187 ms/min	100,923,805ms/min
Memory
Private memory:	2.12 MB	21.59 MB
Private (maximum):	5.45 MB
Private (minimum):	572 KB
Non-paged memory:	2.12 MB	21.59 MB
Virtual memory:	47.7 MB	140.96 MB
Virtual memory (peak):	50.7 MB	169.69 MB
Working set:	708 KB	18.61 MB
Working set (peak):	5.45 MB	37.95 MB
Resource allocations
Threads:	10	12
Handles:	302	600

Process properties

Integrety level:	System
Platform:	32-bit
Command line:	C:\Windows\System32\mqtgsvc.exe
Owner:	NETWORK SERVICE
Windows Service
Service name:	MSMQTriggers
Display name:	Message Queuing-Trigger
Description:	“Bietet eine Regel-basierte Überwachung von Nachrichten an, die in einer Message Queuing-Warteschlange empfangen werden, und, falls die Bedingungen einer Regel erfüllt werden, eine COM-Komponente oder ein eigenständiges ausführbares Programm aufrufen, um die Nachricht zu verarbeiten.”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads