Should I block it?

No, this file is 100% safe to run.

Additional versions

6.2.9200.16384 (win8_rtm.120725-1247)	11.69%
6.2.9200.16384 (win8_rtm.120725-1247)	1.30%
6.1.7601.17514 (win7sp1_rtm.101119-1850)	27.27%
6.1.7601.17514 (win7sp1_rtm.101119-1850)	29.87%
6.1.7600.16385 (win7_rtm.090713-1255)	1.30%
6.0.6002.18005 (lh_sp2rtm.090410-1830)	7.79%
5.01.1111	6.49%
5.01.1110	12.99%
5.01.1108	1.30%

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Related files

mqsvc.exe (Message Queuing Service by Microsoft)

PE file structure

Show functions

Import table

advapi32.dll

TraceMessage, RegCloseKey, RegConnectRegistryW, GetLengthSid, IsValidSid, GetTraceEnableFlags, GetTraceEnableLevel, GetTraceLoggerHandle, RegisterTraceGuidsW, UnregisterTraceGuids, SetSecurityDescriptorDacl, AddAccessAllowedAce, InitializeAcl, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, GetTokenInformation, InitializeSecurityDescriptor, OpenProcessToken, RegDeleteKeyW, RegOpenKeyExW, RegQueryValueExW, RegSetValueExW, RegEnumValueW, AddAccessDeniedAce, LookupAccountNameW, MakeSelfRelativeSD, ReportEventW, RegisterEventSourceW, StartServiceCtrlDispatcherW, RegisterServiceCtrlHandlerW, SetServiceStatus, RegCreateKeyExW

comsvcs.dll

CoLeaveServiceDomain, CoEnterServiceDomain

kernel32.dll

DeleteCriticalSection, InitializeCriticalSection, ResetEvent, SetThreadPriority, LocalFree, GetCurrentProcess, InterlockedDecrement, InterlockedIncrement, LeaveCriticalSection, GetVersion, VirtualQuery, GetModuleHandleW, GetProcAddress, VirtualAlloc, VirtualProtect, ReleaseSemaphore, CreateSemaphoreW, GetSystemInfo, CreateThread, CreateEventW, HeapSetInformation, FormatMessageW, LocalAlloc, GetQueuedCompletionStatus, GetLocalTime, ExpandEnvironmentStringsW, UnhandledExceptionFilter, TerminateProcess, GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, QueryPerformanceCounter, GetModuleHandleA, SetUnhandledExceptionFilter, OutputDebugStringA, InterlockedCompareExchange, InterlockedExchange, WideCharToMultiByte, MultiByteToWideChar, SetEvent, WaitForSingleObject, ResumeThread, CreateIoCompletionPort, Sleep, PostQueuedCompletionStatus, GetComputerNameW, GetTickCount, GetLastError, EnterCriticalSection, CloseHandle, CancelIo, ExitProcess, SetThreadStackGuarantee

mqrt.dll

MQCloseCursor, MQCloseQueue, MQCreateCursor, MQReceiveMessageByLookupId, MQPathNameToFormatName, MQOpenQueue, MQCreateQueue, MQReceiveMessage

mqsec.dll

MQSec_GetLocalSystemSid

msvcrt.dll

DllMain

ntdll.dll

RtlAllocateHeap, RtlFreeHeap, RtlImageNtHeader

ole32.dll

CLSIDFromProgID, CoUninitialize, CoCreateInstance, CoInitializeEx, CLSIDFromString, CoGetObjectContext, CoInitializeSecurity, OleRun

user32.dll

CharUpperW, CharLowerW

MQTGSVC.exe

Message Queuing Trigger Service by Microsoft

Remove MQTGSVC.exe

Version:	6.1.7601.17514 (win7sp1_rtm.101119-1850)
MD5:	9cced9b5ad63bece2f8bc75a5e04cdab
SHA1:	533e6494949281c98bd3dea680b42600e7de981e
SHA256:	0a2a2613956b78a7afcb4d6239580cab485f5d4c4ead16bb25884eabe8111890

This is a Windows system installed file with Windows File Protection (WFP) enabled.

What is MQTGSVC.exe?

Microsoft Message Queuing or MSMQ is a Message Queue implementation. MSMQ is essentially a messaging protocol that allows applications running on separate servers/processes to communicate in a failsafe manner. A queue is a temporary storage location from which messages can be sent and received reliably, as and when conditions permit.

Overview

mqtgsvc.exe runs as a service under the name Message Queuing-Trigger (MSMQTriggers) with minimal NETWORK SERVICE privileges on the local PC and acts as the computer on the network. The assembly utilizes the .NET run-time framework (which is required to be installed on the PC). This version is designed to run on Windows 7 and is compiled as a 32 bit program.

Details

File name:	mqtgsvc.exe
Publisher:	Microsoft Corporation
Product name:	Message Queuing Trigger Service
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\Windows\System32\mqtgsvc.exe
File version:	6.1.7601.17514 (win7sp1_rtm.101119-1850)
Product version:	6.1.7601.17514
Size:	123.5 KB (126,464 bytes)
Digital DNA
File packed:	No
Code language:	Microsoft Visual C# / Basic .NET
.NET CLR:	Yes
.NET NGENed:	No

More details

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'MSMQTriggers' (Message Queuing-Trigger)
MSMQTriggers

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00027377%	0.028634%
Kernel CPU:	0.00019865%	0.013761%
User CPU:	0.00007512%	0.014873%
Kernel CPU time:	198,572 ms/min	100,923,805ms/min
CPU cycles:	27,772/sec	17,470,203/sec
Memory
Private memory:	2.12 MB	21.59 MB
Private (maximum):	3.14 MB
Private (minimum):	2.29 MB
Non-paged memory:	2.12 MB	21.59 MB
Virtual memory:	29.73 MB	140.96 MB
Virtual memory (peak):	30.18 MB	169.69 MB
Working set:	2.33 MB	18.61 MB
Working set (peak):	4.77 MB	37.95 MB
Page faults:	3,043/min	2,039/min
I/O
I/O read transfer:	202 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O other transfer:	38 Bytes/sec	448.09 KB/min
I/O other operations:	3/sec	1,671/min
Resource allocations
Threads:	11	12
Handles:	191	600

Process properties

Integrety level:	System
Platform:	32-bit
Command line:	C:\Windows\System32\mqtgsvc.exe
Owner:	NETWORK SERVICE
Windows Service
Service name:	MSMQTriggers
Display name:	Message Queuing-Trigger
Description:	“Bietet eine Regel-basierte Überwachung von Nachrichten an, die in einer Message Queuing-Warteschlange empfangen werden, und, falls die Bedingungen einer Regel erfüllt werden, eine COM-Komponente oder ein eigenständiges ausführbares Programm aufrufen, um die Nachricht zu verarbeiten.”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads