Should I block it?

No, this file is 100% safe to run.

Additional versions

6.2.9200.16384 (win8_rtm.120725-1247)	11.69%
6.2.9200.16384 (win8_rtm.120725-1247)	1.30%
6.1.7601.17514 (win7sp1_rtm.101119-1850)	27.27%
6.1.7601.17514 (win7sp1_rtm.101119-1850)	29.87%
6.1.7600.16385 (win7_rtm.090713-1255)	1.30%
6.0.6002.18005 (lh_sp2rtm.090410-1830)	7.79%
5.01.1111	6.49%
5.01.1110	12.99%
5.01.1108	1.30%

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Related files

mqsvc.exe (Message Queuing Service by Microsoft)

PE file structure

Show functions

Import table

advapi32.dll

TraceMessage, RegCloseKey, RegConnectRegistryW, GetLengthSid, IsValidSid, GetTraceEnableFlags, GetTraceEnableLevel, GetTraceLoggerHandle, RegisterTraceGuidsW, UnregisterTraceGuids, SetSecurityDescriptorDacl, AddAccessAllowedAce, InitializeAcl, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, GetTokenInformation, InitializeSecurityDescriptor, OpenProcessToken, RegDeleteKeyW, RegOpenKeyExW, RegQueryValueExW, RegSetValueExW, RegEnumValueW, AddAccessDeniedAce, LookupAccountNameW, MakeSelfRelativeSD, ReportEventW, RegisterEventSourceW, StartServiceCtrlDispatcherW, RegisterServiceCtrlHandlerW, SetServiceStatus, RegCreateKeyExW

comsvcs.dll

CoLeaveServiceDomain, CoEnterServiceDomain

kernel32.dll

DeleteCriticalSection, InitializeCriticalSection, ResetEvent, SetThreadPriority, LocalFree, GetCurrentProcess, InterlockedDecrement, InterlockedIncrement, LeaveCriticalSection, GetVersion, VirtualQuery, GetModuleHandleW, GetProcAddress, VirtualAlloc, VirtualProtect, ReleaseSemaphore, CreateSemaphoreW, GetSystemInfo, CreateThread, CreateEventW, HeapSetInformation, FormatMessageW, LocalAlloc, GetQueuedCompletionStatus, GetLocalTime, ExpandEnvironmentStringsW, UnhandledExceptionFilter, TerminateProcess, GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, QueryPerformanceCounter, GetModuleHandleA, SetUnhandledExceptionFilter, OutputDebugStringA, InterlockedCompareExchange, InterlockedExchange, WideCharToMultiByte, MultiByteToWideChar, SetEvent, WaitForSingleObject, ResumeThread, CreateIoCompletionPort, Sleep, PostQueuedCompletionStatus, GetComputerNameW, GetTickCount, GetLastError, EnterCriticalSection, CloseHandle, CancelIo, ExitProcess, SetThreadStackGuarantee

mqrt.dll

MQCloseCursor, MQCloseQueue, MQCreateCursor, MQReceiveMessageByLookupId, MQPathNameToFormatName, MQOpenQueue, MQCreateQueue, MQReceiveMessage

mqsec.dll

MQSec_GetLocalSystemSid

msvcrt.dll

DllMain

ntdll.dll

RtlAllocateHeap, RtlFreeHeap, RtlImageNtHeader

ole32.dll

CLSIDFromProgID, CoUninitialize, CoCreateInstance, CoInitializeEx, CLSIDFromString, CoGetObjectContext, CoInitializeSecurity, OleRun

user32.dll

CharUpperW, CharLowerW

MQTGSVC.exe

Message Queuing Trigger Service by Microsoft

Remove MQTGSVC.exe

Version:	6.0.6002.18005 (lh_sp2rtm.090410-1830)
MD5:	fa3849c021b463e383bf188a9f0c8ed5
SHA1:	cb3fcc64f8d311301c3a63e9353ef0137d9d32b7
SHA256:	050a428f556486a1d19aa458ebca06d95bf15339c48af182b056127e0078c1f4

This is a Windows system installed file with Windows File Protection (WFP) enabled.

What is MQTGSVC.exe?

Microsoft Message Queuing or MSMQ is a Message Queue implementation. MSMQ is essentially a messaging protocol that allows applications running on separate servers/processes to communicate in a failsafe manner. A queue is a temporary storage location from which messages can be sent and received reliably, as and when conditions permit.

Overview

mqtgsvc.exe runs as a service under the name Message Queuing-Trigger (MSMQTriggers) with minimal NETWORK SERVICE privileges on the local PC and acts as the computer on the network. The assembly utilizes the .NET run-time framework (which is required to be installed on the PC). and is compiled as a 32 bit program.

Details

File name:	mqtgsvc.exe
Publisher:	Microsoft Corporation
Product name:	Message Queuing Trigger Service
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\Windows\System32\mqtgsvc.exe
File version:	6.0.6002.18005 (lh_sp2rtm.090410-1830)
Product version:	6.0.6002.18005
Size:	123 KB (125,952 bytes)
Digital DNA
File packed:	No
Code language:	Microsoft Visual C# / Basic .NET
.NET CLR:	Yes
.NET NGENed:	No

More details

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'MSMQTriggers' (Message Queuing-Trigger)
MSMQTriggers

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00059862%	0.028634%
Kernel CPU:	0.00055381%	0.013761%
User CPU:	0.00004481%	0.014873%
Kernel CPU time:	5,240 ms/min	100,923,805ms/min
CPU cycles:	1,240,849/sec	17,470,203/sec
Memory
Private memory:	2.13 MB	21.59 MB
Private (maximum):	4.02 MB
Private (minimum):	3.48 MB
Non-paged memory:	2.13 MB	21.59 MB
Virtual memory:	43.55 MB	140.96 MB
Virtual memory (peak):	43.8 MB	169.69 MB
Working set:	3.58 MB	18.61 MB
Working set (peak):	4.6 MB	37.95 MB
Page faults:	1,288/min	2,039/min
I/O
I/O read transfer:	80 Bytes/sec	1.02 MB/min
I/O read operations:	2/sec	343/min
I/O write transfer:	82 Bytes/sec	274.99 KB/min
I/O write operations:	2/sec	227/min
I/O other transfer:	690 Bytes/sec	448.09 KB/min
I/O other operations:	72/sec	1,671/min
Resource allocations
Threads:	9	12
Handles:	173	600

Process properties

Integrety level:	System
Platform:	32-bit
Command line:	C:\Windows\System32\mqtgsvc.exe
Owner:	NETWORK SERVICE
Windows Service
Service name:	MSMQTriggers
Display name:	Message Queuing-Trigger
Description:	“Bietet eine Regel-basierte Überwachung von Nachrichten an, die in einer Message Queuing-Warteschlange empfangen werden, und, falls die Bedingungen einer Regel erfüllt werden, eine COM-Komponente oder ein eigenständiges ausführbares Programm aufrufen, um die Nachricht zu verarbeiten.”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads