ONENOTEM.EXE
- File Path:
C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE - Description: Send to OneNote Tool
Hashes
| Type | Hash |
|---|---|
| MD5 | BB7C564802654578640F50C38D3F8FEF |
| SHA1 | FAB03A5576D409647B124CD7A88DE5C903A4FF50 |
| SHA256 | 05599A4FF40450D76E738BCE2C121128D5079F5E791FF64E0390AA36297439E6 |
| SHA384 | 56995A480C26A1426E7FFFF62C21E41F9A7ED11C196CD52B88B6A5D2259C41D496A235A441161A360A42C52A391E28C7 |
| SHA512 | 455100EAB374B55A4DA6DE06B3C18DF4B3F9AD02B0AE6C6FFE9BCB3C7710E631F0BB46443DCD6ABA8FFECAA6452B6D6B73F93FACF4278AF20B06C9377F74E942 |
| SSDEEP | 3072:YGRf6t28H9upwpjdMpzMuOvOYOhODOXOYOzODOaOpOxO1O3OvOJO8O+O/ONOHO4D:9Ru5W6uOvOYOhODOXOYOzODOaOpOxO1D |
| IMP | 87CD34E73BFA3CCE089B5835EE56963F |
| PESHA1 | 016861D0A00FAAC1B9A7568676A2481FE01D3586 |
| PE256 | A7544334B247F2A5DF4EEABBCECFB64059E72F6B35EDB5311DFD0BFE3694EC4B |
Runtime Data
Child Processes:
ONENOTE.EXE
Window Title:
Microsoft OneNote 2016
Open Handles:
| Path | Type |
|---|---|
| (R–) C:\ProgramData\Microsoft\Office\ClickToRunPackageLocker | File |
| (R-D) C:\Windows\Fonts\StaticCache.dat | File |
| (RW-) C:\Users\user\Documents | File |
| (RW-) C:\Windows | File |
| (RW-) C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.488_none_11b1e5df2ffd8627 | File |
| (RW-) C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.508_none_429cdbca8a8ffa94 | File |
| \BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 | Section |
| \BaseNamedObjects\NLS_CodePage_437_3_2_0_0 | Section |
| \Sessions\1\BaseNamedObjects\OneNoteM:AppSharedFile | Section |
| \Sessions\1\Windows\Theme64749523 | Section |
| \Windows\Theme1120315852 | Section |
Loaded Modules:
| Path |
|---|
| C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTEM.EXE |
| C:\Windows\SYSTEM32\ntdll.dll |
| C:\Windows\System32\wow64.dll |
| C:\Windows\System32\wow64cpu.dll |
| C:\Windows\System32\wow64win.dll |
Signature
- Status: Signature verified.
- Serial:
33000002CE7C9ACE7D905ED2B70000000002CE - Thumbprint:
B10607FB914700B40F794610850C1DE0A21566C1 - Issuer: CN=Microsoft Code Signing PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Subject: CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
File Metadata
- Original Filename: OneNoteM.exe
- Product Name: Microsoft OneNote
- Company Name: Microsoft Corporation
- File Version: 16.0.12527.20482
- Product Version: 16.0.12527.20482
- Language: Language Neutral
- Legal Copyright:
- Machine Type: 32-bit
File Scan
- VirusTotal Detections: 0/71
- VirusTotal Link: https://www.virustotal.com/gui/file/05599a4ff40450d76e738bce2c121128d5079f5e791ff64e0390aa36297439e6/detection/
MIT License. Copyright (c) 2020-2021 Strontic.