MSOHTMED.EXE
Summary
Microsoft Office HTML Editor - handles HTML editing capabilities for Office applications.
MSOHTMED.EXE is the 1240th most commonly executed Windows program in EchoTrail's dataset, observed 1,179 times across enterprise environments. It typically runs from C:\Program Files\Microsoft Office\Office15 and it is most often launched by msiexec.exe.
Behavior
Top Paths
- C:\Program Files\Microsoft Office\Office1535.45%
- C:\Program Files (x86)\Microsoft Office\Office1525.53%
- C:\Program Files\Microsoft Office\Office1617.9%
- C:\Program Files (x86)\Microsoft Office\Office1411.87%
- C:\Program Files (x86)\Microsoft Office\Office165.6%
- C:\Program Files\Microsoft Office\Office143.05%
- C:\Program Files (x86)\Microsoft Office\Office120.59%
Top Hashes (SHA256)
- 94e28999c85e59795b5ba52b3e31875628540d4b7a4dccd79471edc9c1099aaa30.61%
- 638643c3acf83df1a8d1b960379c0e5b4d4b42681187928b425cd7446eb26e5e20.55%
- 5e240cc8ccc73b26469fc420b5714da33fff61babdacefa711a28c9598be4d7017.99%
- d6dc4a956fc398ab1a8e61a06325e4a2e564573180b970bc92b34c7a821dcf908.7%
- f2f1f55e8934650accdc10f250122e6eaca5cb93e6d5908330568d5b3dfd8d1c5.63%
- bd9e0fd4dce3ad1ba150b5ea0da5d06841d9a1070a7de7dc31d2c2ff561fab213.58%
- 176a13d52453e6d823728d889658ab2ee041e20f1f472c7e1c04264963c637393.41%
- 750e02a681b5eaf4c99739f4e2cf9b93f8706007192e32e9e9f3cb8fe23ffa492.81%
- 461055c9a78d06227c9f2bdd9b9810762632e93374f7f4a5ba9f4d78fa29c5d32.47%
- 220cbd93aba2305411fe1deb3d9b5b6520ad6b02147b8201656c6fa573ee91d41.71%
Process Ancestry
Top Grandparents
- services.exe99.83%
- userinit.exe0.17%
Top Parents
- msiexec.exe99.83%
- explorer.exe0.17%
Top Children
- WINWORD.EXE100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about MSOHTMED.EXE
Rocky answers questions about MSOHTMED.EXE grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.