MSOXMLED.EXE
Summary
Microsoft Office XML Editor — opens XML files with Office
MSOXMLED.EXE is the 2824th most commonly executed Windows program in EchoTrail's dataset, observed 116 times across enterprise environments. It typically runs from C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16 and it is most often launched by explorer.exe.
Behavior
Top Paths
- C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE1631.03%
- C:\Program Files\Common Files\microsoft shared\OFFICE1518.97%
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE1617.24%
- C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE1612.07%
- C:\Program Files\Common Files\microsoft shared\OFFICE1610.34%
- C:\Program Files (x86)\Common Files\microsoft shared\OFFICE1510.34%
Top Hashes (SHA256)
- 53299b7b3d52f63383c8d0493f500853004a9c65d292d67c8cf7273070d180b119.47%
- 6d46985a6d044dd58ce1098e575e7a4b50cfcf4ba7921ecb49fb6cdb877f662314.16%
- 3e8a68a506845ac2881dac23d395c6d688f6fe3ebe78f87669c73c2e11048b4910.62%
- cf00424db3615aa68bd4818a2af7a3e575bc2e255c13fa2ef8c509703ac592709.73%
- 555991ad172e7e6d3977326f7f4ee88a9374849a8254fe5a2ede136b683c1f518.85%
- e2c374705c0ffd5dfe57401007149f9663bded8b619ae0d67c56ffbe74ba38ed6.19%
- 7b0515a696909d9a9275ffa2b6dc35e7b1c6153bf14cae3dba19fdb39462b0ef4.42%
- 701dfc8177007c6092323193cd891c75d15d5f3744eb06aff4099193f55a06143.54%
- 80b40c289c730c7b40813a7075823e68f18350cddfaee565810faa3c435309fa3.54%
- 758e6652b0d3b31875396c52ecaa1be91e3193480f8c9245d8c830b6e96f113c2.65%
Process Ancestry
Top Grandparents
- userinit.exe37.78%
- svchost.exe30%
- explorer.exe23.33%
- lync.exe2.22%
- KeePass.exe1.11%
- OpenWith.exe1.11%
- rundll32.exe1.11%
- winlogon.exe1.11%
- WinRAR.exe1.11%
Top Parents
- explorer.exe60.34%
- OpenWith.exe11.21%
- MSOXMLED.EXE6.9%
- 7zFM.exe5.17%
- OUTLOOK.EXE5.17%
- chrome.exe3.45%
- Acrobat.exe1.72%
- lync.exe1.72%
- firefox.exe0.86%
- RuntimeBroker.exe0.86%
Top Children
- iexplore.exe46.94%
- MSOXMLED.EXE16.33%
- wordpad.exe12.24%
- notepad.exe10.2%
- EXCEL.EXE6.12%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about MSOXMLED.EXE
Rocky answers questions about MSOXMLED.EXE grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.