ONENOTEM.EXE
Summary
Microsoft OneNote Send To utility - handles Send to OneNote operations from other applications.
ONENOTEM.EXE is the 1279th most commonly executed Windows program in EchoTrail's dataset, observed 1,106 times across enterprise environments. It typically runs from C:\Program Files\Microsoft Office\root\Office16 and it is most often launched by explorer.exe.
Behavior
Top Paths
- C:\Program Files\Microsoft Office\root\Office1651.9%
- C:\Program Files (x86)\Microsoft Office\root\Office1645.66%
- C:\Program Files\Microsoft Office 15\root\office152.44%
Top Hashes (SHA256)
- 012d60a433e17a111f0365b21e0cbf4a0266ab6fd7192a63b57f6187639730425.02%
- 526a5b109658d635961eaa94acfed62999cb6dc95f05041e8742d3b1a26597074.47%
- 641fa166c3b51b04b72fb951647096e1ccf71e21b10139a1a0d500e606f593703.9%
- 4d5c27b329ff43b2bc33c6007c67f06185c6c2f2e11ea937e0627e7e473f76343.23%
- fdb95cd78484e3ff0753d264f4a0d6ddaf6b024462f327ab50b398e98bf3fdb73.11%
- 18654d63d571238ce2d5f765cb0405650e4207691623f83ddd3049106a4f0e1f3.08%
- 84fd28d7c04abefda918120bb25d55f4da439a6294ba59642bd40588924beced3.03%
- 98efa86bde94aa5e51209269605087e00e95011e1a9ec7b143a1aae1aa15dffb2.76%
- daeba012ce787c2519da602f05af125ab2b819706a7327b2f4cf61e0c94001492.74%
- 00329ce12ebbf20460564073527225dd0310722210b929afdbf07c90fde8bee92.58%
Process Ancestry
Top Grandparents
- userinit.exe80.63%
- explorer.exe18.23%
- svchost.exe0.25%
- OpenWith.exe0.18%
- ONENOTEM.EXE0.16%
- OfficeClickToRun.exe0.12%
- chrome.exe0.06%
- RuntimeBroker.exe0.04%
Top Parents
- explorer.exe74.41%
- ONENOTE.EXE15.55%
- OfficeClickToRun.exe9.58%
Top Children
- ONENOTE.EXE91.67%
- WerFault.exe8.33%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about ONENOTEM.EXE
Rocky answers questions about ONENOTEM.EXE grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.