Should I block it?

No, this file is 100% safe to run.

VersionsAdditional versions

15.0.4623.1002 3.45%
15.0.4557.1000 2.07%
15.0.4557.1000 0.69%
15.0.4541.1000 0.69%
15.0.4535.1502 4.14%
15.0.4535.1502 0.69%
15.0.4517.1505 0.69%
15.0.4454.1000 2.76%
15.0.4128.1022 3.45%
15.0.4128.1019 0.69%
14.0.7104.5000 12.41%
14.0.6134.5000 2.07%
14.0.6134.5000 10.34%
14.0.6015.1000 45.52%
14.0.6015.1000 6.90%
14.0.4763.1000 0.69%
14.0.4734.1000 2.76%

Relationships

Parent process
Related files

PE structurePE file structure

Show functions
Import table
gdiplus.dll
GdipCreatePen1, GdipGetImageWidth, GdipCreateStringFormat, GdipCloneImage, GdipBitmapLockBits, GdipDrawImageRect, GdipSetSolidFillColor, GdipCreateFromHDC, GdipCreateFontFamilyFromName, GdipFillRectangle, GdipDrawString, GdipGetGenericFontFamilySansSerif, GdipCreateFont, GdipDisposeImage, GdipAlloc, GdipSetPenColor, GdipCreateSolidFill, GdipDeleteStringFormat, GdipDeleteFontFamily, GdipSetStringFormatAlign, GdipDeleteGraphics, GdipCreateBitmapFromScan0, GdipDeleteFont, GdipGetImagePixelFormat, GdipCreateBitmapFromGdiDib, GdipSetTextRenderingHint, GdipSetStringFormatLineAlign, GdipGetImageHeight, GdipCloneBitmapAreaI, GdipCloneBrush, GdipDeletePen, GdipFree, GdipDeleteBrush, GdiplusStartup, GdiplusShutdown, GdipBitmapUnlockBits
kernel32.dll
GetTickCount, GetSystemTimeAsFileTime, GetCurrentProcessId, HeapSetInformation, LoadLibraryA, LocalAlloc, FindResourceW, GetUserDefaultLCID, GetSystemDirectoryW, LocalFree, IsDebuggerPresent, UnhandledExceptionFilter, TerminateProcess, GetStartupInfoW, InterlockedCompareExchange, InterlockedExchange, HeapFree, HeapAlloc, WerRegisterMemoryBlock, GetCommandLineW, HeapCompact, FreeLibrary, CreateProcessW, SetUnhandledExceptionFilter, LoadLibraryExW, GetCurrentProcess, GlobalLock, WaitForSingleObject, SetEvent, GetModuleHandleW, GetProcessHeap, OpenProcess, GlobalAlloc, InitializeCriticalSectionAndSpinCount, Sleep, GetVersionExW, LeaveCriticalSection, GetModuleFileNameW, lstrlenW, GlobalUnlock, RaiseException, GetLastError, GetProcAddress, EnterCriticalSection, GlobalFree, IsWow64Process, CreateFileMappingW, CreateEventW, SetProcessWorkingSetSize, DeleteCriticalSection, GetCurrentThreadId, CloseHandle, FindResourceExW, LoadResource, QueryFullProcessImageNameW, SizeofResource, GetLocaleInfoEx, LockResource, CreateMutexW, MapViewOfFile, UnmapViewOfFile, OpenFileMappingW, ReleaseMutex, GetTempPathW, InitializeCriticalSectionEx, EncodePointer, DecodePointer, FormatMessageW, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, QueryPerformanceCounter, VirtualProtect, InitializeCriticalSection, LoadLibraryW, FindClose, FindNextFileW, MoveFileW, FindFirstFileW, FindCloseChangeNotification, FindNextChangeNotification, FindFirstChangeNotificationW, CreateDirectoryW, CompareStringW, GetStringTypeW, GetLocaleInfoW, GetStartupInfoA
msvcr100.dll
DllMain
msvcr90.dll
DllMain
oleacc.dll
AccessibleObjectFromWindow
user32.dll
CreatePopupMenu, AppendMenuW, EnableMenuItem, SetMenuDefaultItem, CheckMenuItem, SetRect, GetCursorPos, TrackPopupMenu, DestroyMenu, SendMessageW, RedrawWindow, EnumDisplayMonitors, FillRect, SetFocus, SetCapture, SetRectEmpty, LoadCursorW, SetCursor, DefWindowProcW, ShowWindow, WindowFromPoint, IsChild, RegisterWindowMessageW, LoadIconW, RegisterClassExW, CreateWindowExW, SetForegroundWindow, GetDC, OpenClipboard, EmptyClipboard, RegisterClipboardFormatW, SetClipboardData, IsRectEmpty, ReleaseDC, DestroyWindow, PostQuitMessage, LoadImageW, RegisterHotKey, GetMessageW, UnregisterHotKey, DispatchMessageW, PeekMessageW, TranslateMessage, MsgWaitForMultipleObjects, InvalidateRect, GetSysColorBrush, FrameRect, InflateRect, BeginPaint, EndPaint, UnionRect, GetWindowThreadProcessId, AllowSetForegroundWindow, SendMessageTimeoutW, LoadStringW, MessageBoxW, PostMessageW, SystemParametersInfoW, CloseClipboard

OneNoteM.exe

Microsoft OneNote by Microsoft Corporation (Signed)

Remove OneNoteM.exe
Version:   15.0.4517.1505
MD5:   9a25bf088cffd21e1b814c1643fd5813
SHA1:   257f7b805d5caccbdd5a59eee1618f51beaf9b15
SHA256:   7bee5ece20093cf2a3c61165fad94288e2be221d7de7c946bdbebc7f8f034a19

Overview

onenotem.exe executes as a process with the local user's privileges usually within the context of Windows Explorer. During installation, it (or a shortcut) is added to the user's startup folder which is designed to automatically launch when the user logs into Windows. The file is digitally signed by Microsoft Corporation.

DetailsDetails

File name:onenotem.exe
Publisher:Microsoft Corporation
Product name:Microsoft OneNote
Description:Microsoft OneNote Quick Launcher
Typical file path:C:\Program Files\microsoft office 15\root\office15\onenotem.exe
File version:15.0.4517.1505
Size:155.17 KB (158,896 bytes)
Build date:6/18/2013 12:29 AM
Certificate
Issued to:Microsoft Corporation
Authority (CA):Microsoft Corporation
Digital DNA
PE subsystem:Windows GUI
File packed:No
Code language:Microsoft Visual C++ 10.0
.NET CLR:No
More details

BehaviorsBehaviors

User start menu folder
Shortcut pointer placed in '%appdata%\Microsoft\Windows\Start Menu'
  • Shortcut to 'onenotem.exe'

ResourcesResource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)
Averages
 
CPU
Total CPU:0.00002856%
0.028634%
Kernel CPU:0.00001796%
0.013761%
User CPU:0.00001059%
0.014873%
Kernel CPU time:78 ms/min
100,923,805ms/min
CPU cycles:4,851/sec
17,470,203/sec
Memory
Private memory:4.32 MB
21.59 MB
Private (maximum):1.8 MB
Private (minimum):1.77 MB
Non-paged memory:4.32 MB
21.59 MB
Virtual memory:78.18 MB
140.96 MB
Virtual memory (peak):79.43 MB
169.69 MB
Working set:1.8 MB
18.61 MB
Working set (peak):9.63 MB
37.95 MB
Page faults:3,027/min
2,039/min
I/O
I/O read transfer:0 Bytes/sec
1.02 MB/min
I/O read operations:1/sec
343/min
I/O other transfer:59 Bytes/sec
448.09 KB/min
I/O other operations:1/sec
1,671/min
Resource allocations
Threads:2
12
Handles:104
600
GUI GDI count:23
103
GUI GDI peak:24
142
GUI USER count:9
49
GUI USER peak:9
71

BehaviorsProcess properties

Integrety level:Medium
Platform:64-bit
Command line:"C:\Program Files\microsoft office 15\root\office15\onenotem.exe" /tsr
Owner:User
Parent process:explorer.exe (Windows Explorer by Microsoft Corporation)

ResourcesThreads

Averages
 
ONENOTEM.EXE (main module)
Total CPU:0.00017237%
0.272967%
Kernel CPU:0.00008618%
0.107585%
User CPU:0.00008618%
0.165382%
CPU cycles:4,503/sec
5,741,424/sec
Memory:164 KB
1.16 MB
wow64.dll
Total CPU:0.00005746%
Kernel CPU:0.00005746%
User CPU:0.00000000%
CPU cycles:286/sec
Memory:252 KB

Windows OS versionsDistribution by Windows OS

OS versiondistribution
Windows 7 Home Premium 36.55%
Windows 7 Professional 12.41%
Windows 8 Pro 9.66%
Windows 8.1 8.28%
Windows 7 Ultimate 7.59%
Windows 8 6.21%
Windows 8 Pro with Media Center 6.21%
Windows Vista Home Premium 2.76%
Microsoft Windows XP 2.76%
Windows 8 Enterprise 2.07%
Windows 7 Home Basic 1.38%
Windows 8 Release Preview 1.38%
Windows 7 Enterprise 1.38%
Windows 8.1 Pro 0.69%
Windows 8.1 Pro Preview 0.69%

Distribution by countryDistribution by country

United States installs about 51.39% of Microsoft OneNote.

OEM distributionDistribution by PC manufacturer

PC Manufacturerdistribution
Dell 24.56%
ASUS 19.30%
Hewlett-Packard 17.54%
Acer 9.65%
Lenovo 8.77%
Toshiba 7.02%
Sony 7.02%
American Megatrends 1.75%
Packard Bell 1.75%
GIGABYTE 1.75%
Samsung 0.88%
Should I remove It? Clean your PC of unwanted adware, toolbars and bloatware.

Download it for FREE