home

CNQMMAIN.EXE

Canon Quick Menu

Canon Inc.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘CanonQuickMenu’. This is installed with Canon Quick Menu. The file has been seen being downloaded from webmail1p.orange.fr and multiple other hosts.
Publisher:
Canon Inc.  (signed and verified)

Product:
Canon Quick Menu

Version:
2.4.0.0

MD5:
aabd3e439647167142ffa5567512b3a4

SHA-1:
bd45f2032cfd49cf121be213db55c17a1e6ec81b

SHA-256:
9c90d4638b072be1e49fe1704127f62fa1a98d4a7d8a17a4de2f797fdfb85fae

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
1/13/2026 12:18:50 PM UTC  (today)

File size:
1.2 MB (1,284,680 bytes)

Product version:
2.4.0.0

Copyright:
Copyright CANON INC. 2012-2014

Original file name:
CNQMMAIN.EXE

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\canon\quick menu\cnqmmain.exe

Digital Signature
Signed by:
Canon Inc.

Authority:
VeriSign, Inc.

Valid from:
3/5/2013 7:00:00 PM

Valid to:
4/17/2014 7:59:59 PM

Subject:
CN=Canon Inc., OU=Inkjet System Development Center, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Canon Inc., L=Kawasaki-shi, S=Kanagawa, C=JP

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
2EF6AE3D9068E23F0D7E17585BE8CA4E

File PE Metadata
Compilation timestamp:
1/17/2014 2:52:30 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
24576:cTWBP74dMEq+7oUheXx9mGqexFQNWBP74dMEq9:CWBPkdMErxsCexFOWBPkdME+

Entry address:
0xDEA1E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.8075

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
883 KB (904,192 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
CanonQuickMenu

Command:
C:\Program Files\canon\quick menu\cnqmmain.exe \logon


The file CNQMMAIN.EXE has been discovered within the following program.

Canon Quick Menu  by Canon Inc.
Canon Quick Menu is a utility that enables users to start the Canon programs and manuals included with various devices.
www.usa.canon.com
8% remove it
 
Powered by Should I Remove It?

The file CNQMMAIN.EXE has been seen being distributed by the following 4 URLs.

https://webmail1p.orange.fr/webmail/fr_FR/.../Download.html?CHECK_ATTACHEMENT=TRUE&NAME=CNQMMAIN.EXE

https://webmail.laposte.net/service/home/.../?auth=co&loc=fr&id=41944&part=2

http://webmail.nyc.rr.com/do/mail/.../download?msgId=INBOXDELIM21715&part=2&l=en-US&v=twc_theme

https://mg.mail.yahoo.com/.../download?m=YaDownload&mid=2_0_0_3_1257_ADAIDNkAACA0VgtVTASnaNV5S5M&fid=Draft&pid=2&clean=0&appid=YahooMailNeo

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.