protocolhandler.exe
Summary
Protocol Handler - handles URL protocol dispatching for applications.
protocolhandler.exe is the 1299th most commonly executed Windows program in EchoTrail's dataset, observed 1,061 times across enterprise environments. It typically runs from C:\Program Files (x86)\Microsoft Office\root\Office16 and it is most often launched by firefox.exe.
Behavior
Top Paths
- C:\Program Files (x86)\Microsoft Office\root\Office1685.22%
- C:\Program Files\Microsoft Office\root\Office1614.6%
- C:\Program Files\Microsoft Office 15\root\office150.19%
Top Hashes (SHA256)
- fcea5a88718f5955643dc798988393908855516beef3536510b65b28e13d855d8.86%
- c57c06ec4d164bbc23b15a45e5e9fbdf8fcc483d25172da7be601113ca9a0b4e6.03%
- b6af45dafce1265358f604f617785fadad0674f0a7d041d6287a236de6b543025.94%
- e1cb2d3774414e2452abbc615d99b3bd9b2d5b5c98c67552036dd9d301d7b8854.52%
- 5ed9e57e45867c5e40d67bfd8dd153f340a5b0d56ead3d349089b513f0db00334.34%
- df01bf349bb8d13afaf6264129ceea2f5cda2263f912908bba406808e8db60704.34%
- 4a8d53758127c71e1fb7ccc37797884b47340138492a1ae64afe34a796993d703.86%
- 87f2cbed87e5cdf6e6105f0427dbf6ac0489a2f41c0225ec8252a35df922f28f3.49%
- cd7a8360d80826ac3f5aeadc58e3014166778361a40fd0c988f3fa0a6e95cb583.39%
- 768a6a5b2fb9a89cedb0b3195ef873c282f0a0b21100cba45d8fe1e715c967212.83%
Process Ancestry
Top Grandparents
- explorer.exe72.27%
- updater.exe17.44%
- OUTLOOK.EXE5.99%
- firefox.exe1.89%
- Update.exe0.53%
- chrome.exe0.42%
- KeePass.exe0.42%
- svchost.exe0.42%
- cmd.exe0.11%
- ONENOTE.EXE0.11%
Top Parents
- firefox.exe60.36%
- chrome.exe29%
- Teams.exe3.3%
- OUTLOOK.EXE2.17%
- iexplore.exe1.04%
- WINWORD.EXE1.04%
- sihost.exe0.85%
- explorer.exe0.66%
- msedge.exe0.56%
- RuntimeBroker.exe0.47%
Top Children
- WINWORD.EXE34.41%
- POWERPNT.EXE34.21%
- EXCEL.EXE29.13%
- VISIO.EXE2.25%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about protocolhandler.exe
Rocky answers questions about protocolhandler.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.