> For the complete documentation index, see [llms.txt](https://malwaresourcecode.com/home/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://malwaresourcecode.com/home/process-creation-techniques/urlfileprotocolhandler.md).

# UrlFileProtocolHandler

```
BOOL CreateProcessFromUrlFileProtocolHandlerW(_In_ LPCWSTR PathToUrlFile)
{
	typedef HINSTANCE(WINAPI* FILEPROTOCOLHANDLERA)(HWND, HINSTANCE, LPCSTR, INT);
	FILEPROTOCOLHANDLERA FileProtocolHandlerA = NULL;
	HMODULE hMod = NULL;
	BOOL bFlag = FALSE;
	CHAR ccPathToUrlFile[MAX_PATH] = { 0 };

	if (WCharStringToCharString(ccPathToUrlFile, (PWCHAR)PathToUrlFile, StringLengthW(PathToUrlFile)) == 0)
		goto EXIT_ROUTINE;

	hMod = LoadLibraryW(L"url.dll");
	if (hMod == NULL)
		goto EXIT_ROUTINE;

	FileProtocolHandlerA = (FILEPROTOCOLHANDLERA)GetProcAddress(hMod, "FileProtocolHandlerA");
	if (!FileProtocolHandlerA)
		goto EXIT_ROUTINE;

	FileProtocolHandlerA(NULL, NULL, ccPathToUrlFile, SW_SHOW);

	bFlag = TRUE;

EXIT_ROUTINE:

	if (hMod)
		FreeLibrary(hMod);

	return bFlag;
}

BOOL CreateProcessFromUrlFileProtocolHandlerA(_In_ LPCSTR PathToUrlFile)
{
	typedef HINSTANCE(WINAPI* FILEPROTOCOLHANDLERA)(HWND, HINSTANCE, LPCSTR, INT);
	FILEPROTOCOLHANDLERA FileProtocolHandlerA = NULL;
	HMODULE hMod = NULL;
	BOOL bFlag = FALSE;

	hMod = LoadLibraryW(L"url.dll");
	if (hMod == NULL)
		goto EXIT_ROUTINE;

	FileProtocolHandlerA = (FILEPROTOCOLHANDLERA)GetProcAddress(hMod, "FileProtocolHandlerA");
	if (!FileProtocolHandlerA)
		goto EXIT_ROUTINE;

	FileProtocolHandlerA(NULL, NULL, PathToUrlFile, SW_SHOW);

	bFlag = TRUE;

EXIT_ROUTINE:

	if (hMod)
		FreeLibrary(hMod);

	return bFlag;
}
```