mpr.dll

  • File Path: C:\Windows\SysWOW64\mpr.dll
  • Description: Multiple Provider Router DLL

Hashes

Type Hash
MD5 2DA50C759D787577A00FD5A365E5B056
SHA1 18A92E977D2BEEF092FBF08766F96FDBE8E0D74D
SHA256 45AEF4DA43908A7785B786FA8B6556AFF272245B0D0DD99DDC6107077DA833B3
SHA384 C2F492C9B8957010B8422602E31A32106A09E05806B62297CDF2F0CBA288797374E84026D372B19507EB8D353090FB76
SHA512 4A77904E0568BE9AA5E4D395B74A74D4CAFCFC45326F7C6C771C0292D8F58EDB59CD16CCA22EDD1B793F3EA735061F980957BF74CCE8A4B96EA40003B5EEB1DA
SSDEEP 1536:YhhSY3p2e+Lxd/iT66IZfs73b950FWsqT65dSwMwRe8HkFjcPnv:YNp2fXid28b96h5wwN5Hky/v
IMP 85E7CB96F8CF9AA23D636135B5BE7EFB
PESHA1 99B1EBC8D4213AE945B1D53BB9DA681BB349D3F7
PE256 149CCE9400C35B43343F751E37BAAB6F13B08E5F913FF3A9319AE66A0BAEB2E1

DLL Exports:

Function Name Ordinal Type
WNetGetProviderTypeA 58 Exported Function
WNetGetProviderTypeW 59 Exported Function
WNetGetProviderNameW 57 Exported Function
WNetGetPropertyTextW 55 Exported Function
WNetGetProviderNameA 56 Exported Function
WNetGetResourceParentW 63 Exported Function
WNetGetSearchDialog 64 Exported Function
WNetGetResourceParentA 62 Exported Function
WNetGetResourceInformationA 60 Exported Function
WNetGetResourceInformationW 61 Exported Function
WNetGetPropertyTextA 54 Exported Function
WNetGetDirectoryTypeA 47 Exported Function
WNetGetDirectoryTypeW 48 Exported Function
WNetGetConnectionW 46 Exported Function
WNetGetConnection3W 44 Exported Function
WNetGetConnectionA 45 Exported Function
WNetGetNetworkInformationA 52 Exported Function
WNetGetNetworkInformationW 53 Exported Function
WNetGetLastErrorW 51 Exported Function
WNetGetHomeDirectoryW 49 Exported Function
WNetGetLastErrorA 50 Exported Function
WNetSetLastErrorA 79 Exported Function
WNetSetLastErrorW 80 Exported Function
WNetSetConnectionW 78 Exported Function
WNetRestoreSingleConnectionW 76 Exported Function
WNetSetConnectionA 77 Exported Function
WNetUseConnectionA 84 Exported Function
WNetUseConnectionW 85 Exported Function
WNetUseConnection4W 83 Exported Function
WNetSupportGlobalEnum 81 Exported Function
WNetUseConnection4A 82 Exported Function
WNetRestoreAllConnectionsW 75 Exported Function
WNetGetUserW 68 Exported Function
WNetLogonNotify 69 Exported Function
WNetGetUserA 67 Exported Function
WNetGetUniversalNameA 65 Exported Function
WNetGetUniversalNameW 66 Exported Function
WNetPropertyDialogA 73 Exported Function
WNetPropertyDialogW 74 Exported Function
WNetPasswordChangeNotify 72 Exported Function
WNetOpenEnumA 70 Exported Function
WNetOpenEnumW 71 Exported Function
WNetGetConnection3A 43 Exported Function
WNetAddConnection3A 17 Exported Function
WNetAddConnection3W 18 Exported Function
WNetAddConnection2W 16 Exported Function
ShowReconnectDialogUI 7 Exported Function
WNetAddConnection2A 15 Exported Function
WNetAddConnectionW 22 Exported Function
WNetCancelConnection2A 23 Exported Function
WNetAddConnectionA 21 Exported Function
WNetAddConnection4A 19 Exported Function
WNetAddConnection4W 20 Exported Function
ShowReconnectDialogEnd 6 Exported Function
DoProfileErrorDialog 4 Exported Function
I_MprSaveConn 10 Exported Function
DoPasswordDialog 3 Exported Function
DoBroadcastSystemMessage 1 Exported Function
DoCommandLinePrompt 2 Exported Function
MultinetGetErrorTextW 14 Exported Function
ShowReconnectDialog 5 Exported Function
MultinetGetErrorTextA 13 Exported Function
MultinetGetConnectionPerformanceA 11 Exported Function
MultinetGetConnectionPerformanceW 12 Exported Function
WNetDisconnectDialog2 9 Exported Function
WNetEnumResourceA 37 Exported Function
WNetDisconnectDialog1W 35 Exported Function
WNetDisconnectDialog 36 Exported Function
WNetDisconnectDialog1A 34 Exported Function
WNetGetConnection2A 41 Exported Function
WNetGetConnection2W 42 Exported Function
WNetFormatNetworkNameW 40 Exported Function
WNetEnumResourceW 38 Exported Function
WNetFormatNetworkNameA 39 Exported Function
WNetDirectoryNotifyW 33 Exported Function
WNetClearConnections 27 Exported Function
WNetCloseEnum 28 Exported Function
WNetCancelConnectionW 26 Exported Function
WNetCancelConnection2W 24 Exported Function
WNetCancelConnectionA 25 Exported Function
WNetConnectionDialog2 8 Exported Function
WNetDirectoryNotifyA 32 Exported Function
WNetConnectionDialog1W 30 Exported Function
WNetConnectionDialog 31 Exported Function
WNetConnectionDialog1A 29 Exported Function

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: mpr.dll
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/69
  • VirusTotal Link: https://www.virustotal.com/gui/file/45aef4da43908a7785b786fa8b6556aff272245b0d0dd99ddc6107077da833b3/detection/

Possible Misuse

The following table contains possible examples of mpr.dll being misused. While mpr.dll is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
malware-ioc win_apt_invisimole_wrapper_dll.yml - 'Windows\mpr.dll' © ESET 2014-2018
malware-ioc win_apt_invisimole_wrapper_dll.yml - '\mpr.dll' © ESET 2014-2018
malware-ioc numando \| F804DB94139B2E1D1D6A3CD27A9E78634540F87C \| VBoxTray.exe \| mpr.dll © ESET 2014-2018
signature-base apt_lazarus_dec20.yar $s3 = “Load mpr.dll Error “ fullword ascii CC BY-NC 4.0

MIT License. Copyright (c) 2020-2021 Strontic.