mpr.dll

  • File Path: C:\Windows\system32\mpr.dll
  • Description: Multiple Provider Router DLL

Hashes

Type Hash
MD5 3BB787DD69CC2F7B43949151037A3565
SHA1 1DCEDFC87771433432BD3CEA6682190446FB12FB
SHA256 8E12DDA44F76938D4F84DD4DF49305A28ECDC319FEBEF30F586183D03065DC21
SHA384 0F24E1671219771F9A7833CA74BD24C35FA4B7EB35059639A95EFB3D876AA793E34A2B2DCED8DA875B097273C5F0855A
SHA512 9550417C435E41E213C731B6C27DCFBFC3A0DE7099419C2CE179775B0B824FC634D0CB1FC8F7929C8F361206E2742F15D4E6F515704887B5F6E3F36C6EDD6C17
SSDEEP 1536:MSxdGxXyqntBWgQ2R2dUWnhL6Zs6Dv1oYGj+Re87Skf5B1w+PDER:MSfGxFPQ2AhL6W6T1oYmw57SkfDd7ER
IMP 20A055C902A467D5D15649CFA6502CED
PESHA1 E1475C2DD7D4B8E69A9BCD146A0ECADA20731BCF
PE256 D98C38A07C383C16E0014878958CA8770FE7C0AC904DCAF6CF86086379FA5B97

DLL Exports:

Function Name Ordinal Type
WNetGetProviderTypeA 58 Exported Function
WNetGetProviderTypeW 59 Exported Function
WNetGetProviderNameW 57 Exported Function
WNetGetPropertyTextW 55 Exported Function
WNetGetProviderNameA 56 Exported Function
WNetGetResourceParentW 63 Exported Function
WNetGetSearchDialog 64 Exported Function
WNetGetResourceParentA 62 Exported Function
WNetGetResourceInformationA 60 Exported Function
WNetGetResourceInformationW 61 Exported Function
WNetGetPropertyTextA 54 Exported Function
WNetGetDirectoryTypeA 47 Exported Function
WNetGetDirectoryTypeW 48 Exported Function
WNetGetConnectionW 46 Exported Function
WNetGetConnection3W 44 Exported Function
WNetGetConnectionA 45 Exported Function
WNetGetNetworkInformationA 52 Exported Function
WNetGetNetworkInformationW 53 Exported Function
WNetGetLastErrorW 51 Exported Function
WNetGetHomeDirectoryW 49 Exported Function
WNetGetLastErrorA 50 Exported Function
WNetSetLastErrorA 79 Exported Function
WNetSetLastErrorW 80 Exported Function
WNetSetConnectionW 78 Exported Function
WNetRestoreSingleConnectionW 76 Exported Function
WNetSetConnectionA 77 Exported Function
WNetUseConnectionA 84 Exported Function
WNetUseConnectionW 85 Exported Function
WNetUseConnection4W 83 Exported Function
WNetSupportGlobalEnum 81 Exported Function
WNetUseConnection4A 82 Exported Function
WNetRestoreAllConnectionsW 75 Exported Function
WNetGetUserW 68 Exported Function
WNetLogonNotify 69 Exported Function
WNetGetUserA 67 Exported Function
WNetGetUniversalNameA 65 Exported Function
WNetGetUniversalNameW 66 Exported Function
WNetPropertyDialogA 73 Exported Function
WNetPropertyDialogW 74 Exported Function
WNetPasswordChangeNotify 72 Exported Function
WNetOpenEnumA 70 Exported Function
WNetOpenEnumW 71 Exported Function
WNetGetConnection3A 43 Exported Function
WNetAddConnection3A 17 Exported Function
WNetAddConnection3W 18 Exported Function
WNetAddConnection2W 16 Exported Function
ShowReconnectDialogUI 7 Exported Function
WNetAddConnection2A 15 Exported Function
WNetAddConnectionW 22 Exported Function
WNetCancelConnection2A 23 Exported Function
WNetAddConnectionA 21 Exported Function
WNetAddConnection4A 19 Exported Function
WNetAddConnection4W 20 Exported Function
ShowReconnectDialogEnd 6 Exported Function
DoProfileErrorDialog 4 Exported Function
I_MprSaveConn 10 Exported Function
DoPasswordDialog 3 Exported Function
DoBroadcastSystemMessage 1 Exported Function
DoCommandLinePrompt 2 Exported Function
MultinetGetErrorTextW 14 Exported Function
ShowReconnectDialog 5 Exported Function
MultinetGetErrorTextA 13 Exported Function
MultinetGetConnectionPerformanceA 11 Exported Function
MultinetGetConnectionPerformanceW 12 Exported Function
WNetDisconnectDialog2 9 Exported Function
WNetEnumResourceA 37 Exported Function
WNetDisconnectDialog1W 36 Exported Function
WNetDisconnectDialog 34 Exported Function
WNetDisconnectDialog1A 35 Exported Function
WNetGetConnection2A 41 Exported Function
WNetGetConnection2W 42 Exported Function
WNetFormatNetworkNameW 40 Exported Function
WNetEnumResourceW 38 Exported Function
WNetFormatNetworkNameA 39 Exported Function
WNetDirectoryNotifyW 33 Exported Function
WNetClearConnections 27 Exported Function
WNetCloseEnum 28 Exported Function
WNetCancelConnectionW 26 Exported Function
WNetCancelConnection2W 24 Exported Function
WNetCancelConnectionA 25 Exported Function
WNetConnectionDialog2 8 Exported Function
WNetDirectoryNotifyA 32 Exported Function
WNetConnectionDialog1W 31 Exported Function
WNetConnectionDialog 29 Exported Function
WNetConnectionDialog1A 30 Exported Function

Signature

  • Status: Signature verified.
  • Serial: 330000026551AE1BBD005CBFBD000000000265
  • Thumbprint: E168609353F30FF2373157B4EB8CD519D07A2BFF
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: mpr.dll.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/70
  • VirusTotal Link: https://www.virustotal.com/gui/file/8e12dda44f76938d4f84dd4df49305a28ecdc319febef30f586183d03065dc21/detection/

Possible Misuse

The following table contains possible examples of mpr.dll being misused. While mpr.dll is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
malware-ioc win_apt_invisimole_wrapper_dll.yml - 'Windows\mpr.dll' © ESET 2014-2018
malware-ioc win_apt_invisimole_wrapper_dll.yml - '\mpr.dll' © ESET 2014-2018
malware-ioc numando \| F804DB94139B2E1D1D6A3CD27A9E78634540F87C \| VBoxTray.exe \| mpr.dll © ESET 2014-2018
signature-base apt_lazarus_dec20.yar $s3 = “Load mpr.dll Error “ fullword ascii CC BY-NC 4.0

MIT License. Copyright (c) 2020-2021 Strontic.