home

skypec2cpnrsvc.exe

Skype Click to Call

While the file properties state the file is developed by 'Microsoft Corporation', this is not the case and it is designed just to look like a legitimate Microsoft system file. The executable skypec2cpnrsvc.exe, “Phone Number Recognition (PNR) module” has been detected as malware by 3 anti-virus scanners. It runs as a separate (within the context of its own process) windows Service named “Skype Click to Call PNR Service”.
Publisher:
Microsoft Corporation*  (Invalid match)

Product:
Skype Click to Call

Description:
Phone Number Recognition (PNR) module

Version:
8.0.0.9103

MD5:
a6567424c06b451f2b6f0c6ae18d4b44

SHA-1:
0677c9809c45b682df2100a485b46a90e596b696

SHA-256:
58a90dc7d32d5f09ae42bf5ca4e4d0fb407b725fe820a04f0bd0f87eeb3ad676

Scanner detections:
3 / 68

Status:
Malware

Analysis date:
5/2/2024 5:49:54 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Xpirat
160917-0

Dr.Web
Win32.Expiro.80
9.0.1.05190

F-Prot
New or modified Expiro
4.6.5.141

File size:
2.2 MB (2,351,104 bytes)

Product version:
8.0.0.9103

Copyright:
(c) Microsoft Corporation. All rights reserved.

Original file name:
PNRSvc.exe

File type:
Executable application (Win32 EXE)

Language:
English (United Kingdom)

Common path:
C:\Program Files\skype\toolbars\pnrsvc\skypec2cpnrsvc.exe

File PE Metadata
Compilation timestamp:
1/8/2016 4:01:12 PM

OS version:
6.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
9.0

Entry address:
0x834FC

Entry point:
60, 55, 89, E5, 81, EC, 08, 01, 00, 00, C7, 45, EC, 06, 00, 00, 00, C7, 45, F4, 04, 00, 00, 00, 83, 65, F8, 00, 8B, 45, EC, 83, E8, 06, 89, 45, F0, C7, 45, B8, 93, 11, 00, 00, C7, 45, E8, AF, E0, 52, BF, B8, 32, 05, 00, 00, F7, 65, B8, 89, 45, 90, 89, 45, F8, C7, 45, F0, 87, 5F, 00, 00, 81, 45, F0, A1, 26, 00, 00, 81, 45, F0, D8, 31, 03, 00, 8B, 45, F4, 03, 45, EC, 83, E8, 0A, 89, 45, C4, 81, 45, F8, FA, 06, 00, 00, FF, 4D, E8, C7, 45, E4, 1A, 12, 00, 00, 8B, 45, E4, 29, 45, F8, C7, 45, DC, B0, 58, 5B, 00...
 
[+]

Entropy:
6.8390

Code size:
1.1 MB (1,159,168 bytes)

Service
Display name:
Skype Click to Call PNR Service

Service name:
c2cpnrsvc

Description:
Provides phone number recognition services.

Type:
Win32OwnProcess

Depends on:
RpcSs


Remove skypec2cpnrsvc.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.