Should I block it?

No, this file is 100% safe to run.

Additional versions

205e1	34.43%
3a2e8	25.14%
19e83	4.37%
3a2bd	12.57%
1713d	5.46%
0e01d	3.83%
681da	1.09%
83188	5.46%
a1dd3	7.10%
c183b	0.55%

(Note, Even Balance publishes each variation of this file with the same version, but the hashes are unique.)

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Related files

PE file structure

Show functions

Import table

advapi32.dll

RegSetValueExA, CreateServiceA, CloseServiceHandle, DeleteService, ControlService, OpenServiceA, OpenSCManagerA, AdjustTokenPrivileges, LookupPrivilegeValueA, StartServiceCtrlDispatcherA, RegisterServiceCtrlHandlerA, RegCreateKeyExA, StartServiceA, RegOpenKeyExA, RegCloseKey, SetServiceStatus, OpenProcessToken

crypt32.dll

CertGetNameStringA, CryptDecodeObject, CertFreeCertificateContext, CryptMsgClose, CertCloseStore, CertVerifyTimeValidity, CertFindCertificateInStore, CryptQueryObject, CryptMsgGetParam

kernel32.dll

GetCurrentProcess, GetTickCount, GetCPInfo, Sleep, GetSystemDirectoryA, CopyFileA, WideCharToMultiByte, SystemTimeToFileTime, FileTimeToLocalFileTime, lstrcmpA, lstrcpyW, FileTimeToSystemTime, MultiByteToWideChar, GetLastError, FormatMessageA, lstrlenA, LocalAlloc, LocalFree, HeapSize, SetEndOfFile, GetLocaleInfoA, VirtualProtect, GetACP, GetStringTypeW, GetStringTypeA, LoadLibraryA, GetSystemInfo, LCMapStringA, LCMapStringW, CompareStringA, CompareStringW, SetEnvironmentVariableA, CreateDirectoryA, GetFileAttributesA, SetFileAttributesA, GetOEMCP, DeleteFileA, GetSystemTimeAsFileTime, ExitProcess, RtlUnwind, HeapFree, HeapAlloc, GetModuleHandleA, GetCommandLineA, GetVersionExA, WriteFile, FlushFileBuffers, CloseHandle, GetProcAddress, TerminateProcess, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, SetFilePointer, GetTimeZoneInformation, QueryPerformanceCounter, GetCurrentThreadId, GetCurrentProcessId, GetModuleFileNameA, InterlockedExchange, VirtualQuery, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, HeapReAlloc, ReadFile, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetStdHandle, CreateFileA, OpenProcess, ReadProcessMemory, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, TlsAlloc, SetLastError, TlsFree, TlsSetValue, TlsGetValue, InitializeCriticalSection, MoveFileA

psapi.dll

GetModuleInformation, EnumProcessModules, GetModuleFileNameExA

shell32.dll

SHGetFolderPathA

user32.dll

wsprintfA

wintrust.dll

WinVerifyTrust

pnkbstra.exe

By Even Balance (Signed)

Remove pnkbstra.exe

MD5:	0e01d7eebada0b324db0ca1ee73440ba
SHA1:	06f5ca76f422aaecf985ceae24a3788c87a3aea4
SHA256:	734c0a532d02f92cd1a48b142003dfa4ba296322f88e21983825e2b70a68a463

Overview

pnkbstra.exe runs as a service under the name PnkBstrA with extensive SYSTEM privileges (full administrator access). It has been configured with a firewall exception which allows both inbound and outbound network communication without being blocked. The file is digitally signed by Even Balance which was issued by the VeriSign certificate authority (CA).

Details

File name:	pnkbstra.exe
Typical file path:	C:\windows\syswow64\pnkbstra.exe
Size:	65.3 KB (66,872 bytes)
Certificate
Issued to:	Even Balance
Authority (CA):	VeriSign
Effective date:	Sunday, July 1, 2012
Digital DNA
File packed:	No
.NET CLR:	No

More details

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'PnkBstrA'

Windows firewall allowed programs

Exceptions allow programs to access to the Internet through an outbound connections

Firewall exception for 'C:\WINDOWS\system32\PnkBstrA.exe'
Firewall exception for 'C:\WINDOWS\system32\PnkBstrA.exe'

Network connections

Access through an approved Windows firewall exception

[UDP] listens on port 44301

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00021340%	0.028634%
Kernel CPU:	0.00004362%	0.013761%
User CPU:	0.00016978%	0.014873%
Kernel CPU time:	2,496,032 ms/min	100,923,805ms/min
CPU cycles:	126,860/sec	17,470,203/sec
Context switches:	10/sec	284/sec
Memory
Private memory:	1.36 MB	21.59 MB
Private (maximum):	3.56 MB
Private (minimum):	2.16 MB
Non-paged memory:	1.36 MB	21.59 MB
Virtual memory:	45.27 MB	140.96 MB
Virtual memory (peak):	46.99 MB	169.69 MB
Working set:	2.2 MB	18.61 MB
Working set (peak):	3.59 MB	37.95 MB
Page faults:	1,084/min	2,039/min
I/O
I/O read transfer:	0 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O write transfer:	0 Bytes/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	0 Bytes/sec	448.09 KB/min
I/O other operations:	1/sec	1,671/min
Resource allocations
Threads:	3	12
Handles:	71	600

Process properties

Integrety level:	System
Platform:	32-bit
Command line:	C:\Windows\System32\pnkbstra.exe
Owner:	SYSTEM
Windows Service
Service name:	PnkBstrA
Description:	“PunkBuster Service Component [v1029] http://www.evenbalance.com”
Type:	Win32OwnProcess
Parent process:	services.exe (by Microsoft)

Threads

Averages

PnkBstrA.exe (main module)
Total CPU:	0.00083861%	0.272967%
Kernel CPU:	0.00000000%	0.107585%
User CPU:	0.00083861%	0.165382%
CPU cycles:	13,762/sec	5,741,424/sec
Memory:	76 KB	1.16 MB
sechost.dll
Total CPU:	0.00011637%
Kernel CPU:	0.00006982%
User CPU:	0.00004655%
CPU cycles:	61,117/sec
Memory:	100 KB

Distribution by Windows OS

OS version	distribution
Windows 7 Home Premium	28.89%
Windows 7 Ultimate	24.44%
Microsoft Windows XP	12.78%
Windows 7 Professional	7.78%
Windows 8 Pro	5.00%
Windows 7 Home Basic	3.89%
Windows Vista Home Premium	3.89%
Windows 8	3.33%
Windows 8.1 Pro	2.22%
Windows Vista Home Basic	2.22%
Windows 8 Pro with Media Center	1.67%
Windows Developer Preview	1.11%
Windows Vista Business	1.11%
Windows 8.1	0.56%
Windows 7 Enterprise	0.56%
Windows Vista Ultimate	0.56%

Distribution by country

United States installs about 22.78% of pnkbstra.exe.

Distribution by PC manufacturer

PC Manufacturer	distribution
ASUS	16.42%
Hewlett-Packard	12.69%
Acer	11.94%
Dell	10.45%
Lenovo	10.45%
GIGABYTE	8.21%
Toshiba	7.46%
Sony	5.97%
MSI	5.97%
Samsung	2.99%
Gateway	2.99%
American Megatrends	1.49%
Intel	1.49%
Alienware	1.49%

Remove Adware and Spyware Programs, FREE Download!