Should I block it?

No, this file is 100% safe to run.

Additional versions

205e1	34.43%
3a2e8	25.14%
19e83	4.37%
3a2bd	12.57%
1713d	5.46%
0e01d	3.83%
681da	1.09%
83188	5.46%
a1dd3	7.10%
c183b	0.55%

(Note, Even Balance publishes each variation of this file with the same version, but the hashes are unique.)

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Related files

PE file structure

Show functions

Import table

advapi32.dll

RegSetValueExA, CreateServiceA, CloseServiceHandle, DeleteService, ControlService, OpenServiceA, OpenSCManagerA, AdjustTokenPrivileges, LookupPrivilegeValueA, StartServiceCtrlDispatcherA, RegisterServiceCtrlHandlerA, RegCreateKeyExA, StartServiceA, RegOpenKeyExA, RegCloseKey, SetServiceStatus, OpenProcessToken

crypt32.dll

CertGetNameStringA, CryptDecodeObject, CertFreeCertificateContext, CryptMsgClose, CertCloseStore, CertVerifyTimeValidity, CertFindCertificateInStore, CryptQueryObject, CryptMsgGetParam

kernel32.dll

GetCurrentProcess, GetTickCount, GetCPInfo, Sleep, GetSystemDirectoryA, CopyFileA, WideCharToMultiByte, SystemTimeToFileTime, FileTimeToLocalFileTime, lstrcmpA, lstrcpyW, FileTimeToSystemTime, MultiByteToWideChar, GetLastError, FormatMessageA, lstrlenA, LocalAlloc, LocalFree, HeapSize, SetEndOfFile, GetLocaleInfoA, VirtualProtect, GetACP, GetStringTypeW, GetStringTypeA, LoadLibraryA, GetSystemInfo, LCMapStringA, LCMapStringW, CompareStringA, CompareStringW, SetEnvironmentVariableA, CreateDirectoryA, GetFileAttributesA, SetFileAttributesA, GetOEMCP, DeleteFileA, GetSystemTimeAsFileTime, ExitProcess, RtlUnwind, HeapFree, HeapAlloc, GetModuleHandleA, GetCommandLineA, GetVersionExA, WriteFile, FlushFileBuffers, CloseHandle, GetProcAddress, TerminateProcess, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, SetFilePointer, GetTimeZoneInformation, QueryPerformanceCounter, GetCurrentThreadId, GetCurrentProcessId, GetModuleFileNameA, InterlockedExchange, VirtualQuery, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, HeapReAlloc, ReadFile, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetStdHandle, CreateFileA, OpenProcess, ReadProcessMemory, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, TlsAlloc, SetLastError, TlsFree, TlsSetValue, TlsGetValue, InitializeCriticalSection, MoveFileA

psapi.dll

GetModuleInformation, EnumProcessModules, GetModuleFileNameExA

shell32.dll

SHGetFolderPathA

user32.dll

wsprintfA

wintrust.dll

WinVerifyTrust

pnkbstra.exe

By Even Balance (Signed)

Remove pnkbstra.exe

MD5:	a1dd33d16f277ce34124ee52ab2c0f14
SHA1:	d2c04d9061d37c71e8daa8306634665d62c437fb
SHA256:	db5215409d0b6c378567a6399c0170226cb1e2fe74d96b16c97a761d487c613f

Overview

pnkbstra.exe runs as a service under the name PnkBstrA with extensive SYSTEM privileges (full administrator access). It has been configured with a firewall exception which allows both inbound and outbound network communication without being blocked. The file is digitally signed by Even Balance which was issued by the VeriSign certificate authority (CA).

Details

File name:	pnkbstra.exe
Typical file path:	C:\windows\syswow64\pnkbstra.exe
Size:	73.3 KB (75,064 bytes)
Certificate
Issued to:	Even Balance
Authority (CA):	VeriSign
Effective date:	Sunday, July 1, 2012
Digital DNA
File packed:	No
.NET CLR:	No

More details

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'PnkBstrA'

Windows firewall allowed programs

Exceptions allow programs to access to the Internet through an outbound connections

Firewall exception for 'C:\WINDOWS\system32\PnkBstrA.exe'
Firewall exception for 'C:\WINDOWS\system32\PnkBstrA.exe'

Network connections

Access through an approved Windows firewall exception

[UDP] listens on port 44301

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00153202%	0.028634%
Kernel CPU:	0.00099217%	0.013761%
User CPU:	0.00053985%	0.014873%
Kernel CPU time:	546,224 ms/min	100,923,805ms/min
CPU cycles:	79,316/sec	17,470,203/sec
Context switches:	10/sec	284/sec
Memory
Private memory:	1.68 MB	21.59 MB
Private (maximum):	4.13 MB
Private (minimum):	2.8 MB
Non-paged memory:	1.68 MB	21.59 MB
Virtual memory:	45.71 MB	140.96 MB
Virtual memory (peak):	48.75 MB	169.69 MB
Working set:	3.53 MB	18.61 MB
Working set (peak):	4.66 MB	37.95 MB
Page faults:	1,528/min	2,039/min
I/O
I/O read transfer:	10.17 KB/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O write transfer:	1.65 KB/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	6 Bytes/sec	448.09 KB/min
I/O other operations:	2/sec	1,671/min
Resource allocations
Threads:	4	12
Handles:	100	600
GUI GDI count:	4	103
GUI USER count:	1	49

Process properties

Integrety level:	System
Platform:	64-bit
Command lines:	C:\windows\syswow64\pnkbstra.exe C:\Windows\System32\pnkbstra.exe
Owner:	SYSTEM
Windows Service
Service name:	PnkBstrA
Description:	“PunkBuster Service Component [v1029] http://www.evenbalance.com”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads

Averages

wow64.dll
Total CPU:	0.00220776%	0.272967%
Kernel CPU:	0.00110388%	0.107585%
User CPU:	0.00110388%	0.165382%
CPU cycles:	731,209/sec	5,741,424/sec
Context switches:	10/sec	79/sec
Memory:	252 KB	1.16 MB
sechost.dll
Total CPU:	0.00183031%
Kernel CPU:	0.00074876%
User CPU:	0.00108155%
CPU cycles:	546,413/sec
Context switches:	10/sec
Memory:	100 KB
PnkBstrA.exe (main module)
Total CPU:	0.00023375%
Kernel CPU:	0.00023375%
User CPU:	0.00000000%
CPU cycles:	6,592/sec
Memory:	88 KB

Distribution by Windows OS

OS version	distribution
Windows 7 Home Premium	28.89%
Windows 7 Ultimate	24.44%
Microsoft Windows XP	12.78%
Windows 7 Professional	7.78%
Windows 8 Pro	5.00%
Windows 7 Home Basic	3.89%
Windows Vista Home Premium	3.89%
Windows 8	3.33%
Windows 8.1 Pro	2.22%
Windows Vista Home Basic	2.22%
Windows 8 Pro with Media Center	1.67%
Windows Developer Preview	1.11%
Windows Vista Business	1.11%
Windows 8.1	0.56%
Windows 7 Enterprise	0.56%
Windows Vista Ultimate	0.56%

Distribution by country

United States installs about 22.78% of pnkbstra.exe.

Distribution by PC manufacturer

PC Manufacturer	distribution
ASUS	16.42%
Hewlett-Packard	12.69%
Acer	11.94%
Dell	10.45%
Lenovo	10.45%
GIGABYTE	8.21%
Toshiba	7.46%
Sony	5.97%
MSI	5.97%
Samsung	2.99%
Gateway	2.99%
American Megatrends	1.49%
Intel	1.49%
Alienware	1.49%

Remove Adware and Spyware Programs, FREE Download!