Should I block it?

No, this file is 100% safe to run.

Additional versions

27f1b	40.00%
0e4c4	7.50%
1428e	17.50%
e2410	5.00%
1f438	2.50%
13721	2.50%
9a386	2.50%
0066c	2.50%
7c018	2.50%
8b3fc	2.50%
19fb4	2.50%
bb67d	2.50%
cab78	2.50%
ada0d	2.50%
43cb6	2.50%
49b76	2.50%

(Note, Even Balance publishes each variation of this file with the same version, but the hashes are unique.)

Relationships

Parent process

services.exe (Services and Controller app by Microsoft)

Related files

PE file structure

Show functions

Import table

advapi32.dll

CloseServiceHandle, RegQueryValueExA, RegOpenKeyExA, DeleteService, ControlService, OpenServiceA, OpenSCManagerA, StartServiceA, CreateServiceA, StartServiceCtrlDispatcherA, RegisterServiceCtrlHandlerA, RegCreateKeyExA, RegSetValueExA, SetServiceStatus, RegCloseKey

crypt32.dll

CryptDecodeObject, CertFreeCertificateContext, CryptMsgClose, CertCloseStore, CertVerifyTimeValidity, CertFindCertificateInStore, CryptMsgGetParam, CertGetNameStringA, CryptQueryObject

kernel32.dll

lstrcmpA, FileTimeToLocalFileTime, SystemTimeToFileTime, GetFileAttributesA, SetFileAttributesA, FileTimeToSystemTime, MultiByteToWideChar, FormatMessageA, lstrlenA, LocalAlloc, LocalFree, LoadLibraryA, GetProcAddress, DeviceIoControl, GetPriorityClass, GetCurrentThread, GetThreadPriority, CloseHandle, CreateFileA, GetTickCount, SetEnvironmentVariableA, CompareStringW, CompareStringA, HeapSize, SetEndOfFile, SetStdHandle, IsBadCodePtr, IsBadReadPtr, SetUnhandledExceptionFilter, InitializeCriticalSection, VirtualProtect, GetOEMCP, GetACP, GetSystemDirectoryA, CopyFileA, Sleep, GetVersionExA, GetSystemInfo, GetCurrentProcess, GetLastError, FreeLibrary, lstrcpyW, GetCurrentProcessId, ExitProcess, HeapAlloc, HeapFree, RtlUnwind, DeleteFileA, GetSystemTimeAsFileTime, WideCharToMultiByte, GetModuleHandleA, GetCommandLineA, QueryPerformanceCounter, GetCurrentThreadId, GetModuleFileNameA, TlsAlloc, SetLastError, TlsFree, TlsSetValue, TlsGetValue, LCMapStringA, LCMapStringW, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, HeapReAlloc, IsBadWritePtr, ReadFile, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, SetFilePointer, InterlockedExchange, VirtualQuery, WriteFile, FlushFileBuffers, GetTimeZoneInformation, TerminateProcess, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetStringTypeA, GetStringTypeW, GetCPInfo, GetLocaleInfoA, CreateDirectoryA

shell32.dll

SHGetFolderPathA

user32.dll

wsprintfA

wintrust.dll

WinVerifyTrust

pnkbstrb.exe

By Even Balance (Signed)

Remove pnkbstrb.exe

MD5:	19fb4efd165577f3f3b893cacce2fc17
SHA1:	c7b29cc879566794b3e0b33530c0ffa550f81f87
SHA256:	8e45f39f081699821cf242f1d0bac32e136c6b47aafbbb9069f3f591b3a2aa5d

Overview

pnkbstrb.exe runs as a service under the name PnkBstrB with extensive SYSTEM privileges (full administrator access). It has been configured with a firewall exception which allows both inbound and outbound network communication without being blocked. The file is digitally signed by Even Balance which was issued by the VeriSign certificate authority (CA). Note, some antivirus scanners have flagged this file, however it is not necessarily considered malware (see below for details).

Details

File name:	pnkbstrb.exe
Typical file path:	C:\windows\syswow64\pnkbstrb.exe
Size:	284.27 KB (291,088 bytes)
Certificate
Issued to:	Even Balance
Authority (CA):	VeriSign
Digital DNA
File packed:	No
.NET CLR:	No

More details

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'PnkBstrB'

Windows firewall allowed programs

Exceptions allow programs to access to the Internet through an outbound connections

Firewall exception for 'C:\WINDOWS\system32\PnkBstrB.exe'
Firewall exception for 'C:\WINDOWS\system32\PnkBstrB.exe'

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00065020%	0.028634%
Kernel CPU:	0.00019874%	0.013761%
User CPU:	0.00045146%	0.014873%
Kernel CPU time:	406 ms/min	100,923,805ms/min
CPU cycles:	27,698,109/sec	17,470,203/sec
Context switches:	1,004/sec	284/sec
Memory
Private memory:	3.38 MB	21.59 MB
Private (maximum):	5.5 MB
Private (minimum):	4.91 MB
Non-paged memory:	3.38 MB	21.59 MB
Virtual memory:	49.74 MB	140.96 MB
Virtual memory (peak):	52.24 MB	169.69 MB
Working set:	5.45 MB	18.61 MB
Working set (peak):	5.5 MB	37.95 MB
Page faults:	1,602/min	2,039/min
I/O
I/O read transfer:	63 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O write transfer:	0 Bytes/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	106 Bytes/sec	448.09 KB/min
I/O other operations:	1/sec	1,671/min
Resource allocations
Threads:	4	12
Handles:	93	600

Process properties

Integrety level:	System
Platform:	64-bit
Command line:	C:\windows\syswow64\pnkbstrb.exe
Owner:	SYSTEM
Windows Service
Service name:	PnkBstrB
Description:	“PunkBuster Service Component [v2.304 BFP4F] http://www.evenbalance.com”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Distribution by Windows OS

OS version	distribution
Microsoft Windows XP	27.50%
Windows 7 Home Premium	20.00%
Windows 7 Ultimate	15.00%
Windows 7 Professional	12.50%
Windows 7 Home Basic	7.50%
Windows Developer Preview	5.00%
Windows Vista Home Premium	5.00%
Windows Vista Home Basic	5.00%
Windows 8 Pro	2.50%

Distribution by country

United States installs about 30.00% of pnkbstrb.exe.

Distribution by PC manufacturer

PC Manufacturer	distribution
Toshiba	20.00%
GIGABYTE	20.00%
ASUS	20.00%
Acer	15.00%
Lenovo	10.00%
Dell	10.00%
Hewlett-Packard	5.00%

Remove Adware and Spyware Programs, FREE Download!