Should I block it?

No, this file is 100% safe to run.

Additional versions

27f1b	40.00%
0e4c4	7.50%
1428e	17.50%
e2410	5.00%
1f438	2.50%
13721	2.50%
9a386	2.50%
0066c	2.50%
7c018	2.50%
8b3fc	2.50%
19fb4	2.50%
bb67d	2.50%
cab78	2.50%
ada0d	2.50%
43cb6	2.50%
49b76	2.50%

(Note, Even Balance publishes each variation of this file with the same version, but the hashes are unique.)

Relationships

PE file structure

Show functions

Import table

advapi32.dll

CloseServiceHandle, RegQueryValueExA, RegOpenKeyExA, DeleteService, ControlService, OpenServiceA, OpenSCManagerA, StartServiceA, CreateServiceA, StartServiceCtrlDispatcherA, RegisterServiceCtrlHandlerA, RegCreateKeyExA, RegSetValueExA, SetServiceStatus, RegCloseKey

crypt32.dll

CryptDecodeObject, CertFreeCertificateContext, CryptMsgClose, CertCloseStore, CertVerifyTimeValidity, CertFindCertificateInStore, CryptMsgGetParam, CertGetNameStringA, CryptQueryObject

kernel32.dll

lstrcmpA, FileTimeToLocalFileTime, SystemTimeToFileTime, GetFileAttributesA, SetFileAttributesA, FileTimeToSystemTime, MultiByteToWideChar, FormatMessageA, lstrlenA, LocalAlloc, LocalFree, LoadLibraryA, GetProcAddress, DeviceIoControl, GetPriorityClass, GetCurrentThread, GetThreadPriority, CloseHandle, CreateFileA, GetTickCount, SetEnvironmentVariableA, CompareStringW, CompareStringA, HeapSize, SetEndOfFile, SetStdHandle, IsBadCodePtr, IsBadReadPtr, SetUnhandledExceptionFilter, InitializeCriticalSection, VirtualProtect, GetOEMCP, GetACP, GetSystemDirectoryA, CopyFileA, Sleep, GetVersionExA, GetSystemInfo, GetCurrentProcess, GetLastError, FreeLibrary, lstrcpyW, GetCurrentProcessId, ExitProcess, HeapAlloc, HeapFree, RtlUnwind, DeleteFileA, GetSystemTimeAsFileTime, WideCharToMultiByte, GetModuleHandleA, GetCommandLineA, QueryPerformanceCounter, GetCurrentThreadId, GetModuleFileNameA, TlsAlloc, SetLastError, TlsFree, TlsSetValue, TlsGetValue, LCMapStringA, LCMapStringW, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, HeapReAlloc, IsBadWritePtr, ReadFile, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, SetFilePointer, InterlockedExchange, VirtualQuery, WriteFile, FlushFileBuffers, GetTimeZoneInformation, TerminateProcess, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetStringTypeA, GetStringTypeW, GetCPInfo, GetLocaleInfoA, CreateDirectoryA

shell32.dll

SHGetFolderPathA

user32.dll

wsprintfA

wintrust.dll

WinVerifyTrust

pnkbstrb.exe

By Even Balance (Signed)

Remove pnkbstrb.exe

MD5:	ada0de76427206ada7fff462b10b8bc3
SHA1:	943da4e4332705b327811e4cea5ab7cce3fdc482
SHA256:	b80b80da10c741b981b340b410861ce9b7a0fcca3fd4ae869d956437bb931054

Overview

pnkbstrb.exe runs as a service under the name PnkBstrB with extensive SYSTEM privileges (full administrator access). It has been configured with a firewall exception which allows both inbound and outbound network communication without being blocked. This is typically installed with the program Call of Duty(R) 4 - Modern Warfare(TM) published by Activision. The file is digitally signed by Even Balance which was issued by the VeriSign certificate authority (CA).

Details

File name:	pnkbstrb.exe
Typical file path:	C:\windows\syswow64\pnkbstrb.exe
Size:	275.16 KB (281,768 bytes)
Build date:	9/13/2012 2:49 PM
Certificate
Issued to:	Even Balance
Authority (CA):	VeriSign
Digital DNA
File packed:	No
.NET CLR:	No

More details

Programs

The following program will install this file

Call of Duty 4 - Modern Warfare

Activision

5% remove

Call of Duty 4: Modern Warfare is a first-person shooter video game, developed by Infinity Ward and published by Activision. As opposed to earlier games in the Call of Duty series, the game features modern equipment and new features, many exclusive to the multiplayer part of the game, such as "killstreaks"; killing a number of enemies without the player dying in between kills allows access to various assets including airstrikes and heli...

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'PnkBstrB'

Windows firewall allowed programs

Exceptions allow programs to access to the Internet through an outbound connections

Firewall exception for 'C:\WINDOWS\system32\PnkBstrB.exe'
Firewall exception for 'C:\WINDOWS\system32\PnkBstrB.exe'

Network connections

Access through an approved Windows firewall exception

[UDP] listens on port 45301

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00013870%	0.028634%
Kernel CPU:	0.00006170%	0.013761%
User CPU:	0.00007700%	0.014873%
Kernel CPU time:	70,406 ms/min	100,923,805ms/min
Context switches:	280/sec	284/sec
Memory
Private memory:	4.99 MB	21.59 MB
Private (maximum):	432 KB
Private (minimum):	396 KB
Non-paged memory:	4.99 MB	21.59 MB
Virtual memory:	36.47 MB	140.96 MB
Virtual memory (peak):	37.75 MB	169.69 MB
Working set:	404 KB	18.61 MB
Working set (peak):	5.66 MB	37.95 MB
Page faults:	1,747/min	2,039/min
I/O
I/O read transfer:	194 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O write transfer:	55 Bytes/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	40 Bytes/sec	448.09 KB/min
I/O other operations:	1/sec	1,671/min
Resource allocations
Threads:	4	12
Handles:	137	600
GUI GDI count:	4	103
GUI USER count:	2	49

Process properties

Integrety level:	Undefined
Platform:	32-bit
Command line:	C:\Windows\System32\pnkbstrb.exe
Owner:	SYSTEM
Windows Service
Service name:	PnkBstrB
Description:	“PunkBuster Service Component [v2.304 BFP4F] http://www.evenbalance.com”
Type:	Win32OwnProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads