File name:

Battle.net-Setup.exe

Full analysis: https://app.any.run/tasks/da9c885e-61bb-4ac0-b752-31d50391f7be
Verdict: Malicious activity
Analysis date: May 10, 2025, 04:00:19
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

F7FE24CEBBC4B0332C77BCE563E11B1D

SHA1:

744968C9193E5A1B96941695600D3770E61A6FFA

SHA256:

002F33FEE7B8A159058368B7E93E492931C4CA72E90660BDB2691BCD62FEDD3C

SSDEEP:

98304:sdpEDlZPq7VZYLwZ6SbP+04w1n+5aSdNbgl8LoA94D1PfjWEeJfZX/BufZdERaQP:jqO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Battle.net-Setup.exe (PID: 5596)
      • Battle.net-Setup.exe (PID: 4120)
      • Agent.exe (PID: 6752)
      • Agent.exe (PID: 856)
      • AgentHelper.exe (PID: 6040)

    • Application launched itself

      • Battle.net-Setup.exe (PID: 5596)

    • Potential Corporate Privacy Violation

      • Battle.net-Setup.exe (PID: 5596)
      • Battle.net-Setup.exe (PID: 4120)

    • Executable content was dropped or overwritten

      • Battle.net-Setup.exe (PID: 4120)
      • Agent.exe (PID: 856)
      • AgentHelper.exe (PID: 6040)

    • Checks for external IP

      • Battle.net-Setup.exe (PID: 4120)
      • Battle.net-Setup.exe (PID: 5596)

    • Connects to unusual port

      • Battle.net-Setup.exe (PID: 4120)
      • Battle.net-Setup.exe (PID: 5596)
      • Agent.exe (PID: 856)

    • Process drops legitimate windows executable

      • Agent.exe (PID: 856)

    • The process drops C-runtime libraries

      • Agent.exe (PID: 856)

  • INFO

    • Reads the computer name

      • Battle.net-Setup.exe (PID: 5596)
      • Battle.net-Setup.exe (PID: 4120)
      • Agent.exe (PID: 6752)
      • Agent.exe (PID: 856)
      • AgentHelper.exe (PID: 6040)

    • Checks proxy server information

      • Battle.net-Setup.exe (PID: 5596)
      • Battle.net-Setup.exe (PID: 4120)
      • Agent.exe (PID: 856)

    • Creates files in the program directory

      • Battle.net-Setup.exe (PID: 5596)
      • Battle.net-Setup.exe (PID: 4120)
      • Agent.exe (PID: 6752)
      • Agent.exe (PID: 856)
      • AgentHelper.exe (PID: 6040)

    • Checks supported languages

      • Battle.net-Setup.exe (PID: 5596)
      • Battle.net-Setup.exe (PID: 4120)
      • Agent.exe (PID: 6752)
      • Agent.exe (PID: 856)
      • AgentHelper.exe (PID: 6040)

    • Creates files or folders in the user directory

      • Battle.net-Setup.exe (PID: 5596)
      • Battle.net-Setup.exe (PID: 4120)
      • Agent.exe (PID: 856)

    • Reads the machine GUID from the registry

      • Battle.net-Setup.exe (PID: 5596)
      • Battle.net-Setup.exe (PID: 4120)
      • Agent.exe (PID: 856)
      • AgentHelper.exe (PID: 6040)

    • Reads the software policy settings

      • Battle.net-Setup.exe (PID: 5596)
      • Battle.net-Setup.exe (PID: 4120)
      • Agent.exe (PID: 856)
      • AgentHelper.exe (PID: 6040)

    • Process checks computer location settings

      • Battle.net-Setup.exe (PID: 5596)
      • Battle.net-Setup.exe (PID: 4120)
      • Agent.exe (PID: 6752)
      • Agent.exe (PID: 856)

    • The sample compiled with english language support

      • Battle.net-Setup.exe (PID: 4120)
      • Agent.exe (PID: 856)
      • AgentHelper.exe (PID: 6040)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:08:04 01:44:13+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.15
CodeSize: 2932736
InitializedDataSize: 1978368
UninitializedDataSize: -
EntryPoint: 0x13b686
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.18.10.3141
ProductVersionNumber: 1.18.10.3141
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
LegalCopyright: © 2005-2023 Blizzard Entertainment Inc.
InternalName: Battle.net Setup
FileVersion: 1.18.10.3141
CompanyName: Blizzard Entertainment
ProductName: Battle.net Setup
ProductVersion: 1.18.10.3141
FileDescription: Battle.net Setup
OriginalFileName: Battle.net-Setup.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
9
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start battle.net-setup.exe sppextcomobj.exe no specs slui.exe no specs battle.net-setup.exe agent.exe no specs agent.exe conhost.exe no specs agenthelper.exe conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
744C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
856"C:\ProgramData\Battle.net\Agent\Agent.9124\Agent.exe" --locale=enUS --session=7968814799916715449C:\ProgramData\Battle.net\Agent\Agent.9124\Agent.exe
Agent.exe
User:
admin
Company:
Blizzard Entertainment
Integrity Level:
HIGH
Description:
Battle.net Update Agent
Version:
2.38.1.9124
Modules
Images
c:\programdata\battle.net\agent\agent.9124\agent.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\wintrust.dll
4120"C:\Users\admin\AppData\Local\Temp\Battle.net-Setup.exe" --cmdver=2 --elevated --locale=enUS --mode=setup --session=7968814799916715449C:\Users\admin\AppData\Local\Temp\Battle.net-Setup.exe
Battle.net-Setup.exe
User:
admin
Company:
Blizzard Entertainment
Integrity Level:
HIGH
Description:
Battle.net Setup
Version:
1.18.10.3141
Modules
Images
c:\users\admin\appdata\local\temp\battle.net-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\rpcrt4.dll
5228\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Agent.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5324"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5596"C:\Users\admin\AppData\Local\Temp\Battle.net-Setup.exe" C:\Users\admin\AppData\Local\Temp\Battle.net-Setup.exe
explorer.exe
User:
admin
Company:
Blizzard Entertainment
Integrity Level:
MEDIUM
Description:
Battle.net Setup
Exit code:
0
Version:
1.18.10.3141
Modules
Images
c:\users\admin\appdata\local\temp\battle.net-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\rpcrt4.dll
6028\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—AgentHelper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6040"C:\ProgramData\Battle.net\Agent\AgentHelper.exe" --install --target=C:/ProgramData/Battle.net_components/battlenet_helpersvc/AgentHelper.exeC:\ProgramData\Battle.net\Agent\AgentHelper.exe
Agent.exe
User:
admin
Company:
Blizzard Entertainment
Integrity Level:
HIGH
Description:
Battle.net Admin Agent
Exit code:
0
Version:
2.38.1.9124
Modules
Images
c:\programdata\battle.net\agent\agenthelper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6752"C:\ProgramData\Battle.net\Agent\Agent.exe" --locale=enUS --session=7968814799916715449C:\ProgramData\Battle.net\Agent\Agent.exe—Battle.net-Setup.exe
User:
admin
Company:
Blizzard Entertainment
Integrity Level:
HIGH
Description:
Battle.net File Switcher
Exit code:
0
Version:
2.38.1.9124
Modules
Images
c:\programdata\battle.net\agent\agent.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
15 115
Read events
15 113
Write events
2
Delete events
0

Modification events

(PID) Process:(5596) Battle.net-Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Blizzard Entertainment\Blizzard Error
Operation:writeName:UserUUID
Value:
A0E44B1F-6086-41D8-9334-B070199B1CE7
(PID) Process:(5596) Battle.net-Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Blizzard Entertainment\Launcher
Operation:writeName:Locale
Value:
enUS
Executable files
139
Suspicious files
364
Text files
37
Unknown types
0

Dropped files

PID
Process
Filename
Type
5596Battle.net-Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_B717F9EACC1FD87B066F7B1136975CF6binary
MD5:058E52EFFF5947C234A2C9B795A85B39
SHA256:5F6893FD278B2A528B8008805842956D10819C3307B82E8329BF99538C6048EA
5596Battle.net-Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5binary
MD5:74A8419ADBD9D1651F6FE02DF6659754
SHA256:510296268B1A16FD9B38CD1AA307EF12821D7E8CFC3D9AC9DCF16D2E9BCE2507
5596Battle.net-Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5binary
MD5:2B4254882655885B4EC4DF341A2FF514
SHA256:FAEC367C154F2EB9F2D457B3EA11C13B8B55E24AB76689DE6196357C22B0396B
4120Battle.net-Setup.exeC:\ProgramData\Battle.net\Agent\.Blizzard Uninstaller.exe.13.4120.tempexecutable
MD5:B8BB284B7CD26643DF6876D665FBDE02
SHA256:117420F75D1D5DB1B3908E0728F748198D37894AF980F7614226480C7DD7BAEB
5596Battle.net-Setup.exeC:\ProgramData\Battle.net\Setup\bna_2\Logs\battle.net-setup-20250510T040026.logtext
MD5:16D0F888F2A2DCE77A1CA7D38C11A3C3
SHA256:0B7728A2F62927FFE3C46D0D920CE5AB7B18690899A509293E5F0405263DA81B
5596Battle.net-Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_B717F9EACC1FD87B066F7B1136975CF6binary
MD5:1947E7A6C66F5592EA16C0D9D079D146
SHA256:13BBD96032497418D0A4CF5B3C366776628B5FD452DAA1999F8EA4D28A724980
4120Battle.net-Setup.exeC:\ProgramData\Battle.net\Agent\.Blizzard Uninstaller.exe.11.4120.tempbinary
MD5:39BDB3BFAF3ED89FAD4865E7C70BCA6E
SHA256:44EBF0CB8E9E3148A57E8767D3A0EAA46CD0180137237B7771FB62E2E9E75DD8
4120Battle.net-Setup.exeC:\ProgramData\Battle.net\Setup\bna_2\Logs\battle.net-setup-20250510T040034.logtext
MD5:7DBDCE4227B263D35FF27DD1EB783462
SHA256:8558ADBC9E2CD9C8CA57E4C611DC0C26B7535487D369EC0F2EA52F46A5A30B7A
4120Battle.net-Setup.exeC:\ProgramData\Battle.net\Agent\..LICENSES.14.4120.temp.15.4120.temp.temptext
MD5:835AE7FB6E7733264A44F792CA33FB2B
SHA256:7CB852F64FB8C7BDE31B53CF7BD5C68EC50EBA128054DD3646C8A2C73B331162
4120Battle.net-Setup.exeC:\ProgramData\Battle.net\Agent\..Blizzard Uninstaller.exe.11.4120.temp.12.4120.tempexecutable
MD5:B8BB284B7CD26643DF6876D665FBDE02
SHA256:117420F75D1D5DB1B3908E0728F748198D37894AF980F7614226480C7DD7BAEB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
240
TCP/UDP connections
101
DNS requests
19
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.16:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5596
Battle.net-Setup.exe
POST
—
66.40.185.57:3724
http://iir.blizzard.com:3724/submit/BNET_APP
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5596
Battle.net-Setup.exe
GET
204
54.76.212.57:80
http://nydus.battle.net/geoip
unknown
—
—
whitelisted
5596
Battle.net-Setup.exe
POST
—
66.40.185.57:3724
http://iir.blizzard.com:3724/submit/BNET_APP
unknown
—
—
whitelisted
5596
Battle.net-Setup.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAxEIEg8DxEkiqu7bqioboI%3D
unknown
—
—
whitelisted
5596
Battle.net-Setup.exe
POST
—
66.40.185.57:3724
http://iir.blizzard.com:3724/submit/BNET_APP
unknown
—
—
whitelisted
5596
Battle.net-Setup.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D
unknown
—
—
whitelisted
4120
Battle.net-Setup.exe
GET
200
137.221.106.28:1119
http://us.patch.battle.net:1119/bts/versions
unknown
—
—
whitelisted
4120
Battle.net-Setup.exe
GET
200
137.221.106.28:1119
http://us.patch.battle.net:1119/agent/versions
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.16:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5596
Battle.net-Setup.exe
54.76.212.57:80
nydus.battle.net
AMAZON-02
IE
whitelisted
5596
Battle.net-Setup.exe
66.40.185.57:3724
iir.blizzard.com
—
US
whitelisted
5596
Battle.net-Setup.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4120
Battle.net-Setup.exe
54.76.212.57:80
nydus.battle.net
AMAZON-02
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.216.77.16
  • 23.216.77.38
  • 23.216.77.41
  • 23.216.77.15
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.186.78
whitelisted
nydus.battle.net
  • 54.76.212.57
  • 52.30.60.10
whitelisted
iir.blizzard.com
  • 66.40.185.57
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
us.patch.battle.net
  • 137.221.106.28
whitelisted
level3.blizzard.com
  • 23.48.23.25
  • 23.48.23.9
whitelisted
us.cdn.blizzard.com
  • 137.221.64.5
  • 137.221.64.7
  • 137.221.64.3
  • 137.221.64.6
  • 137.221.64.1
  • 137.221.64.2
  • 137.221.64.4
  • 137.221.64.8
whitelisted

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET INFO GeoIP Lookup (nydus.battle.net)
—
—
Potential Corporate Privacy Violation
ET INFO GeoIP Lookup (nydus.battle.net)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Battle.net-Setup.exe