Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/11/2026, 18:05

General

  • Target
    暗黑破坏神不朽电脑版战网版Battle.net-Setup-CN.exe
  • Size 4.7MB
  • Sample261110-wpfaqszy6k
  • SHA256 dca359dfa8266695fc8911c5b182146a5e63fb55f2edb66af63845e2e87ee0c1
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

    Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

  • Embeds OpenSSL 2 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\暗黑破坏神不朽电脑版战网版Battle.net-Setup-CN.exe
    "C:\Users\Admin\AppData\Local\Temp\暗黑破坏神不朽电脑版战网版Battle.net-Setup-CN.exe"
    1⤵
    • Checks computer location settings
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3324
    • C:\ProgramData\Battle.net\Setup\bna_2\Battle.net-Setup.exe
      "C:\ProgramData\Battle.net\Setup\bna_2\Battle.net-Setup.exe" --cmdver=2 --locale=zhCN --mode=setup --processpath=C:\Users\Admin\AppData\Local\Temp\暗黑破坏神不朽电脑版战网版Battle.net-Setup-CN.exe --region=CN --session=16567896044327947604
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Direct Volume Access: Opens a physical disk for reading
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2820
      • C:\ProgramData\Battle.net\Agent\Agent.exe
        "C:\ProgramData\Battle.net\Agent\Agent.exe" --locale=zhCN --session=16567896044327947604
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:808
        • C:\ProgramData\Battle.net\Agent\Agent.9852\Agent.exe
          "C:/ProgramData/Battle.net/Agent/Agent.9852/Agent.exe" "--locale=zhCN" "--session=16567896044327947604"
          4⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          PID:5656

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        .product.db

        • Path C:\ProgramData\Battle.net\Agent\.product.db
        • Size 193B
        • SHA256 ed5bc248ac6560c17beba17bf0c2129e6a748ba9c0796fbdf94bf51f5e28fd5b
        • MD5 SHA1 SHA512 TLSH

        Agent.exe

        • Path C:\ProgramData\Battle.net\Agent\Agent.9852\Agent.exe
        • Size 7.0MB
        • SHA256 ee5ef234ebe83004fff9e2937b60862436c698ed8908e89335fa105d80f3d630
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Agent-20261110T180606.log

        • Path C:\ProgramData\Battle.net\Agent\Agent.9852\Logs\Agent-20261110T180606.log
        • Size 4KB
        • SHA256 597a2af8e9b656138371d5b2994334f6572eb55734e0e4caa200ad69ff8ca78a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Agent-20261110T180606.log

        • Path C:\ProgramData\Battle.net\Agent\Agent.9852\Logs\Agent-20261110T180606.log
        • Size 878B
        • SHA256 100ca3aae5fd376f124ba0055ae04f811cee1728a69a248f6eef745f43744835
        • MD5 SHA1 SHA512 TLSH

        AgentErrors-20261110T180606.log

        • Path C:\ProgramData\Battle.net\Agent\Agent.9852\Logs\AgentErrors-20261110T180606.log
        • Size 317B
        • SHA256 19609f1e8b36c616b9e45b54db342cb90c0c85216ee30ad769a0d7f59f1876e6
        • MD5 SHA1 SHA512 TLSH

        AgentErrors-20261110T180606.log

        • Path C:\ProgramData\Battle.net\Agent\Agent.9852\Logs\AgentErrors-20261110T180606.log
        • Size 2KB
        • SHA256 564f87bce331e2f9516d45004df78b0a190ce0ef7847841b365e03b88e0fd6de
        • MD5 SHA1 SHA512 TLSH

        AgentErrors-20261110T180606.log

        • Path C:\ProgramData\Battle.net\Agent\Agent.9852\Logs\AgentErrors-20261110T180606.log
        • Size 4KB
        • SHA256 d5e7ab336ccc8ea3472e1fc4638389516c435cae673363ca3fa24ec58776c094
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Features-20261110T180606.log

        • Path C:\ProgramData\Battle.net\Agent\Agent.9852\Logs\Features-20261110T180606.log
        • Size 91B
        • SHA256 13227d9fbd571ccde1fe4342f6db1bd5169874e501dbe8a2bbf6326e0588f1c2
        • MD5 SHA1 SHA512 TLSH

        Operations-20261110T180606.log

        • Path C:\ProgramData\Battle.net\Agent\Agent.9852\Logs\Operations-20261110T180606.log
        • Size 159B
        • SHA256 861cbbb8392e1104a72e25064cf7317ff70b21d3ab92a1a703036e2e7c7c3492
        • MD5 SHA1 SHA512 TLSH

        Version-20261110T180606.log

        • Path C:\ProgramData\Battle.net\Agent\Agent.9852\Logs\Version-20261110T180606.log
        • Size 480B
        • SHA256 0388e839fe123bc201bb0186b45e5f0de32a8a74aaf3563161c1139953ff6e80
        • MD5 SHA1 SHA512 TLSH

        Version-20261110T180606.log

        • Path C:\ProgramData\Battle.net\Agent\Agent.9852\Logs\Version-20261110T180606.log
        • Size 800B
        • SHA256 15eaf26c52da63ab8cafc2587202e983b3a9bb02116f5a75819893d6251c5eb1
        • MD5 SHA1 SHA512 TLSH

        bc-20261110T180606.log

        • Path C:\ProgramData\Battle.net\Agent\Agent.9852\Logs\bc-20261110T180606.log
        • Size 2KB
        • SHA256 60f65c88121f76ff8cfc1ad9ca8ea831c4a810a767ca5e0222eefcac309e1fd1
        • MD5 SHA1 SHA512 TLSH

        bc-20261110T180606.log

        • Path C:\ProgramData\Battle.net\Agent\Agent.9852\Logs\bc-20261110T180606.log
        • Size 1KB
        • SHA256 9c8c797108df79be14632f208b89074b6169b76f6cea3198deff5bbe3b90579e
        • MD5 SHA1 SHA512 TLSH

        telemetry-20261110T180606.log

        • Path C:\ProgramData\Battle.net\Agent\Agent.9852\Logs\telemetry-20261110T180606.log
        • Size 444B
        • SHA256 9ebb594f00c7a0dfc7764418035c96d59aeb818de824d2937cad1ab7f2741e36
        • MD5 SHA1 SHA512 TLSH

        Agent.dat

        • Path C:\ProgramData\Battle.net\Agent\Agent.dat
        • Size 5B
        • SHA256 ff45d2771ed5442c59f7fb0013f691ca820619fea4964f305eb331466a65a9a5
        • MD5 SHA1 SHA512

        Agent.exe

        • Path C:\ProgramData\Battle.net\Agent\Agent.exe
        • Size 528KB
        • SHA256 effdeea7930f5284b0b14d2768ad5b1807d52ae2023d003362f05336982ec4b8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AgentHelper.exe

        • Path C:\ProgramData\Battle.net\Agent\AgentHelper.exe
        • Size 3.5MB
        • SHA256 88d9ad664b89526a439515ccf2b742a8e74c301782ffd8d31fba5d47594e3059
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Blizzard Uninstaller.exe

        • Path C:\ProgramData\Battle.net\Agent\Blizzard Uninstaller.exe
        • Size 2.4MB
        • SHA256 84bd6e776da568bc002218890058ecd9a359777389a58d4147468563d1abe3c0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        BlizzardError.exe

        • Path C:\ProgramData\Battle.net\Agent\BlizzardError.exe
        • Size 877KB
        • SHA256 be2394ff7880e403a92ad773c675295a47e9fafe330f01df21fc886f5383b21a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LICENSES

        • Path C:\ProgramData\Battle.net\Agent\LICENSES
        • Size 11KB
        • SHA256 7cb852f64fb8c7bde31b53cf7bd5c68ec50eba128054dd3646c8a2c73b331162
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0000000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\agent\0000000001.idx
        • Size 128KB
        • SHA256 2ae23ee9b318d520edbf129daf0850c8d44fff4212e67bae1d7084923579a564
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0000000002.idx

        • Path C:\ProgramData\Battle.net\Agent\data\agent\0000000002.idx
        • Size 128KB
        • SHA256 4e3918073111827794658c18d83d2b66c71779643f0587a2ac6f5064b9d0cd03
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0100000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\agent\0100000001.idx
        • Size 128KB
        • SHA256 820ed1e6a174d77c6d76b172a0e1e5224c6db6cdaeabfc7fac6d7777f359fa29
        • MD5 SHA1 SHA512 SSDEEP

        0200000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\agent\0200000001.idx
        • Size 128KB
        • SHA256 d18a5cda2d5fcc89d376c68ff0ff72bffb56e566c29b43026998c752299262d1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0200000002.idx

        • Path C:\ProgramData\Battle.net\Agent\data\agent\0200000002.idx
        • Size 128KB
        • SHA256 900eecb5d2ec0b2cd5a7040bcfc7a5a7d11d99a7da286c62a27a603d7ba6a28f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0300000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\agent\0300000001.idx
        • Size 128KB
        • SHA256 48d6166420cffe70b2c41ff0d4579633fc98ae02fdf2ce27ff0979581b724c74
        • MD5 SHA1 SHA512 SSDEEP

        0400000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\agent\0400000001.idx
        • Size 128KB
        • SHA256 1a898a393356dc9df435c7ee4175734a5a2ac7a383586a90d39c14064448b229
        • MD5 SHA1 SHA512 SSDEEP

        0500000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\agent\0500000001.idx
        • Size 128KB
        • SHA256 d0332cddaa876b746f4efe41b5710bc46c983f76487850374f0287e096f38080
        • MD5 SHA1 SHA512 SSDEEP

        0600000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\agent\0600000001.idx
        • Size 128KB
        • SHA256 0ba320dbc56e73ef51b513d1c847785f53787521e5d7e68b48f1e67be17c4fd5
        • MD5 SHA1 SHA512 SSDEEP

        0700000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\agent\0700000001.idx
        • Size 128KB
        • SHA256 ce6c4a07087f0092d2fcfcfea05db5d8e5716d852ae4ae4668bc6b7637e36b8d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0700000002.idx

        • Path C:\ProgramData\Battle.net\Agent\data\agent\0700000002.idx
        • Size 128KB
        • SHA256 300a3a56c3e9d2b78033d119aca5df17e491ce41294f05a9d775ed1ad62ef93a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0800000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\agent\0800000001.idx
        • Size 128KB
        • SHA256 c17dab7465854240b269f28cc74f4826b48961f0b826a3b36b9411a40e3df08c
        • MD5 SHA1 SHA512 SSDEEP

        0900000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\agent\0900000001.idx
        • Size 128KB
        • SHA256 806f9681d7072e741e667082759461e768acc7ae2d3b13aa47562291d4fab1ee
        • MD5 SHA1 SHA512 SSDEEP

        0a00000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\agent\0a00000001.idx
        • Size 128KB
        • SHA256 1f172f3493ec49d4e76d81e6ef73856e1c345be794f1004201876a60df3097db
        • MD5 SHA1 SHA512 SSDEEP

        0b00000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\agent\0b00000001.idx
        • Size 128KB
        • SHA256 6a3ef7b0b913fcf9011461bc44a9bbdd8f5f3523b92705cbeb5eb625247aeb98
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0b00000002.idx

        • Path C:\ProgramData\Battle.net\Agent\data\agent\0b00000002.idx
        • Size 128KB
        • SHA256 7b97d7b6bec877e96b863cafc3f8d2862754a03b4ecf864dae1dd0ebd4f38761
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0c00000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\agent\0c00000001.idx
        • Size 128KB
        • SHA256 faa673d515b5d29de957ec609edd5a854066a0f731a5981bbf6b1d40e9076117
        • MD5 SHA1 SHA512 SSDEEP

        0d00000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\agent\0d00000001.idx
        • Size 128KB
        • SHA256 c09f6c15ed5a168286a681d9e8f3313a87f1a0386bb20013894ebaa412329899
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0d00000002.idx

        • Path C:\ProgramData\Battle.net\Agent\data\agent\0d00000002.idx
        • Size 128KB
        • SHA256 067da62516843a940d59f1a9634f6d7199a92394a043a1024b24aa0d2ac2fcbc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0e00000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\agent\0e00000001.idx
        • Size 128KB
        • SHA256 0b6e2e4e520a2c388e0930d3313f6668ca5cd0055379af5b729f1995d32b7518
        • MD5 SHA1 SHA512 SSDEEP

        0f00000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\agent\0f00000001.idx
        • Size 128KB
        • SHA256 22958835248f9b1b1223a84af0c0b567d5a25704cc6f2b7dde35713ae0a654de
        • MD5 SHA1 SHA512 SSDEEP

        bf4bddf3db7a5e2eb9f36b9304b47816

        • Path C:\ProgramData\Battle.net\Agent\data\cache\bf\4b\bf4bddf3db7a5e2eb9f36b9304b47816
        • Size 7KB
        • SHA256 db090aaadd0bd59615e6209075795ae377adaa3abf7954e06b4483aba83e7542
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cdn-agent-3433090

        • Path C:\ProgramData\Battle.net\Agent\data\cache\cdn-agent-3433090
        • Size 1KB
        • SHA256 4a5a67e6d7ebc02f2bbbd8060614889d8f57ae2bd5d85445aa686ea0ff7343c4
        • MD5 SHA1 SHA512 TLSH

        cdn-bts-2248514

        • Path C:\ProgramData\Battle.net\Agent\data\cache\cdn-bts-2248514
        • Size 771B
        • SHA256 996cec1cf904d298550ea073b5b15287ed9dc29d2afaabf830b16bf2ab66e082
        • MD5 SHA1 SHA512 TLSH

        e8a9e3b2b36cc844d7a26a18fce57792

        • Path C:\ProgramData\Battle.net\Agent\data\cache\e8\a9\e8a9e3b2b36cc844d7a26a18fce57792
        • Size 308B
        • SHA256 861e375dcdfe06f23998a42e9c9d2204d3dae197bcfac37d6ce54284e7a4a2a3
        • MD5 SHA1 SHA512 TLSH

        summary--4129030

        • Path C:\ProgramData\Battle.net\Agent\data\cache\summary--4129030
        • Size 25KB
        • SHA256 d722ed390602f3f5e9a6c17d34a10d78e53cc99c70cb20b6efc0847a67db5751
        • MD5 SHA1 SHA512 SSDEEP TLSH

        version-agent-4100163

        • Path C:\ProgramData\Battle.net\Agent\data\cache\version-agent-4100163
        • Size 742B
        • SHA256 a5cd6fb6b468c6df67dfd85204d04c20d441e3021ff0d0db0bd13629cd182617
        • MD5 SHA1 SHA512 TLSH

        version-bts-4080386

        • Path C:\ProgramData\Battle.net\Agent\data\cache\version-bts-4080386
        • Size 3KB
        • SHA256 feff22b93130b7b86f1a875ce10c42fa97d1a9fac702a5f5a802c8f0e75a92c4
        • MD5 SHA1 SHA512 TLSH

        26000534d51b737e111bd408814c836d

        • Path C:\ProgramData\Battle.net\Agent\data\config\26\00\26000534d51b737e111bd408814c836d
        • Size 804B
        • SHA256 4c902db30f6fd6574c2642d4f1ecd401d61bf4d7f4aec5f23f595094c11e3e1b
        • MD5 SHA1 SHA512 TLSH

        c4638fcc6561eeedafcd32f3abcdb0f3

        • Path C:\ProgramData\Battle.net\Agent\data\config\c4\63\c4638fcc6561eeedafcd32f3abcdb0f3
        • Size 857B
        • SHA256 36ababa24d5c41f8177fa71e6ecebc190cee35702989b5afc0e2e066628cf281
        • MD5 SHA1 SHA512 TLSH

        0000000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0000000001.idx
        • Size 64KB
        • SHA256 8bf77290a80ebc5b01e2db5a4a9bffd3b894e5c1a70861e6182ec24993d05c42
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0000000002.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0000000002.idx
        • Size 64KB
        • SHA256 cb00016d6d37e506cf57030a96cd9c02f28fc9bc963ab3f3f712f63787f35aa4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0100000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0100000001.idx
        • Size 64KB
        • SHA256 8bd3d1cccb32edeba39f57a6ee9ddaf7934fa3af5bace9e9ad8170fe54ad50de
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0100000002.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0100000002.idx
        • Size 64KB
        • SHA256 bf817205c1f4d5e655a6caf5bb90d68e28ac6d92bf37dc723bff45557da81091
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0200000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0200000001.idx
        • Size 64KB
        • SHA256 230bd0f3f25a0bf4ab68b1daaaa36cf2b49dcfce13554d16657278eb7f2408ef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0200000002.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0200000002.idx
        • Size 64KB
        • SHA256 de413b4487ab9b4bc000c7b1bd91bb710927679fa23219e18050ab691be7777a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0300000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0300000001.idx
        • Size 64KB
        • SHA256 fb7cea3580c4eb90d4a1108b3d25faeea4c0975c1f5710ef1b6a73ef566b3bc0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0300000002.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0300000002.idx
        • Size 64KB
        • SHA256 6b28b364dca614c79a9de387b128efcb7275676afd3e961140dab11494c823b7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0400000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0400000001.idx
        • Size 64KB
        • SHA256 be838a39700025b57fd4705d59b83ea7e4f433d8cdd4b95891c37257efeff0df
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0400000002.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0400000002.idx
        • Size 64KB
        • SHA256 dacf76c74891794793d270d369304f4ca8c87dac4e1f294c214c4a6eee8c2a8c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0500000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0500000001.idx
        • Size 64KB
        • SHA256 b71056ff8b636e32d631d800ae3e472899a3e0870bbd1ff3f33af00ec03194f9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0500000002.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0500000002.idx
        • Size 64KB
        • SHA256 b495bfa50a7ae7ad79d4fe8eb6bda55d4996a58159b3df8c6b51e943a28b8fea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0600000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0600000001.idx
        • Size 64KB
        • SHA256 d0eeebd6f5c637a215008560232f4b8cd40bc9bf18878a43cc46a27b4aad8798
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0600000002.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0600000002.idx
        • Size 64KB
        • SHA256 2340c1980ab5abe0772d49eac973b6525c79155c02f99a274babf02a44d8177b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0700000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0700000001.idx
        • Size 64KB
        • SHA256 de033d63a328cb2c7ac839e30c35183a8bb243e2de25e8996b923e08dcdaad0b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0700000002.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0700000002.idx
        • Size 64KB
        • SHA256 8a9138eff4853e48939ab69d934abb3e9b78568b02b19f196c67a6f10d0dd133
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0700000003.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0700000003.idx
        • Size 64KB
        • SHA256 41176809c9d9d738b59eece2bca75c7360ac163ee6a66c9c8132c98c23507420
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0700000004.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0700000004.idx
        • Size 64KB
        • SHA256 05d61d9221fa28f086fd9ae3084399f5df33555a8bcbcb7524151c5136424cb2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0700000005.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0700000005.idx
        • Size 64KB
        • SHA256 6313f1adbb87e974e3df162e3342bc3e7b7e5a7a7584780357be833e71cd27b5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0700000006.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0700000006.idx
        • Size 64KB
        • SHA256 2b3b13549a30d33b988e196ba1bd48c9fb06d8f24ff71d81e435f51c4beba256
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0800000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0800000001.idx
        • Size 64KB
        • SHA256 aafdf62b04e14b67c3172ea7695deba89542d517debdc89aa6feb1400be52fe8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0800000002.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0800000002.idx
        • Size 64KB
        • SHA256 f6e4b9046252b1f7c2dea9b9122f330c8aa5dc94c6b8af047f5b1a5e5a48233a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0900000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0900000001.idx
        • Size 64KB
        • SHA256 ad9599782e17aaddfd62d9ad74652f633de43b54f7e50d149d89f7836c4b93d3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0900000002.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0900000002.idx
        • Size 64KB
        • SHA256 43ee821b4184cb1de15b6af13f30b21f479c6a78812e07e043b1094a8aadb6b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0a00000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0a00000001.idx
        • Size 64KB
        • SHA256 75bb45b08bf99334be1f32a3046f5505f4bd563bda86ee481965200d1fe21287
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0a00000002.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0a00000002.idx
        • Size 64KB
        • SHA256 f68d0fd4e5b8aa79fbb014714435ecd519c478c04219bbb46caaaa21270ebc3d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0b00000002.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0b00000002.idx
        • Size 64KB
        • SHA256 8dcc74e72f73e4dc93de6f9349a3159ad0e4f41c2deaa13f124a270b5b535d1b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0b00000003.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0b00000003.idx
        • Size 64KB
        • SHA256 25c9af5e611dbfb8eac60af230d8ae163b18167ac2cd82114ba89bf5addb006f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0b00000004.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0b00000004.idx
        • Size 64KB
        • SHA256 428e2c90e345fd42219fff691dca9b1d93b322c23eff1aefa6d84704d813a113
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0c00000002.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0c00000002.idx
        • Size 64KB
        • SHA256 c6abeacdb1e6f10e0ac4c9644e1dbdd5d506be7227003dcd238172521a4f7eb4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0d00000002.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0d00000002.idx
        • Size 64KB
        • SHA256 8f3c587ad7e70f4053586ea6d19a26acc5f8ff6703d8c333a0ffb24cddad890d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0e00000002.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0e00000002.idx
        • Size 64KB
        • SHA256 8580faee68a548359cdcd733d9ecb5da5a4172464bfe4a7cd2fc9d13a2e24495
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0e00000003.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0e00000003.idx
        • Size 64KB
        • SHA256 10c3dcbfe692982d1a31070a65c48034f363d63859388bb95f1886c38017001b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0e00000004.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0e00000004.idx
        • Size 64KB
        • SHA256 9eaddb721abaf9b3e03591aea4b81533bfa56839c7628b85595156917842296b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0f00000002.idx

        • Path C:\ProgramData\Battle.net\Agent\data\data\0f00000002.idx
        • Size 64KB
        • SHA256 0e7ecb4ef6e361c3a469bbc93e91f19181c6bc224ca0c3918722cbafbb58c324
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0000000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\ecache\0000000001.idx
        • Size 64KB
        • SHA256 70fe0d11bb289a8fc7fd8df2879453f7cff8d6a051005c0a372a70e646f320f4
        • MD5 SHA1 SHA512 SSDEEP

        0100000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\ecache\0100000001.idx
        • Size 64KB
        • SHA256 1643f0d04013760727739399fcd533602edc8a1c1b765fa4b0c43a74d80f8623
        • MD5 SHA1 SHA512 SSDEEP

        0200000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\ecache\0200000001.idx
        • Size 64KB
        • SHA256 59e9196ac1eccb457924bbb42edbed455fd30a775bce0263bf99c61d0e7f10b9
        • MD5 SHA1 SHA512 SSDEEP

        0300000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\ecache\0300000001.idx
        • Size 64KB
        • SHA256 cac0c466467146095ebfc8aeecfd307b588e88f1d86cd3119f8c6218a46b7853
        • MD5 SHA1 SHA512 SSDEEP

        0400000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\ecache\0400000001.idx
        • Size 64KB
        • SHA256 a26b1a46f3474b32702cdd203385fcd83f8cc9cc7de08e3ebdf07263f1b6f764
        • MD5 SHA1 SHA512 SSDEEP

        0500000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\ecache\0500000001.idx
        • Size 64KB
        • SHA256 b152cd7eea8c94caf78e1f9ee5e72dd2480ec40bc4d27371edb3da3852b16a44
        • MD5 SHA1 SHA512 SSDEEP

        0600000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\ecache\0600000001.idx
        • Size 64KB
        • SHA256 2820b0c778c10b4813932efc3354ce8a4a3d47aa72cb0ebfc12d5be585bc555e
        • MD5 SHA1 SHA512 SSDEEP

        0700000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\ecache\0700000001.idx
        • Size 64KB
        • SHA256 95672a87ef6d52783674345d0fe9422c33265cacd6fed655ad2958f18fef91fa
        • MD5 SHA1 SHA512 SSDEEP

        0800000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\ecache\0800000001.idx
        • Size 64KB
        • SHA256 196bbf174509cc80e98479a2e65cfb7ca97aa26eb6539fd8a739119f8d27d6fc
        • MD5 SHA1 SHA512 SSDEEP

        0900000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\ecache\0900000001.idx
        • Size 64KB
        • SHA256 75c0db968bfbc0a91bf669c8aa4d612be5c684607f62eb06962f3ff207fce889
        • MD5 SHA1 SHA512 SSDEEP

        0a00000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\ecache\0a00000001.idx
        • Size 64KB
        • SHA256 5937741ae3d5a2a2efacf65b7deab513070cbbea176a46617ddcc2e2e4b0f7b8
        • MD5 SHA1 SHA512 SSDEEP

        0b00000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\ecache\0b00000001.idx
        • Size 64KB
        • SHA256 3f1d90a4d2c7e1e65007c0044c6fed405dae4d6dabcf67031e1e7d3f32bf492b
        • MD5 SHA1 SHA512 SSDEEP

        0c00000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\ecache\0c00000001.idx
        • Size 64KB
        • SHA256 732ea83e632861d1ac548cabbb4d662661322db5637df0fa3ebc2406250b7e65
        • MD5 SHA1 SHA512 SSDEEP

        0d00000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\ecache\0d00000001.idx
        • Size 64KB
        • SHA256 4cce5a44e4e2335e97a666ebd40704f08fb6203e7a7f98ae8142d017ba6d8eb2
        • MD5 SHA1 SHA512 SSDEEP

        0e00000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\ecache\0e00000001.idx
        • Size 64KB
        • SHA256 490aca1e72e5be850677032ff71b0ea33ba6de9145379cb8dd1a4af4a95ed32c
        • MD5 SHA1 SHA512 SSDEEP

        0f00000001.idx

        • Path C:\ProgramData\Battle.net\Agent\data\ecache\0f00000001.idx
        • Size 64KB
        • SHA256 6b61a81b0a3eebc6f1183683b4ea0f9872344851a6e40c87bef4016e3ce40068
        • MD5 SHA1 SHA512 SSDEEP

        20e9207c7c8569f29ac05eb9a190eea1.index

        • Path C:\ProgramData\Battle.net\Agent\data\indices\20e9207c7c8569f29ac05eb9a190eea1.index
        • Size 48KB
        • SHA256 6dbb52ccd1b52dbd009f79617017b6595074f74df3afae77256d000cd6193396
        • MD5 SHA1 SHA512 SSDEEP TLSH

        2baf5f9cb1df3a44fcbd1392a7a17618.index

        • Path C:\ProgramData\Battle.net\Agent\data\indices\2baf5f9cb1df3a44fcbd1392a7a17618.index
        • Size 32KB
        • SHA256 b086f02436b5592c1a5a348e911a2e879f1af189bed3ad559975cde99b8e74d9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        349846ef38c2de9088dde1283f10dd47.index

        • Path C:\ProgramData\Battle.net\Agent\data\indices\349846ef38c2de9088dde1283f10dd47.index
        • Size 16KB
        • SHA256 5cf9a87f6d5b94299e0ed06d9d030a10e1ed9f32e2f26a9b1ada9f48a1a55737
        • MD5 SHA1 SHA512 SSDEEP TLSH

        5005e458fb185f626300613198230f38.index

        • Path C:\ProgramData\Battle.net\Agent\data\indices\5005e458fb185f626300613198230f38.index
        • Size 8KB
        • SHA256 70a1fe052406f47d56a4c6f496597eaf2108da423e8b489e58d347c45ef2b5f3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        57042e35e867cb479db7bb1176394bef.index

        • Path C:\ProgramData\Battle.net\Agent\data\indices\57042e35e867cb479db7bb1176394bef.index
        • Size 8KB
        • SHA256 8c349166deb26d9bef7ccf1641cadbbc298e9a35af2e7a4a68f544aa7f05961f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        67b6527eacfa180bef9e04a8c4970d04.index

        • Path C:\ProgramData\Battle.net\Agent\data\indices\67b6527eacfa180bef9e04a8c4970d04.index
        • Size 4KB
        • SHA256 b346296485ef06b11959ee53577366ec52fd6f3fa004ba84318a90f44f4ffab1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        6b52d25e899384072f852060f24d58ba.index

        • Path C:\ProgramData\Battle.net\Agent\data\indices\6b52d25e899384072f852060f24d58ba.index
        • Size 12KB
        • SHA256 f7ed2c30542f6c44dc64c344cec6692f234a5af829ced9783473e7890002d36c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7203c0a12fcd2f324ca03e5c6ecd4a83.index

        • Path C:\ProgramData\Battle.net\Agent\data\indices\7203c0a12fcd2f324ca03e5c6ecd4a83.index
        • Size 24KB
        • SHA256 07fc4cbe514fe5d2ab3404b6e6668012b94eff0beb8c193354006ab247232190
        • MD5 SHA1 SHA512 SSDEEP TLSH

        793825bfc6ac39f9907800a8fa4a3e24.index

        • Path C:\ProgramData\Battle.net\Agent\data\indices\793825bfc6ac39f9907800a8fa4a3e24.index
        • Size 12KB
        • SHA256 d6cd01ffce27f8d13deb60dfd3e2aba76e38aced23d23bcf70a57567c83f8402
        • MD5 SHA1 SHA512 SSDEEP TLSH

        8a50cfd62ec1a8ec459e3f37e0adc7a2.index

        • Path C:\ProgramData\Battle.net\Agent\data\indices\8a50cfd62ec1a8ec459e3f37e0adc7a2.index
        • Size 8KB
        • SHA256 dab69af53ae8412ac59f4cd233022df76e569053de88be73569e871d5bbffa34
        • MD5 SHA1 SHA512 SSDEEP TLSH

        9d080a5be26c96356788058163a8879d.index

        • Path C:\ProgramData\Battle.net\Agent\data\indices\9d080a5be26c96356788058163a8879d.index
        • Size 12KB
        • SHA256 f5feef2b43b6c2b5f88961c467c682600b9312af82f4bb8528b6c6e98ac66425
        • MD5 SHA1 SHA512 SSDEEP TLSH

        9dfa9b7f52b0733254864a3dda1d63e2.index

        • Path C:\ProgramData\Battle.net\Agent\data\indices\9dfa9b7f52b0733254864a3dda1d63e2.index
        • Size 16KB
        • SHA256 a38929a210a9833620c57483a48735249449a615f6c59a91f200860daf57054a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        9f1fbfaa776782c660abaa0c21c7ace7.index

        • Path C:\ProgramData\Battle.net\Agent\data\indices\9f1fbfaa776782c660abaa0c21c7ace7.index
        • Size 8KB
        • SHA256 38ab73d1dade03ed5545be6127ad85669a0936ddc3947ff1f3ad6fd82f50a131
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bae5f57eafef7e9f5e2fd4a0befe29d4.index

        • Path C:\ProgramData\Battle.net\Agent\data\indices\bae5f57eafef7e9f5e2fd4a0befe29d4.index
        • Size 8KB
        • SHA256 4fcee5cbe0cca88875e2d8fc61eb478fff44eba215980e7190b145c1371f4a85
        • MD5 SHA1 SHA512 SSDEEP TLSH

        c4b2fbd6ae7fde3e2991c25427048270.index

        • Path C:\ProgramData\Battle.net\Agent\data\indices\c4b2fbd6ae7fde3e2991c25427048270.index
        • Size 20KB
        • SHA256 d42dee6254a0fb75d04055b3c09af96008d279fa6956c19898ac487f8f0c17ef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        c856402fe1c953bf80faeda4cfe6c234.index

        • Path C:\ProgramData\Battle.net\Agent\data\indices\c856402fe1c953bf80faeda4cfe6c234.index
        • Size 16KB
        • SHA256 80d16b7a55437665d1bd28d15827a975ea906251cf46b8b9c8211a2e520ccd20
        • MD5 SHA1 SHA512 SSDEEP TLSH

        d6e1913a79a73d667983e88e6efe470c.index

        • Path C:\ProgramData\Battle.net\Agent\data\indices\d6e1913a79a73d667983e88e6efe470c.index
        • Size 100KB
        • SHA256 c65edb949c9f2962e8b8b9c31b0741dc33cc7f3b924c58f01472d54b40113092
        • MD5 SHA1 SHA512 SSDEEP TLSH

        product.db

        • Path C:\ProgramData\Battle.net\Agent\product.db
        • Size 196B
        • SHA256 3bc75ad9366f15aacf510c50cf3e6cbf828e4e9fa086aa989c198a22bf28cbfa
        • MD5 SHA1 SHA512 TLSH

        product.db

        • Path C:\ProgramData\Battle.net\Agent\product.db
        • Size 239B
        • SHA256 103f03c700e2d15ebd1f392982c0227665b062a37eb2b54d98f2d397e7b8549d
        • MD5 SHA1 SHA512 TLSH

        ..Battle.net-Setup.exe.7.3324.temp.8.3324.temp.temp

        • Path C:\ProgramData\Battle.net\Setup\bna_2\..Battle.net-Setup.exe.7.3324.temp.8.3324.temp.temp
        • Size 4.5MB
        • SHA256 f4643a2086c0cecb1ab68cc601bf38c1a0a6f7ef5914ad03375cc9449385bec6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        .Battle.net-Setup.exe.7.3324.temp

        • Path C:\ProgramData\Battle.net\Setup\bna_2\.Battle.net-Setup.exe.7.3324.temp
        • Size 2.1MB
        • SHA256 9b67771dd53686f1a96c0f8bb36ea9f41b31b2f8d8671db77ce511604796f444
        • MD5 SHA1 SHA512 SSDEEP TLSH

        battle.net-setup-20261110T180538.log

        • Path C:\ProgramData\Battle.net\Setup\bna_2\Logs\battle.net-setup-20261110T180538.log
        • Size 5KB
        • SHA256 156f4233a0cd65be417b304d60bab0688f544aa3fa3b139eeb63cd36b437dd7a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
        • Size 471B
        • SHA256 e692b8539b252cd40bbe7f0015eaaf466298c96f8883acebbfa24bb99c333b0d
        • MD5 SHA1 SHA512 TLSH

        8EC9B1D0ABBD7F98B401D425828828CE_FB08E67B7F5C70AA49C06077EDAF7FD1

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_FB08E67B7F5C70AA49C06077EDAF7FD1
        • Size 727B
        • SHA256 1eef20c94e5910d268f7a4dad0353308f7f783ebf34340646e2371d8b2a63da9
        • MD5 SHA1 SHA512 TLSH

        C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
        • Size 727B
        • SHA256 9fbf78682aafa571331eb73dd361eed2a906eef684a92a28e29be4b610e48b20
        • MD5 SHA1 SHA512 TLSH

        698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
        • Size 400B
        • SHA256 5816f830737ae818909f5ebf70df6fd576da066cb17ff78eb938e4bcc2b7a506
        • MD5 SHA1 SHA512 TLSH

        8EC9B1D0ABBD7F98B401D425828828CE_FB08E67B7F5C70AA49C06077EDAF7FD1

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_FB08E67B7F5C70AA49C06077EDAF7FD1
        • Size 408B
        • SHA256 d9dea8dafe24ddb51e64bb0ecb3c21725dcbffdf25abb2c5188d26ab0b21ad94
        • MD5 SHA1 SHA512 TLSH

        C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
        • Size 412B
        • SHA256 e7f3c9f0206429e31a9fddb55b32a47d4bff88c0b381cf7b383d97fedf66041d
        • MD5 SHA1 SHA512 TLSH