Blizzard, the gaming company that makes WoW, SC and Hearthstone uses battle.net.exe and agent.exe.

When I close the battle.net application and don't have any games open, agent.exe runs in the background. If I end agent.exe's process in task manager, it reboots and continues running. There's no way to shut it down. If I suspend process for agent.exe in Windows Resource Monitor, the battle.net launcher and games don't work until I unsuspend it.

24 hours a day, agent.exe is sending data from my computer to Blizzard. It sends about 350 bytes per second. It sends data even if I don't have any Blizzard applications open. If I have Blizzard applications open, battle.net.exe sends about 350 bytes per second instead of agent.exe.

What data is Blizzard sending from my computer over the network? Why does it need to collect this data 24/7? Is this some serious spyware that I should be seriously concerned about and should consider uninstalling the application? Or is it just sending data about its games back to its servers?

I tried searching about this issue online but found that there weren't many people talking about this. It seems that this might be happening to everyone who uses Blizzard software, but I'm not sure.

enter image description here

  • 2
    We can't know without performing network analysis. If you are concerned you should do some executable analysis. I believe the Guide to Practical Malware Analysis from No-Starch Press would tell you what to do. Unfortunately it's far too broad of a topic to explain on SE. Mar 30, 2018 at 12:52
  • 1
    How do you know this network traffic is going to blizzard? It can also be that its a communication link with other parts of your system (called local-host connections) without a Network analysis we just do not know. For the same context see the System, it also send / receives data (and it will do this regardless of actual Internet connectivity) you can check this out by the simple test of disconnecting form the Internet and still seeing this traffic.
    – LvB
    Mar 30, 2018 at 13:34
  • @LvB well agent.exe and blizzard.net.exe do have remote IP addresses listed in network monitor, whereas the IP address of system is a home IP address - if that helps. I'm pretty new to monitoring traffic on my network but would like to learn more
    – Michael d
    Mar 30, 2018 at 13:49
  • you can open more than 1 connection, unless you do a traffic analysis (like with tcpdump) you just do not know.
    – LvB
    Mar 30, 2018 at 13:53
  • maybe it's mining bitcoins, have you checked the TOS?
    – dandavis
    Mar 30, 2018 at 21:17


Browse other questions tagged or ask your own question.