so first of all, I would like to clarify that I am by far no expert in this kind of analysis. I just have some basic knowledge about whats going on in an operating system. And all I'm asking for here, is for someone to help me put things into perspective and explain to me what might be going on or what I might have misinterpreted.
Lately, while playing Starcraft: Remastered, I recognised some unusually heavy upload activity, originating from my Computer and going towards my wifi router. It can nicely be observed within the wifi workload of the router. Download speed remains as usual.
Taking a look into the network activites using a monitoring tool, I found that in fact the process of Starcraft is responsible for the upload. Using the UDP protocol, it seems to send a lot of data to 220.127.116.11. Alongside with some other IP addresses, which most likely apply to the other players.
A lookup of the, by far most active, IP address unsurprisingly reveals that its a static IP address of Blizzard. (Btw. blocking that IP does not work. Starcraft just switches to another one within the 37.244.54.X range. I don't know how many excalty, but a lot of them seem to belong to Blizzard. And if I block the entire range, I am no longer able to join any games - but surprisingly still able to join Battle.Net and chat.)
The interesting part is, that the upload starts as soon as I join a game Lobby, peaks at the start of a game and starts to lower after some minutes into the game.
Curiosity sparked, I decided to monitor all activities of the Starcraft process for a while. After some time, there was something interesting. Right at the moment when I joined another game lobby, Starcraft.exe read in a lot of files, which it actually should not have any interest in.
The executables of Deamon Tools Lite, HP Scanning Software, WPS Office, Windows System Binaries... and so on.
And like the ones marked in the Screenshot, Starcraft.exe did not only probe the mentioned files; it completely read them in. So I am wondering, what does it do with that data? Is that normal behavior for a game executable?
Not sure about the file reading thing, but the crazy upload behavior started since the last update of Starcraft: Remastered via the Battle.Net Launcher.
Can someone help me understand?