Confirmed Au_.exe is an integral part of the NSIs installation package with instructions _ Virus killing

confirmed Au_.exe is an integral part of the NSIs installation package, not a virus
When it unloads 360safe, it does connect to port 80 of the following address
60.195.253.85

Grab the bag as follows:
SOURCE Address: 10.1.5.189 Port: 1214 Destination Address: 60.195.253.85 Port: ttl:64 packetsize:64
Protocol: TCP TCP flag: ack| URG
0x02 0x04 0x05 0xAC 0x01 0x03 0x03 0x02 0x01 0x01 0x08 0x0A 0x00 0x00-0x00 0x00 ......
0x00 0x00 0x00 0x00 0x01 0x01 0x04 0x02 ...

SOURCE Address: 10.1.5.189 Port: 1214 Destination Address: 60.195.253.85 Port: ttl:64 packetsize:52
Protocol: TCP TCP Flag
0A 7A D1 FD 35 ...... 2zxY.. 5

SOURCE Address: 60.195.253.85 Port: 80 Destination Address: 10.1.5.189 Port: 1214 ttl:50 packetsize:60
Protocol: TCP TCP flag: URG
0x02 0x04 0x05 0x18 0x01 0x03 0x03 0x00 0x01 0x01 0x08 0x0A 0x59 0xFD 0xD1 0x35 .... Y.. 5
0x00 0x00 0x00 0x00 ....

SOURCE Address: 10.1.5.189 Port: 1214 Destination Address: 60.195.253.85 Port: ttl:64 packetsize:352
Protocol: TCP TCP Flag
0x01 0x01 0x08 0x0A 0x00 0x32 0x7a 0x78 0x59 0xFD 0xD1 0x35 0x47 0x45 0x54 0x20 ... 2zxY.. 5GET
0x2F 0x72 0x65 0x67 0x2F 0x73 0x61 0x66 0x65 0x5F 0x75 0x6E 0x69 0x2E 0x68 0x74         /reg/safe_uni.ht
0x6D 0x3F 0x70 0x61 0x72 0x74 0x6E 0x65 0x72 0x3D 0x68 0x5F 0x68 0x6F 0x6D 0x65         m?partner=h_home
0x26 0x76 0x65 0x72 0x3D 0x32 0x2E 0x30 0x2E 0x30 0x2E 0x33 0x30 0x30 0x33 0x26         &ver=2.0.0.3003&
0x74 0x3D 0x33 0x33 0x30 0x38 0x32 0x37 0x31 0x38 0x37 0x20 0x48 0x54 0x54 0x50         t=330827187 HTTP
0x2f 0x31 0x2e 0x31 0x0D 0x0A 0x41 0x63 0x63 0x65 0x70 0x74 0x3a 0x20 0x2a 0x2f/1.1..accept: * *
0x2a 0x0D 0x0A 0x41 0x63 0x63 0x65 0x70 0x74 0x2d 0x45 0x6e 0x63 0x6f-0x64 0x69 * ... Accept-encodi
0x6E 0x67 0x3A 0x20 0x67 0x7A 0x69 0x70 0x2C 0x20 0x64 0x65 0x66 0x6C 0x61 0x74         ng: gzip, deflat
0x65 0x0D 0x0A 0x55 0x73 0x65 0x72 0x2d 0x41 0x67 0x65 0x6e 0x74 0x3a 0x20 E.. User-agent:m
0x6F 0x7A 0x69 0x6C 0x6C 0x61 0x2F 0x34 0x2E 0x30 0x20 0x28 0x63 0x6F 0x6D 0x70         ozilla/4.0 (comp
0x61 0x74 0x69 0x62 0x6C 0x65 0x3B 0x20 0x4D 0x53 0x49 0x45 0x20 0x36 0x2E 0x30         atible; MSIE 6.0
0x3B 0x20 0x57 0x69 0x6E 0x64 0x6F 0x77 0x73 0x20 0x4E 0x54 0x20 0x35 0x2E 0x31         ; Windows NT 5.1
0x3B 0x20 0x53 0x56 0x31 0x3B 0x20 0x54 0x65 0x6E 0x63 0x65 0x6E 0x74 0x54 0x72         ; SV1; Tencenttr
0x61 0x76 0x65 0x6c 0x65 0x72 0x20 0x3b 0x20 0x46 0x44 0x4d 0x3b 0x20 the 0x2e 0x4e Aveler; FDM;. N
0x45 0x54 0x20 0x43 0x4c 0x52 0x20 0x31 0x2e 0x31 0x2e 0x34 0x33 0x32 0x32 0x3b ET CLR 1.1.4322;
0x20 0x2e 0x4e 0x45 0x54 0x20 0x43 0x4c 0x52 0x20 0x32 0x2e 0x30 0x2e 0x35. NET CLR 0x30
0x37 0x32 0x37 0x29 0x0D 0x0A 0x48 0x6f 0x73 0x74 0x3a 0x20 0x69 0x6e 0x73 0x74 727). Host:inst
0x2E 0x33 0x36 0x30 0x73 0x61 0x66 0x65 0x2E 0x63 0x6F 0x6D 0x0D 0x0A 0x43 0x6F         .360safe.com..Co
0x6E 0x6E 0x65 0x63 0x74 0x69 0x6F 0x6E 0x3A 0x20 0x4B 0x65 0x65 0x70 0x2D 0x41         nnection: Keep-A
0x6c 0x69 0x76 0x65 0x0D 0x0A-0x0D 0x0A .....

SOURCE Address: 60.195.253.85 Port: 80 Destination Address: 10.1.5.189 Port: 1214 ttl:50 packetsize:215
Protocol: TCP TCP Flag
0x01 0x01 0x08 0x0A 0x59 0xFD 0xD1 0x45 0x00 0x32 0x7a 0x78 0x48 0x54 0x54 0x50 .... Y.. E.2zxhttp
0x2f 0x31 0x2e 0x31 0x20 0x32 0x30 0x30 0x20 0x4f 0x4b 0x0D 0x0A 0x44 0x61 OK ... Dat
0x65 0x3a 0x20 0x54 0x75 0x65 0x2c 0x20 0x31 0x37 0x20 0x4f 0x63 0x74 0x20 0x32 e:tue, Oct 2
0x30 0x30 0x36 0x20 0x30 0x32 0x3A 0x34 0x33 0x3A 0x33 0x34 0x20 0x47 0x4D 0x54         006 02:43:34 GMT
0x0D 0x0A 0x53 0x65 0x72 0x76 0x65 0x72 0x3a 0x20 0x41 0x70 0x61 0x63-0x68 0x65 ... Server:apache
0x0D 0x0A 0x58 0x2d 0x50 0x6f 0x77 0x65 0x72 0x65 0x64 0x2d 0x42 0x79-0x3a 0x20 ... X-powered-by:
0x50 0x48 0x50 0x2F 0x34 0x2E 0x33 0x2E 0x31 0x31 0x0D 0x0A 0x43 0x6F 0x6E 0x74         PHP/4.3.11..Cont
0x65 0x6E 0x74 0x2D 0x4C 0x65 0x6E 0x67 0x74 0x68 0x3A 0x20 0x32 0x0D 0x0A 0x43         ent-Length: 2..C
0x6F 0x6E 0x6E 0x65 0x63 0x74 0x69 0x6F 0x6E 0x3A 0x20 0x63 0x6C 0x6F 0x73 0x65         onnection: close
0x0D 0x0A 0x43 0x6f 0x6e 0x74 0x65 0x6e 0x74 0x2d 0x54 0x79 0x70 0x65-0x3a 0x20 ... Content-type:
0x74 0x65 0x78 0x74 0x2f 0x68 0x74 0x6d 0x6c 0x0D 0x0A 0x0D 0x0A 0x6f 0x6b ext/html....ok.

SOURCE Address: 60.195.253.85 Port: 80 Destination Address: 10.1.5.189 Port: 1214 ttl:50 packetsize:52
Protocol: TCP TCP Flag
0A FD D1 7A 78 ..... Y.. E.2zx

SOURCE Address: 10.1.5.189 Port: 1214 Destination Address: 60.195.253.85 Port: ttl:64 packetsize:52
Protocol: TCP TCP Flag
0A 7A 7A D1 FD 45 ..... 2zzY.. E

SOURCE Address: 10.1.5.189 Port: 1214 Destination Address: 60.195.253.85 Port: ttl:64 packetsize:52
Protocol: TCP TCP Flag
0A 7A 7A D1 FD 45 ..... 2zzY.. E

SOURCE Address: 60.195.253.85 Port: 80 Destination Address: 10.1.5.189 Port: 1214 ttl:50 packetsize:52
Protocol: TCP TCP Flag
0A FD D1 7A 7A ..... Y.. T.2zz

NSIs is the Nullsoft Install System, a software that makes the installer
Search results are as follows:

NSIs is the abbreviation for the Nullsoft Script installation system (Nullsoft scriptable installation system), which is a free Win32 installation, uninstall system, with a simple and efficient scripting approach. It was originally a system created by Nullsoft and published as a Winamp and its plug-ins, but has now been applied by hundreds of applications as a tool for their release.

NSIs created by Setup can install, uninstall, set system settings, extract files, and so on. Can almost do all things. Because it is based on a script file, you can completely control each part of your setup program. Its scripting language supports variables, functions, and string processing, just like a normal programming language-but only designed to create an installer.