File name:

TLauncher-Installer-1.7.2.exe

Full analysis: https://app.any.run/tasks/064558ae-a40b-4d07-b396-62cd1142f504
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 17, 2025, 03:00:43
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
upx
lua
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

CB36CC6B09BD767CCA83A494D65AE496

SHA1:

C24EA24A25B9B315363C114A6DBF3CB1C7FB8083

SHA256:

A9741780FC7DEE2AFE2C51229704D911A4DDFCB85DAAA7E3AAA681E3412B6EC1

SSDEEP:

196608:LCVdM8FnOaNvJN8cOuOl0e+d3bRnTEWkRo/F7zdHFRloinZ87eSkDgtycn7:WXmabiZjmnlRAoNBTl72RkUn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • irsetup.exe (PID: 6964)
      • 360TS_Setup.exe (PID: 4428)

  • SUSPICIOUS

    • Checks for Java to be installed

      • irsetup.exe (PID: 6964)

    • Reads security settings of Internet Explorer

      • TLauncher-Installer-1.7.2.exe (PID: 6564)
      • irsetup.exe (PID: 6964)
      • BrowserInstaller.exe (PID: 5164)
      • irsetup.exe (PID: 6728)
      • 360-installer-bro.exe (PID: 1164)
      • 360TS_Setup.exe (PID: 4428)

    • Executable content was dropped or overwritten

      • irsetup.exe (PID: 6964)
      • BrowserInstaller.exe (PID: 5164)
      • irsetup.exe (PID: 6728)
      • TLauncher-Installer-1.7.2.exe (PID: 6564)
      • 360TS_Setup.exe (PID: 7000)
      • 360TS_Setup.exe (PID: 4428)
      • 360-installer-bro.exe (PID: 1164)

    • Reads Microsoft Outlook installation path

      • irsetup.exe (PID: 6964)

    • There is functionality for taking screenshot (YARA)

      • irsetup.exe (PID: 6964)
      • 360TS_Setup.exe (PID: 7000)

    • Reads Internet Explorer settings

      • irsetup.exe (PID: 6964)

    • Process requests binary or script from the Internet

      • 360-installer-bro.exe (PID: 1164)

    • Potential Corporate Privacy Violation

      • 360-installer-bro.exe (PID: 1164)

    • Creates a software uninstall entry

      • irsetup.exe (PID: 6964)

    • Starts itself from another location

      • 360TS_Setup.exe (PID: 7000)

    • Creates file in the systems drive root

      • 360TS_Setup.exe (PID: 4428)

    • The process verifies whether the antivirus software is installed

      • 360TS_Setup.exe (PID: 4428)

    • Drops 7-zip archiver for unpacking

      • 360TS_Setup.exe (PID: 4428)

  • INFO

    • The sample compiled with english language support

      • irsetup.exe (PID: 6964)
      • BrowserInstaller.exe (PID: 5164)
      • irsetup.exe (PID: 6728)
      • TLauncher-Installer-1.7.2.exe (PID: 6564)
      • 360-installer-bro.exe (PID: 1164)
      • 360TS_Setup.exe (PID: 4428)

    • Checks supported languages

      • irsetup.exe (PID: 6964)
      • TLauncher-Installer-1.7.2.exe (PID: 6564)
      • BrowserInstaller.exe (PID: 5164)
      • irsetup.exe (PID: 6728)
      • 360-installer-bro.exe (PID: 1164)
      • 360TS_Setup.exe (PID: 4428)
      • 360TS_Setup.exe (PID: 7000)

    • Create files in a temporary directory

      • irsetup.exe (PID: 6964)
      • BrowserInstaller.exe (PID: 5164)
      • irsetup.exe (PID: 6728)
      • TLauncher-Installer-1.7.2.exe (PID: 6564)
      • 360-installer-bro.exe (PID: 1164)
      • 360TS_Setup.exe (PID: 7000)
      • 360TS_Setup.exe (PID: 4428)

    • Reads the software policy settings

      • irsetup.exe (PID: 6964)
      • irsetup.exe (PID: 6728)
      • slui.exe (PID: 5364)
      • 360TS_Setup.exe (PID: 4428)

    • Reads the computer name

      • irsetup.exe (PID: 6964)
      • BrowserInstaller.exe (PID: 5164)
      • irsetup.exe (PID: 6728)
      • 360-installer-bro.exe (PID: 1164)
      • TLauncher-Installer-1.7.2.exe (PID: 6564)
      • 360TS_Setup.exe (PID: 7000)
      • 360TS_Setup.exe (PID: 4428)

    • Process checks computer location settings

      • irsetup.exe (PID: 6964)
      • BrowserInstaller.exe (PID: 5164)
      • irsetup.exe (PID: 6728)
      • TLauncher-Installer-1.7.2.exe (PID: 6564)
      • 360-installer-bro.exe (PID: 1164)
      • 360TS_Setup.exe (PID: 4428)

    • The process uses Lua

      • irsetup.exe (PID: 6964)
      • irsetup.exe (PID: 6728)

    • UPX packer has been detected

      • irsetup.exe (PID: 6964)
      • irsetup.exe (PID: 6728)

    • Checks proxy server information

      • irsetup.exe (PID: 6728)
      • irsetup.exe (PID: 6964)
      • slui.exe (PID: 5364)
      • 360TS_Setup.exe (PID: 4428)
      • 360-installer-bro.exe (PID: 1164)

    • Creates files or folders in the user directory

      • irsetup.exe (PID: 6964)
      • 360-installer-bro.exe (PID: 1164)
      • 360TS_Setup.exe (PID: 4428)

    • Reads the machine GUID from the registry

      • irsetup.exe (PID: 6728)
      • irsetup.exe (PID: 6964)
      • 360-installer-bro.exe (PID: 1164)
      • 360TS_Setup.exe (PID: 4428)

    • Creates files in the program directory

      • irsetup.exe (PID: 6964)
      • 360TS_Setup.exe (PID: 7000)
      • 360TS_Setup.exe (PID: 4428)

    • Disables trace logs

      • 360-installer-bro.exe (PID: 1164)

    • The sample compiled with chinese language support

      • 360TS_Setup.exe (PID: 4428)
      • 360TS_Setup.exe (PID: 7000)

    • The sample compiled with turkish language support

      • 360TS_Setup.exe (PID: 4428)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:09:18 16:06:44+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 23552
InitializedDataSize: 142848
UninitializedDataSize: -
EntryPoint: 0x2ce1
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.7.2.0
ProductVersionNumber: 2.9316.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: ASCII
Comments: TLauncher Setup
CompanyName: TLauncher Inc.
FileDescription: TLauncher Setup
FileVersion: 1.7.2.0
InternalName: TLauncher
LegalCopyright: TLauncher Copyright © 2025
LegalTrademarks: TLauncher
OriginalFileName: suf_launch.exe
ProductName: TLauncher
ProductVersion: 2.9316.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
129
Monitored processes
9
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start tlauncher-installer-1.7.2.exe irsetup.exe browserinstaller.exe irsetup.exe 360-installer-bro.exe slui.exe 360ts_setup.exe 360ts_setup.exe tlauncher-installer-1.7.2.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1164"C:\Users\admin\AppData\Local\Temp\360-installer-bro.exe" /sC:\Users\admin\AppData\Local\Temp\360-installer-bro.exe
irsetup.exe
User:
admin
Company:
Qihoo 360 Technology Co. Ltd.
Integrity Level:
HIGH
Description:
360 Total Security Online Installer
Exit code:
1
Version:
6, 6, 0, 1060
Modules
Images
c:\users\admin\appdata\local\temp\360-installer-bro.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1228"C:\Users\admin\Desktop\TLauncher-Installer-1.7.2.exe" C:\Users\admin\Desktop\TLauncher-Installer-1.7.2.exe—explorer.exe
User:
admin
Company:
TLauncher Inc.
Integrity Level:
MEDIUM
Description:
TLauncher Setup
Exit code:
3221226540
Version:
1.7.2.0
Modules
Images
c:\users\admin\desktop\tlauncher-installer-1.7.2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4428"C:\Program Files (x86)\1742180593_0\360TS_Setup.exe" /c:WW.TLauncher.CPI202307 /pmode:2 /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /s /TSinstallC:\Program Files (x86)\1742180593_0\360TS_Setup.exe
360TS_Setup.exe
User:
admin
Integrity Level:
HIGH
Description:
Installer Module
Version:
11,0,0,1178
Modules
Images
c:\program files (x86)\1742180593_0\360ts_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
5164"C:\Users\admin\AppData\Local\Temp\BrowserInstaller.exe" /NOINIT /S:C:\Users\admin\AppData\Local\Temp\setuparguments.iniC:\Users\admin\AppData\Local\Temp\BrowserInstaller.exe
irsetup.exe
User:
admin
Company:
TLauncher Inc.
Integrity Level:
HIGH
Description:
Installer of Browser Offers in TLauncher
Exit code:
0
Version:
5.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\browserinstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
5364C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6564"C:\Users\admin\Desktop\TLauncher-Installer-1.7.2.exe" C:\Users\admin\Desktop\TLauncher-Installer-1.7.2.exe
explorer.exe
User:
admin
Company:
TLauncher Inc.
Integrity Level:
HIGH
Description:
TLauncher Setup
Version:
1.7.2.0
Modules
Images
c:\users\admin\desktop\tlauncher-installer-1.7.2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6728"C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" /NOINIT /S:C:\Users\admin\AppData\Local\Temp\setuparguments.ini __IRAOFF:1682186 "__IRAFN:C:\Users\admin\AppData\Local\Temp\BrowserInstaller.exe" "__IRCT:3" "__IRTSS:1712847" "__IRSID:S-1-5-21-1693682860-607145093-2874071422-1001"C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
BrowserInstaller.exe
User:
admin
Company:
Indigo Rose Corporation
Integrity Level:
HIGH
Description:
Setup Application
Exit code:
0
Version:
9.7.0.0
Modules
Images
c:\users\admin\appdata\local\temp\_ir_sf_temp_1\irsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6964"C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1776394 "__IRAFN:C:\Users\admin\Desktop\TLauncher-Installer-1.7.2.exe" "__IRCT:3" "__IRTSS:23849095" "__IRSID:S-1-5-21-1693682860-607145093-2874071422-1001"C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
TLauncher-Installer-1.7.2.exe
User:
admin
Company:
Indigo Rose Corporation
Integrity Level:
HIGH
Description:
Setup Application
Version:
9.7.0.0
Modules
Images
c:\users\admin\appdata\local\temp\_ir_sf_temp_0\irsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7000"C:\Users\admin\AppData\Local\Temp\360TS_Setup.exe" /c:WW.TLauncher.CPI202307 /pmode:2 /promo:eyJib290dGltZSI6IjciLCJtZWRhbCI6IjciLCJuZXdzIjoiMCIsIm9wZXJhIjoiNyIsIm9wZXJhX2lucyI6IjAiLCJwb3B1cCI6IjciLCJyZW1pbmRlciI6IjciLCJ1cGdyYWRlX25vdyI6IjAifQo= /sC:\Users\admin\AppData\Local\Temp\360TS_Setup.exe
360-installer-bro.exe
User:
admin
Integrity Level:
HIGH
Description:
Installer Module
Version:
11,0,0,1178
Modules
Images
c:\users\admin\appdata\local\temp\360ts_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
18 329
Read events
18 265
Write events
48
Delete events
16

Modification events

(PID) Process:(6964) irsetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6964) irsetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6964) irsetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6964) irsetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry
Operation:delete valueName:AddToFavoritesInitialSelection
Value:
(PID) Process:(6964) irsetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry
Operation:delete valueName:AddToFeedsInitialSelection
Value:
(PID) Process:(1164) 360-installer-bro.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\360Safe\Liveup
Operation:writeName:mid
Value:
80342cb959da2233832ae840f019ccba8b56b331eb673be97c52113eab1cd1bc
(PID) Process:(1164) 360-installer-bro.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\LiveUpdate360
Operation:writeName:proxytype
Value:
1
(PID) Process:(1164) 360-installer-bro.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\360-installer-bro_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1164) 360-installer-bro.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\360-installer-bro_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1164) 360-installer-bro.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\360-installer-bro_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
101
Suspicious files
363
Text files
795
Unknown types
0

Dropped files

PID
Process
Filename
Type
6964irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.dat —
MD5:—
SHA256:—
6964irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG5.BMPimage
MD5:E08203F56B8B0B7022783CFE8495A099
SHA256:8BB7B411181B2E5CC1309ADEDEC23C1300F7E02F9750187E149A88525D549289
6964irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG5.PNGimage
MD5:ECD04B0C2180B0DBDCB4DD8FB87EB49A
SHA256:3E343404718D5815D534AF9FC55D7C004601D3DA6FCCA64AB9A71A6F4EF2B77D
6964irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.BMPimage
MD5:F35117734829B05CFCEAA7E39B2B61FB
SHA256:9C893FE1AB940EE4C2424AA9DD9972E7AD3198DA670006263ECBBB5106D881E3
6964irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG4.PNGimage
MD5:62A68F57624E91A9C97AD271913EB6E8
SHA256:5CCB1B59AA0D3107AEFC6386B275B34C4BEC38A68E574F9AB05368189D6E86F4
6964irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.BMPimage
MD5:3ADF5E8387C828F62F12D2DD59349D63
SHA256:1D7A67B1C0D620506AC76DA1984449DFB9C35FFA080DC51E439ED45EECAA7EE0
6964irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG7.BMPimage
MD5:E276621DBADE47E7E95DAFD5E543C794
SHA256:41DEF0B87D450A2096339F5E9D1EB73E479962AD49F8EF243ABE4685301AF599
6964irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.PNGimage
MD5:989062F9985A241F1EECB2E3FEFE768B
SHA256:5613C36D661C305A2C765F519C4F006355BACB6283CF682923FE29A30599C570
6964irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG6.BMPimage
MD5:E3E2115B669FF7BF83E2335AD9DC20C7
SHA256:BEC04616F5E6F2313FF008BA90FDF61D1903350CED09747AABE708B89B1D2076
6964irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.BMPimage
MD5:F5D6A81635291E408332CC01C565068F
SHA256:4C85CDDDD497AD81FEDB090BC0F8D69B54106C226063FDC1795ADA7D8DC74E26
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
40
TCP/UDP connections
69
DNS requests
15
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6964
irsetup.exe
GET
200
104.20.36.13:80
http://dl2.tlauncher.org/
unknown
—
—
malicious
6964
irsetup.exe
GET
200
104.20.36.13:80
http://dl2.tlauncher.org/
unknown
—
—
malicious
1164
360-installer-bro.exe
GET
200
151.236.118.173:80
http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Rel.cab
unknown
—
—
whitelisted
1164
360-installer-bro.exe
GET
200
52.29.179.141:80
http://s.360safe.com/360ts/mini_inst.htm?ver=6.6.0.1060&pid=WW.TLauncher.CPI202307&os=10.0&mid=80342cb959da2233832ae840f019ccba&state=153
unknown
—
—
whitelisted
1164
360-installer-bro.exe
GET
200
52.29.179.141:80
http://s.360safe.com/safei18n/dimana.htm?lr=1&mid=80342cb959da2233832ae840f019ccba&mod=360Installer.exe&ph=02a8342074eb25c8adb2d135e2bab7e5&p2p=1&t_id=360TS_Setup_For_Mini.cab&tads=656&tdl=656&tds=656&terr=0&tes=Status|1,ErrorCode|0,DnCount|6,HttpNum|1,DnFailCount|1,FStatus|1,P2SS|656,P2PS|0,PDMode|2&tfl=656&tp=t&tst=1&ttdl=656&ttm=1000&ttup=120&vh=1.3.0.1361&vp=1.3.0.1320&softname=360TS
unknown
—
—
whitelisted
1164
360-installer-bro.exe
GET
200
108.138.24.189:80
http://sd.p.360safe.com/0AF163392E0737C0CFF7908EC1FB2ACC0BAD6FDB.trt
unknown
—
—
whitelisted
1164
360-installer-bro.exe
GET
200
52.29.179.141:80
http://s.360safe.com/safei18n/query_env.htm?v611=DgY0MAEIT09F0AABAADlPJRb4qVil2f%2FlqrkeJ8CdzRipr8pWZfKv2DSJnGDWHISSVdJneyv0QqXkqzjkM3Z5z7vQO00JA6fm4BBzVI1JYdwlZudcc04VtxrUcXbKyC1DaB%2FrHq3h%2Bs9oxuohVqli75YKWI%2BsMJRPPD2xnX2dvAkPicdL9G1Y10JUETsPr%2FRXnKqGCUqbJqcB0v37BZxg5K7Qp%2FJD5iT03OWilfDR7bFlCbOqKg10imC%2BCuVVTRMXDRDfMexWWEO6URcsEC0lRR%2F4sBfFobkCmqZX8COcGd2LvEnEc9divUfZsW2b4pP4wuqmiSO9KDFDgSgN5G4d8qby5ZJHnhvskpStAo50zJ%2BVllQNoST9Wfao9oN4Me2Wtlcb6caQsykJnpDAx6X%2BxjwrOpzCsMzLh9yLIerIJHXsVoFSvse%2Bv7PN5pLIWRtKcqnp%2FOx00%2FirjU%2Bhsw%3D
unknown
—
—
whitelisted
1164
360-installer-bro.exe
GET
—
104.192.108.20:80
http://int.down.360safe.com/totalsecurity/360TS_Setup_11.0.0.1178.exe
unknown
—
—
whitelisted
1164
360-installer-bro.exe
GET
—
104.192.108.17:80
http://int.down.360safe.com/totalsecurity/360TS_Setup_11.0.0.1178.exe
unknown
—
—
whitelisted
1164
360-installer-bro.exe
GET
—
104.192.108.21:80
http://int.down.360safe.com/totalsecurity/360TS_Setup_11.0.0.1178.exe
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6964
irsetup.exe
104.20.36.13:80
dl2.tlauncher.org
CLOUDFLARENET
—
unknown
6964
irsetup.exe
104.20.36.13:443
dl2.tlauncher.org
CLOUDFLARENET
—
unknown
6728
irsetup.exe
151.236.71.147:443
free.360totalsecurity.com
CDNetworks LLC
RU
whitelisted
1164
360-installer-bro.exe
54.77.42.29:3478
st.p.360safe.com
—
—
whitelisted
1164
360-installer-bro.exe
52.29.179.141:80
s.360safe.com
AMAZON-02
DE
whitelisted
1164
360-installer-bro.exe
151.236.118.173:80
iup.360safe.com
CDNetworks LLC
RU
whitelisted
1164
360-installer-bro.exe
54.76.174.118:80
tr.p.360safe.com
—
—
whitelisted
1164
360-installer-bro.exe
108.138.24.189:80
sd.p.360safe.com
AMAZON-02
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.184.206
whitelisted
dl2.tlauncher.org
  • 104.20.36.13
  • 104.20.37.13
unknown
free.360totalsecurity.com
  • 151.236.71.147
whitelisted
st.p.360safe.com
  • 54.77.42.29
whitelisted
s.360safe.com
  • 52.29.179.141
  • 18.184.178.29
whitelisted
iup.360safe.com
  • 151.236.118.173
whitelisted
tr.p.360safe.com
  • 54.76.174.118
whitelisted
int.down.360safe.com
  • 104.192.108.17
  • 104.192.108.20
  • 104.192.108.21
whitelisted
sd.p.360safe.com
  • 108.138.24.189
  • 108.138.24.132
  • 108.138.24.16
  • 108.138.24.221
whitelisted

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET INFO Packed Executable Download
1164
360-installer-bro.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
1164
360-installer-bro.exe
Misc activity
ET INFO Packed Executable Download
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
TLauncher-Installer-1.7.2.exe