vendor research (Microsoft Threat Intelligence, Nov 3); PUA/monetization campaign, not classic credential-stealer; domains rotate — hunt the callback pattern
Hunt: fake game/crack Inno installers that install WorldProxyPool proxyware, CharityEngine/BOINC compute, or AW Manager utilities
Process: execution from %TEMP%\is-*.tmp\ of eld*.exe, set_*.exe, FirstFast[1].exe, SecondRunner[1].exe.
Network: outbound URLs containing d=inno with r=offer_execution or r=offer_execution_fail (domains rotate; examples in the blog include beliefdesk[.]xyz, companyharbor[.]xyz, signalpane[.]cfd, inkact[.]xyz, wishgrove[.]cfd).