---
title: Hunt: fake game/crack Inno installers that install WorldProxyPool proxyware, CharityEngine/BOINC compute, or AW Manager utilities | ctxsec
url: https://ctxsec.com/items/hunt-msft-fake-download-worldproxypool-charityengine-boinc-monetization
description: "Microsoft Threat Intelligence describes a fake-download campaign that uses trojanized Inno Setup-style installers for cracked software, free games, activators and unofficial utilities. A temporary runner under %TEMP%\\is-*.tmp\\ stages eld*.exe payloads and reports per-offer results with a durable d=inno and r=offer_execution (or _fail) callback. Confirmed monetization branches: WorldProxyPool (SYSTEM scheduled tasks for sdk-agent, five-minute PowerShell watchdog, hourly updater), CharityEngine/BOINC plus VirtualBox for distributed compute, and Advanced Windows Manager / Windows Manager adware-style utilities. Products may be legitimate on their own; the risk is silent bundled install without informed consent."
status: "vendor research (Microsoft Threat Intelligence, Nov 3); PUA/monetization campaign, not classic credential-stealer; domains rotate — hunt the callback pattern"
published: 2026-11-07
---

> Microsoft Threat Intelligence describes a fake-download campaign that uses trojanized Inno Setup-style installers for cracked software, free games, activators and unofficial utilities. A temporary runner under %TEMP%\is-*.tmp\ stages eld*.exe payloads and reports per-offer results with a durable d=inno and r=offer_execution (or _fail) callback. Confirmed monetization branches: WorldProxyPool (SYSTEM scheduled tasks for sdk-agent, five-minute PowerShell watchdog, hourly updater), CharityEngine/BOINC plus VirtualBox for distributed compute, and Advanced Windows Manager / Windows Manager adware-style utilities. Products may be legitimate on their own; the risk is silent bundled install without informed consent.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-msft-fake-download-worldproxypool-charityengine-boinc-monetization.md)

vendor research (Microsoft Threat Intelligence, Nov 3); PUA/monetization campaign, not classic credential-stealer; domains rotate — hunt the callback pattern

2026-11-07

### Hunt: fake game/crack Inno installers that install WorldProxyPool proxyware, CharityEngine/BOINC compute, or AW Manager utilities

- **Process:** execution from `%TEMP%\is-*.tmp\` of `eld*.exe`, `set_*.exe`, `FirstFast[1].exe`, `SecondRunner[1].exe`.
- **Network:** outbound URLs containing `d=inno` with `r=offer_execution` or `r=offer_execution_fail` (domains rotate; examples in the blog include beliefdesk[.]xyz, companyharbor[.]xyz, signalpane[.]cfd, inkact[.]xyz, wishgrove[.]cfd).
- **Persistence:** scheduled tasks `WorldProxyPoolAgent`, `WorldProxyPoolWatchdog`, `WorldProxyPoolUpdater`; path `C:\Program Files\WorldProxyPool\sdk-agent.exe`.
- **Inventory:** unexpected WorldProxyPool, CharityEngine, BOINC or VirtualBox installs users did not choose.
- **Hashes (SHA-256 samples from Microsoft):** `006510ce1da2b7410376f0788c19e55616eb4bcc30072d25b7d0871dc32aa11c`, `21306fc5716f95e252388f920314b42f1c8bcc7df67cb4d39da30217b96f4044`, `ab2c2dd37fdcfe1e7620a57f98c80bd063258bea145adc0cc6a0f8b1e24c6a8f`.

Sources: [Microsoft Security Blog: Fake-download campaign uses trojanized installers to deliver monetization payloads (Nov 3)](https://www.microsoft.com/en-us/security/blog/2026/11/03/fake-download-campaign-uses-trojanized-installers-deliver-monetization-payloads/)