Difference between revisions of "Bulgaria drop"

From otp22 db
Jump to: navigation, search
(Created page with "We got CD content: https://www.dropbox.com/sh/mkltz004gql56d4/xbX21pytra data.bin 32.08 MB IFFOUND.TXT 774 bytes SHOPPING.TXT 378 bytes IFFOUND.TXT: Code: ========IF===...")
 
m (data.bin :: non-private video)
 
(6 intermediate revisions by 3 users not shown)
Line 1: Line 1:
We got CD content:
+
{{Locbox|Bulgaria CD drop|BulgariaCD.jpg‎|Dimitrovgrad Bulgaria|42.0552|25.5927|CD
 +
||Stefan|CD|type=CD|status=Acquired|foundon=9-06-2013}}
 +
 
 +
 
 +
 
 +
Check also [http://forums.unfiction.com/forums/viewtopic.php?t=36166&start=450 UF link]
 +
 
 +
== We got CD content: ==
  
 
https://www.dropbox.com/sh/mkltz004gql56d4/xbX21pytra
 
https://www.dropbox.com/sh/mkltz004gql56d4/xbX21pytra
Line 9: Line 16:
  
  
IFFOUND.TXT:
+
== IFFOUND.TXT: ==
  
 
Code:
 
Code:
Line 49: Line 56:
  
  
SHOPPING.TXT:
+
== SHOPPING.TXT: ==
  
 
Code:
 
Code:
Line 70: Line 77:
  
  
data.bin :
+
== data.bin : ==
not sure yet
+
 
 +
"Random" binary data, 33633585 bytes long.
 +
 
 +
It was found that the file can be decrypted by XORing with a file from the Black OTP 9 disk. The decrypted file is a WMV video.
 +
 
 +
Decrypted file:
 +
https://dl.dropboxusercontent.com/u/28940500/output.wmv
 +
 
 +
Decrypted video on youtube:
 +
https://www.youtube.com/watch?v=UyHZvvqth3Q
 +
 
 +
The video shows the previously seen globe-and-radio-masts logo with a "blip" on Svalbard, followed by another "blip" further towards the North Pole. A weird [http://i.imgur.com/0SYS1j6.png symbol] is briefly shown. A Cleveland Direct calling card is then presented and its use demonstrated. It is to be used to access Class 6 Telephone Systems operated by WORM.
 +
 
 +
Among the text on the calling card two numbers are printed.
 +
Access Number: + 1 412 888 0004
 +
PIN: 615048801
 +
 
 +
The video contains some DTMF tones heard when it is demonstrated how to use the "Cleveland Direct" calling card to call numbers. The tones are:
 +
 
 +
{|
 +
|-
 +
! Tone nr. !! Time in Video !! Decoded Number
 +
|-
 +
| 1. || 2:01 - 2:10 || 212 364 9953
 +
|-
 +
| 2. || 2:26 - 2:33 || 412 888 0004
 +
|-
 +
| 3. || 2:41 - 2:52 || 15048801#
 +
|-
 +
| 4. || 3:03 - 3:11 || 212 364 9953
 +
|}
 +
 
 +
http://otp22.referata.com/wiki/Designing_Compelling_Worm_Sanctuaries/Investigation/Phone_numbers#212-364-9953
 +
http://otp22.referata.com/wiki/412_888_0004
 +
 
 
check logs for more: http://198.23.165.56/irclogs/%23arg/2013_09_08_%23arg.log
 
check logs for more: http://198.23.165.56/irclogs/%23arg/2013_09_08_%23arg.log
 +
 +
== INVESTIGATION: ==
 +
 +
=== Traveling + and - indicator: ===
 +
 +
http://i.imgur.com/oTHLt56.jpg
 +
 +
{{DropItemsForPage}}
 +
 +
{{Sources|Dead drops}}
 +
[[Category:Mail drops]]  <----this line neds fixing

Latest revision as of 07:56, June 15, 2014

Bulgaria CD drop
BulgariaCD.jpg‎
Location     Dimitrovgrad Bulgaria
Coordinates 42.0552°, 25.5927°
Landmarks CD
Items
People/Visitors Stefan
Found 9-06-2013
Type CD
Status Acquired


Check also UF link

We got CD content:

https://www.dropbox.com/sh/mkltz004gql56d4/xbX21pytra

data.bin 32.08 MB IFFOUND.TXT 774 bytes SHOPPING.TXT 378 bytes


IFFOUND.TXT:

Code:

========IF===FOUND======
======-====STOP==========
=============+=========
IF YOU FIND THIS DISK
KINDLY DO NOT REMOVE IT
AS THIS IS MY SHOPPING
LIST TO HELP ME REMEMBER
WHAT TO BUY FROM THE STORE
EVERY TIME I MAKE A SHOPPING
LIST A BUNCH OF WEIRD
FILES SHOW UP BUT I NEED
TO KNOW HOW TO UNCHECK
THAT OPTION IF YOU KNOW
HOW THEN PLEASE CALL ME
AT +1 202 204 2303 AND IF
YOU SAY THE NUMBER
A16395 IT WILL REMIND
ME BECAUSE ITS MY FAVORITE
NUMBER AND ALSO IF YOU FIND IT
YOU CAN CALL
ME AND LET ME KNOW AS
I MUST HAVE LOST MY SHOPPING
LIST AND CANT BUY THE STUFF
I WANTED FROM THE STORE
THANK YOU
========================
ROBERT: YOU CANNOT HIDE
FROM WORMS. WILL WE FIND
YOU.
========================
===THANK YOU=====
================
482608888888888889
05 78 94 84 78 25 92


SHOPPING.TXT:

Code:

SHOPPING LIST (DO LATER WHEN NIGHTLIGHT)
=========================================
+37    Black/Orange Worms Riding ATVs
+64.69 Green/Rainbow Worms Riding OHGs
2      Switches

ACCOUNT INFORMATION
=========================================
ORANGE SWITCH  : *340938AB#
RAINBOW SWITCH : *991837DA#

FINAL CODE: *3033090004#
FINAL VRFY: *97841000DDDDDD#

SYNC: 4888883910000988886


data.bin :

"Random" binary data, 33633585 bytes long.

It was found that the file can be decrypted by XORing with a file from the Black OTP 9 disk. The decrypted file is a WMV video.

Decrypted file: https://dl.dropboxusercontent.com/u/28940500/output.wmv

Decrypted video on youtube: https://www.youtube.com/watch?v=UyHZvvqth3Q

The video shows the previously seen globe-and-radio-masts logo with a "blip" on Svalbard, followed by another "blip" further towards the North Pole. A weird symbol is briefly shown. A Cleveland Direct calling card is then presented and its use demonstrated. It is to be used to access Class 6 Telephone Systems operated by WORM.

Among the text on the calling card two numbers are printed. Access Number: + 1 412 888 0004 PIN: 615048801

The video contains some DTMF tones heard when it is demonstrated how to use the "Cleveland Direct" calling card to call numbers. The tones are:

Tone nr. Time in Video Decoded Number
1. 2:01 - 2:10 212 364 9953
2. 2:26 - 2:33 412 888 0004
3. 2:41 - 2:52 15048801#
4. 3:03 - 3:11 212 364 9953

http://otp22.referata.com/wiki/Designing_Compelling_Worm_Sanctuaries/Investigation/Phone_numbers#212-364-9953 http://otp22.referata.com/wiki/412_888_0004

check logs for more: http://198.23.165.56/irclogs/%23arg/2013_09_08_%23arg.log

INVESTIGATION:

Traveling + and - indicator:

oTHLt56.jpg

Drop Items

Drop item name Drop item condition Drop item status Location Notes
Bulgaria CD Unknown Received L0j1k None

[See Drop Item Inventory to edit this.]

<----this line neds fixing