|Bulgaria CD drop|
Check also UF link
We got CD content:
data.bin 32.08 MB IFFOUND.TXT 774 bytes SHOPPING.TXT 378 bytes
========IF===FOUND====== ======-====STOP========== =============+========= IF YOU FIND THIS DISK KINDLY DO NOT REMOVE IT AS THIS IS MY SHOPPING LIST TO HELP ME REMEMBER WHAT TO BUY FROM THE STORE EVERY TIME I MAKE A SHOPPING LIST A BUNCH OF WEIRD FILES SHOW UP BUT I NEED TO KNOW HOW TO UNCHECK THAT OPTION IF YOU KNOW HOW THEN PLEASE CALL ME AT +1 202 204 2303 AND IF YOU SAY THE NUMBER A16395 IT WILL REMIND ME BECAUSE ITS MY FAVORITE NUMBER AND ALSO IF YOU FIND IT YOU CAN CALL ME AND LET ME KNOW AS I MUST HAVE LOST MY SHOPPING LIST AND CANT BUY THE STUFF I WANTED FROM THE STORE THANK YOU ======================== ROBERT: YOU CANNOT HIDE FROM WORMS. WILL WE FIND YOU. ======================== ===THANK YOU===== ================ 482608888888888889 05 78 94 84 78 25 92
SHOPPING LIST (DO LATER WHEN NIGHTLIGHT) ========================================= +37 Black/Orange Worms Riding ATVs +64.69 Green/Rainbow Worms Riding OHGs 2 Switches ACCOUNT INFORMATION ========================================= ORANGE SWITCH : *340938AB# RAINBOW SWITCH : *991837DA# FINAL CODE: *3033090004# FINAL VRFY: *97841000DDDDDD# SYNC: 4888883910000988886
"Random" binary data, 33633585 bytes long.
It was found that the file can be decrypted by XORing with a file from the Black OTP 9 disk. The decrypted file is a WMV video.
Decrypted file: https://dl.dropboxusercontent.com/u/28940500/output.wmv
Decrypted video on youtube: http://www.youtube.com/watch?v=jqNQMeIX-dM
The video shows the previously seen globe-and-radio-masts logo with a "blip" on Svalbard, followed by another "blip" further towards the North Pole. A weird symbol is briefly shown. A Cleveland Direct calling card is then presented and its use demonstrated. It is to be used to access Class 6 Telephone Systems operated by WORM.
Among the text on the calling card two numbers are printed. Access Number: + 1 412 888 0004 PIN: 615048801
The video contains some DTMF tones heard when it is demonstrated how to use the "Cleveland Direct" calling card to call numbers. The tones are:
|Tone nr.||Time in Video||Decoded Number|
|1.||2:01 - 2:10||212 364 9953|
|2.||2:26 - 2:33||412 888 0004|
|3.||2:41 - 2:52||15048801#|
|4.||3:03 - 3:11||212 364 9953|
check logs for more: http://188.8.131.52/irclogs/%23arg/2013_09_08_%23arg.log
Traveling + and - indicator: