User Tools

Site Tools


investigation:other:vi:ad03
To prevent vandalism, unregistered users cannot edit this wiki. If you would like to contribute, please create an account.

Access Dive 3

It was first hinted it would start with this video, that lead to a timer, that started at 4h30m and during the passing 4 days the hour hand would move backwards.
When the hour hand reached the number 12 the minute one starting going back wards in real time and every 5 minutes the clock would update with the sentences “to watch” and “to be watched”, showing up more and more.


At the end of the 30 minutes it would update with this image

Making the access to the console and it's nodes possible

Hidden Info

Node 1

G+ Link

post

Hidden Info


The node

image

Hidden Info

Node 2

G+ Link

post

Hidden Info


The node

image

Hidden Info

Node 3

G+ Link

post

Hidden Info


The node

image

Hidden Info

Node 4

G+ Link

Node 4 unlocked by agent @Wapta Final security barrier expected to be broken at zero hundred hours

http://www.veruminveniri.com/ad3/console

helzpsifpgdhdduasr

Hidden Info
6 rows of 3, read diagonally to get 8ppg4residualz684s


The node

When attempting to recover some documents the carrier activated an incendiary device in his briefcase. This was the only page that we were able to recover.

Hidden Info
The MD5 hash of the link means static

Vengeance

On the 23th of November a message was posted that was deleted a few minutes later. On it the message LBHEFUNQBJFNERSNQVATLBHEFRPERGFNERABYBATREFNSR was written and this image was seen with the title Vengeance

Thanks to Anthony Castanza for managing to get the post before it was deleted

Hidden Info
The EXIF of this image says YOUARENOTSAFEANYMORE.
Applying a ROT 13 to the message of the post we get YOURSHADOWSAREFADINGYOURSECRETSARENOLONGERSAFE



After the deletion this post was published by VI

Around 0600 UTC, an unauthorized Agent gained access to an internal VI account, and, as such, had momentary access to our processing queue and social media pages. We are reviewing our security protocol to ensure that future incidents of a similar nature do not occur.

In the meantime, Field Agents with knowledge as to who is responsible for this breach are encouraged to come forward.


Node 5

G+ Link

Node 5 unlocked by agent @HowardRoark.

http://www.veruminveniri.com/ad3/console

Ww0yODkBZG9vtBJaBSh6ZnM=

Hidden Info


The node

Hidden Info
The MD5 hash of the link means noise
There is an info in the exif that says XP Comment’ string: ccd587dcb9fa10b3aa81b6b8e6fbce77.png. Using that as a link we get http://www.veruminveniri.com/ad3/node5/ccd587dcb9fa10b3aa81b6b8e6fbce77.png

They have the value of 7a 20 74 69 74 e9
6e 73 3a
76 e9 72
75 73 20
20 66 e9
72 6f 75
6f 75 73
76 e9 20
4e 6f 75
69 74 6f
20 76 6f
6c 61 20
6c 69 63
73 20 76

Straight conversion of Hex to ASCII and then reordering to get a proper sentence gives Nous vous félicitons: vous avez trouvé la verité (french for We congratulate you: You have found the truth)

Placing the pixels in a 16 x 16 grid
You can then read the row and the column value (starting at 0) and five to each previous group a 2 digit value (hex). For example ‘Nou’ which was retrieved from RGB: 4e 6f 75. This is one of the three pixels in row 6, column 9 (start counting at 0), or 69.
In the end you get the string
69 6e 76 65 6e 69 72 69 34 6e 61 36 39 6c 72 32 which in hex to ASCII gives inveniri4na69lr2

Node 6

G+ Link

post

Hidden Info


The node

image

Hidden Info

Node 7

G+ Link

Node 7 unlocked by agent @Wapta Final arrangements being set. Node online ETA remains the same.

http://www.veruminveniri.com/ad3/console

sxhotkvftgsmjerfvuvwqhjttvtpvlsxhotk

This post had the particularity of having a reply from someone called Xxxxxx. The message said “Advice, do not get more involved than you are. Just back away and nothing will happen to you. Stay and you will share the same fate as VI. This is your first and only warning”

Hidden Info


The node

Hidden Info
The MD5 hash of the link means i
The audio contains morse that decodes to “after the introduction of decapoint”
After that there is some more morse but with no breaks.
...-...--.-.--....----...----.-.---..-.......-....-.....----------.-...---..----.-..

Using the hints to braille (decapoint and louis) break the string in 3 equal parts and groups of 2

.. .- .. .- -. -. -- .. .. -- -- .. .- -- 
-. -. -- -. .- .. .. .. .- .. .. -. .. ..  
-- -- -- -- -- .- .. .- -- .. -- -- .- ..  

Interpret . as on and - as off, the braille will translate to deceit7qf73dr7


Node 8

G+ Link

Node 8 unlocked by agent @Vorticity.

http://www.veruminveniri.com/ad3/console


The node


Ingredients

1.5 kg brussel sprouts 250 g diced bacon 100 g sliced almonds 30 g crushed garlic 30 ml balsamic vinegar seasoning

Recipe

Fry the bacon until browned and slightly crisp and remove from pan. Add the crushed garlic and the almonds to the heated bacon fat and cook briefly until lightly roasted. Add the brussel sprouts and toss to cover them with oil. Add the balsamic vinegar and cook the brussel sprouts until brown, stirring frequently. Remove from heat, stir in the bacon and season to taste.

Hidden Info
The MD5 hash of the link means t

At the top of the image there are some 2×2 squares (starting top left, evenly spaced) which have colors that do not match their surroundings. The RGB values for these squares are:

55 53 49 115 114 101 97 109 120 105 49 114 48 112 117 53 104 100 120 100 52 111 53 56

Converting to ASCII gives you 751sreamxi1r0pu5hdxd4o58

Reverse and take take characters at odd positions to get 8odd5primes5

Key word: 855, and ‘odd primes’ as hint for the suffix. Odd primes = 3, 5, 7, 11, 13, ..

Use these as indices for: 751sreamxi1r0pu5hdxd4o58 to get 1ra10hx5, reverse this and append to 855 to get: 8555xh01ar1



Also the image EXIF contains uotammafsqdbztzjpgybbhsctomrqrdcoighsniy
Looking carefully at the image in the top left you will see a dolphin

Vigenere with the word dolphin to get railfencefourgwverrtoeereheendsnhateectr

Railfence 4 on gwverrtoeereheendsnhateectr

greentwodcseventhreearthree → green2dc73ar3





And finally in the main console page in the link for node 8 in the source code there is eteihcvnggaetthirswnterpoeudolsvyle

railfence 7 to get eightuydeightcarrollpseventwosevent – > 8uyd8carrollp727t


Node 9

G+ Link

post

Hidden Info


The node

image

Hidden Info
The MD5 hash of the link means

Node 10

G+ Link

Node 10 unlocked by @az32612 The hidden battles rage on.

http://www.veruminveniri.com/ad3/console

q37e73s76e61i34f62w6Cn75e65b73i34f37c34y76w00e

Hidden Info


The node

Hidden Info
The MD5 hash of the link means ep

Node 11

G+ Link

Node 11 unlocked by @MarkByers Node will be online at the predicted time. They will not stop us.

http://www.veruminveniri.com/ad3/console

The video Jammed was also in this post


The node

Hidden Info
The MD5 hash of the link means one
There is an image hidden in the source

This image is a glider from Conway's Game of Live. This is a hint that the rest is also a Conway's Game of life.
Running it gives you inveniri1pt85sr8

Node 12

G+ Link

Node 12 unlocked by @jestr Carry on the good work agents. It's time for them to be the ones in fear.

http://www.veruminveniri.com/ad3/console

3012b44b2g0g0f1h0fjg53124c -p

Hidden Info
3012b44b2g0g0f1h0fjg53124c-p. remove the p. Letters to numbers and vice versa (a=0) . Pairs and then hex to base 64. replace the final g== with the p and you get 2rwe4campbellv284p


The node

Hidden Info
The MD5 hash of the link means m

The filename “hsp” is the word for “garden” in Ancient Egyptian language which hints at Gardiner. Each hieroglyph inside the Cartouche has a Gardiner Index. From left to right, these indices are: V11 E1 R12 U16 M1 A8 R8 C6 B1 D2 Z11 R18 H4

Reading downwards, using letters where letters are expected in the passcode and reading numbers where numbers are expected, one gets verum8rc12zr4

Then, using the remaining numbers and letters, and doing a letter to number and vice versa conversion, one gets 11, 1, 12, 16, 1, A, 8, 6, B, D, 11, 18, H → kalpa1hf24kr8


Node 13

G+ Link

Node 13 unlocked by @TheHivemind What will be found at the end? 56 63 02 13 53 61 15 19 00 15 13 04 04 63 06 00 57

Hidden Info
underline numbers = subtract from previous result obtained, non underline = add
56 119 117 104 51 112 97 116 116 101 114 110 114 51 57 57 114
Decimal to ASCII to get 8wuh3patternr399r


The node

VI SIGINT Report

Target:  Strategic Explorations
Location:  [LOCATION REDACTED] Harbor
Coordinates:  [COORDINATES REDACTED]
Intercepted:  09:03  19-[DATE REDACTED]
Method:  Visual

   B      
-------      B
   R      -------
-------      R
   B

\ \ Y / /        ^
 \ \ / /        / \ W
Y \ V / Y      /   \
  / ^ \        \ R /
 /B/ \ \        \ /
/ / Y \ \        V


                  B
              ---------
  +     +         W
              ---------
     +            R
              ---------
  +     +         W
              ---------
                  B


   |   |       |   |
   |   |       |   |
 Y | B | Y   B | W | B
   |   |       |   |
   |   |       |   |
 

   R         R        |   |
-------   -------     |   |
   Y         Y      R | W | R
-------   -------     |   |
   R         R        |   |
   

             Y
   Y      -------
-------   
   R         B 
-------   
   Y      -------
             Y


   |   |     +     +
   |   |       
 R | W | R      +
   |   | 
   |   |     +     +


   |   | 
   |   |        B      
 B | W | B  ---------
   |   |        R
   |   |    
 

\ \ R / /    +     +
 \ \ / /     
R \ V / R       +
  / ^ \        
 /W/ \ \     +     +
/ / R \ \  


W/ / /          |
/B/ / /         |
 /W/ /          |
/ /B/ /      W  |  R
 / /W/          |
/ / /B/         |
 / / /W         |


   R       +     +    R | | R
-------              ---- ----
   Y          +          Y
-------              ---- ----
   R       +     +    R | | R


   R         \ 
-------       \
   Y        Y  \  R
-------         \
   R             \
Hidden Info
The MD5 hash of the link means k

Node 14

G+ Link

post

Hidden Info


The node

image

Hidden Info
The MD5 hash of the link means

Node 15

G+ Link

System back online. Resuming the AD3 console process

Node 15 unlocked by @jestr http://www.veruminveniri.com/ad3/console

Hidden Info
78b6b093799495939599b4b8797575ba
Hex to binary, shift every top nibble right one bit, binary to ASCII 8vpc9deceitx955z


The node

Hidden Info
The MD5 hash of the link means vi

Adjusting the levels of the image, the following text pops out:

23.3N, 29.2W, 27.9N, 87.4E, 22.8S, 122.1E, 29.9N, 41.6W, 19.8S, 69.1W, 44.9S, 41.5E, 14.2S, 151.9W, 32.5S, 5.2W

Eight pairs of coordinates. The coordinates are only accurate to one tenth of a degree, and don’t seem to point to anything interesting on earth. However, the image is of a statue of Helios and Selene, the Sun god and Moon goddess (this is fairly easy to find - a Google Image search of the image will yield this result directly). With this in mind, interpret the coordinates as Selenic Coordinates. One could use any sufficiently detailed moon atlas to look up these coordinates, but searching for the coordinates Verbatim in Google gives the solution very easily: each set of coordinates points towards a crater:

23.3N 29.2W Euler 27.9N, 87.4E Urey 22.8S, 122.1E Xenophon 29.9N 41.6W Angstrom 19.8S, 69.1W Darwin 44.9S, 41.5E Janssen 14.2S, 151.9W Galois 32.5S, 5.2W Deslandres

Taking the first letters of each crater name in order yields EUXADJGD → 5ux14jg4 The picture is a statue of of Helios on Selene → statue5ux14jg4


Node 16

G+ Link

Process initiated by unknown user N detected User Voynich has killed process Tracking of user N initiated Resuming AD3 console

Node 16 unlocked by @stau http://www.veruminveniri.com/ad3/console

Hidden Info


The node

Hidden Info
The MD5 hash of the link means ni

Node 17

G+ Link

Node 17 unlocked by @az32612. Online status in 25. Weird subroutine found today. Seemed to have been triggered by today's peculiar date. We advise all agents to %ˆ$#*@(….

TRANSMISSION INTERRUPTED. MESSAGE BOT HAS FAILED. Error Log - /'579Z4\/\/$4LP93/'/\4

http://www.veruminveniri.com/ad3/console

Hidden Info


The node

76 69 0d 0a 79 6e 6c 69 6b 71 33 6d 30 35 67 68 72 72 65 73 69 73 74 1b 35 58 30 72 65 34 6c 78 70 6c 34 68 32 58 50 24 70 33 68 78 34 68 50 34 68 37 78 24 70 68 32 58 24 70 34 68 78 32 68 50 24 70

Hidden Info
The MD5 hash of the link means b

Node 18

G+ Link

Spike detected. Possible attempt to break the tracking LOG ID - faifiahbxcijghgefxhiiefbfbxeihf Resources had to be diverted to avoid this Now resuming schedule for node release

Node 18 unlocked by @hivemind http://www.veruminveniri.com/ad3/console

Hidden Info
letters to number a=0. X means invert next bit until next X. Decimal to ASCII 2upg6cernt339t


The node

Hidden Info
The MD5 hash of the link means e

Node 19

G+ Link

Node 19 unlocked by ^%$

Error Code: 75884869056797773778489065523589 Unexpected exception while accessing node path: Files missing File corruption detected in tracking process results. Some data may be unrecoverable Operator action required before carrying on

Hidden Info
Make pairs
75 88 48 69 05 67 97 77 37 78 48 90 65 52 35 89

Thinking in terms of decimal ranges (48-57 65-90) and of passcode format ( [2-9][p-z][p-z][a-h][2-9]keyword[p-z][2-9][2-9][2-9][p-z] ) you will notice that the odd pairs are reversed. reverse those
57 88 84 69 50 67 79 77 73 78 84 90 56 52 53 89

Decimal to ASCII 9xte2comintz845y 


The node

image

Hidden Info
The MD5 hash of the link means

Node 20

G+ Link

post

Hidden Info


The node

image

Hidden Info
The MD5 hash of the link means

investigation/other/vi/ad03.txt · Last modified: 2016/06/18 21:20 (external edit)