Timeline and Concept Map created for the ARG by user Gunsrequiem.
Final Timeline - Codes A-D Onward
(Events begin after IRC Clue #1 and before Code D solution)
I. October 4, 2012
A. IRC Clue #2 - “Note Welsh”
1. '“N38°57'8.05" W77°8'44.82".
Solution two ignore loc data N32°52'50.77" W106°20'49.40" not buried at initial loc, fly here.
Travel 14.16 miles east we transferred the niobium there.
Await further instructions.”
2. ''Capital letters in initial solution spell out “NOTE WELSH”
II. October 5, 2012
A. IRC Clue #3 - “X01/X02”
1. ''“INCOMING TRANSMISSION - LOC 2 LAYER 2 SUBSTRATA 3 X01/X02 HALOS PROJECT INITIATED 41Nb recovered. HAFB Compromised.
Transfer to site complete, project HALOS underway. Further INFO [Classified].
CODE BASE 64 compromised, switch to old code talker.
They are watching, assume leaker on site.
WSMR No longer viable location, move to main site, check external sources.”
III. November 4, 2012
A. SECOM cipher solved
1. Grilled Pizza image on site
a) Message hidden at bottom of page:
(1) '‘They stole the lie, as if that matters to me, HALOS is far too complete to stop now. They can't hide there, not now, not now I have this, this holds the key to all things... they CAN'T hide from me. I will follow them, I'll set up a link and this to remind me. Perhaps I should hide it on the secure site, perhaps that would be best. I'll find them though and they will pay, they will definitely pay. Dr Marcel was right when he said, "When you're building a cage for Satan, you don't ask him to wait around whilst you put the doors on." Welsh is probably behind this, but he won't get away with it.’
b) Decoded image message:
IV. November 4, 2012
A. IRC Clue #4 - “Prime Site Compromised”
1. Base64 decoding: “Proxyhost@-84-9-123-164.dslgb.com//closed.proxy.accepted//?OTR,1,3,?OTR:[I---MI-G TR--SMI---ON - UN---WN S##RCE]Access detected to personal site.
HALOS project under threat. Site offline as response. Switching to new protocols.[********] ~[OTR//2.0]Q0FZRUlMVEhEWkVIVEhBTlpJRVRLSU5OQUFTVFNPU
2. Navajo Code + Playfair (Key: “Terminal”) decryption of inner portion:
V. November 5, 2012
A. IRC Clue #5 - “BENALOHPAILLIER”
1. Base64 decode #1:
“[[Proxyhost@-84-9-123-155.dslgb.com//closed.proxy.accepted//?OTR,1,3,?OTR:[INCOMING TRANSMISSION UNKNOWN SOURCE]LEAK SOURCE DETECTED. TRIANGULATING...MIX CASCADE
HOP DETECTED...ATTEMPTING TIMING ATTACK...[TERMINATED] CANNOT CONNECT TO HOST...ATTEMPTING CONNECT TO USER H... SENDING DATA. SECURITY LEVEL 7 ALPHA.[OTR//3.0]
RRUogQlZMQk8gREpJSEUgQ1pUSE0gWktISUUgTk9NTFMgQVhWVlcKRVRXSVMgRVRJR00gUlhFVkYgUVlBVUIgVkZDRUIgUFdCVUsgRU1OT0wgVw==[/][End Transmission]|¬[Terminal.] ~~ [Transmission Ends]]”
2. Base64 and running key decode #2 (inner portion):
"This is a message left for Dr. Horn. Just to remind you in case of emergencies that the password to the HALOS files is BENALOHPAILLIER. I have programmed HALOS to send in level seven cases. You should bring pizzas."
VI. November 7, 2012
A. IRC Clue #6 - “HALOS.TXT”
1. Reminder to check website which led to discovery of HALOS.txt:
“[[ProxyhoSt@-84-9-I23-345.dslgb.com//closed.proxy.accepTEd//?OTR,3,4,?OTR:[INCOMING TRANSMISSION]ThEpIzZaIsaLiE...HALOS[Transmission Ends]]”
2. Not mentioned on Wiki (I have since updated to reflect this), but the capital letters after the first “p” spell out: “SITE”
a) This is obviously just a hint to return to the site
A. 752-character hex code retrieved from HALOS.txt . . . .
Clicking the Concept Map should allow you to open/download it for a more detailed examination.