Killing Floor 2

Killing Floor 2
Active since 2017-04-21
A set of Killing Floor 2 Puzzles - also known as "From a Friend".
Type	[[List_of_Investigations#Official|Official]]
Creator	Tripwire Interactive
Discovered	2017-04-21

Main Page > List of Investigations > Killing Floor 2

The Killing Floor 2 ARG/puzzle chain, also known as From a Friend, began on April 21, 2017. As of yet, it is unclear what these puzzles are leading towards.

Initial Announcement

On April 21, 2017, a Steam announcement was made by Tripwire Interactive:

L krsh wklv phvvdjh pdnhv lw rxw! Kruclqh lv xs wr qr jrrg dqg wkh zruog qhhgv wr nqrz! Zlwk dqb oxfn brx'oo ghflskhu wklv dqg ilqg wkh foxhv L'oo eh ohdylqj. Brx duh wkh rqob krsh zh kdyh wr vwrs wklv ehiruh lw lv wrr odwh!
lxusglxoktj/znkyzgxz.vtm

Using ROT23 for the first part, and ROT20 for the filename at the end, this ciphertext was decoded to:

I hope this message makes it out! Horzine is up to no good and the world needs to know! With any luck you'll decipher this and find the clues I'll be leaving. You are the only hope we have to stop this before it is too late!
fromafriend/thestart.png

thestart.png

The decoded ciphertext led us to http://media.tripwirecdn.com/fromafriend/thestart.png, which hosts the following image:

Atlassian

keeplooking.png

On May 17, 2017, more information was found on the Tripwire Atlassian homepage. Jared Creasy made another change to the website before Puzzle.png, by reuploaded a photo with a "FAF" description underneath.

Image analysis reveals no changes between the two photos, however, the data was slightly altered in the newest version. If you open the photo in a text editor, the very last line reads "... keeplooking.png"

As usual, you can find the image on the tripwirecdn website. Note that this image was added before Puzzle.png, and therefore is the true second piece to the puzzle.

Puzzle.png

On May 4, 2017, a Double XP and Drop Weekend! was announced by Tripwire Interactive which also included a Cipher:

ah?mIoehseuktene osn e tg t okartih!yrCdhoo ge ne elcp

The Cipher was later revealed using an unspecified script:

Is there anyone out there looking? Check the mod pages!

Clues were then discovered on Tripwire's Atlassian page, which lead detectives to this image. Modifying color levels of the image reveals the puzzle piece down below. This piece will appear differently depending on how it was extracted.

Security Footage

On May 5, 2017, a "Statement From Horzine" was distributed:

I have been asked to pass along the following statement from Horzine:
"We at Horzine would like to disabuse the rumors that things may have gotten worse with the ZED outbreaks or that "unethical" experiements are continuing. Horzine is dedicated to the fight against, and containment of, the threat that the ZEDs pose to us all. As a proof of good will we are releasing some security footage from a undisclosed Horzine facility."

https://media.tripwirecdn.com/032317/cam_02.mp4

cam_04.webm

During the last half of the cam_02 footage, "cam_04.webm not found" is slightly visible. Putting "cam_04.webm" into the .../fromafriend/ directory provides a new webm.

At roughly 2.5 seconds, a new puzzle piece is revealed.

Background Interference

On May 27, 2017, a new WWAUT was released by Tripwire Interactive, with the last few lines containing the next part of the puzzle:

LOUD NOISE WARNING http://media.tripwirecdn.com/052617/sample.wav

Running the audio through spectrogram software reveals a hidden message, (Cleaned version down below.)

Using the information around the newly formed picture reveals instructions on how to arrange an Enigma decipher. The result is a sentence spelled out in one word:

ANTONWOULDBEPROUD

It is still unclear weather or not this is the end of the may 27th clue, or if there's still more information to be discovered.

---

This page is a work in progress - it will be updated as new findings emerge.