Exagen

Exagen is the prequel for Society X, and is made by the same puppetmasters.

The Beginning

On August 16th, 9:05 PM UTC, A discord user by the name of Charles J. Cruz posted a link in the Game Detectives, and SCX discord with a message.

Charles J. Cruz - Today at 9:05 PM
The Government needs to stop lying. http://bobbywatersconspiracy.ga/

The site had a contact email, and a bitcoin address.

(The bitcoin address was removed shortly after)

Upon contacting the email, Bobby Waters responds:

From: Bobby Waters <[email protected]> 22:37 (43 minutes ago)   

Hi *,

I have posted my website on many websites and social media platforms as a form of self promotion. 

And while I don't directly need help for my story on Exagen Laboratories, I would recommend for you to educate yourself on the issue. While Exagen has been pretty quiet for the whole 12 years that they have been allowed to operate on our tax dollars, they are slowly starting to become more public. I'm sure you'll be able to find more about them somewhere online.  

Regards,
Bobby

Looking for "Exagen Laboratories" on youtube brought this link.

A frame from the video showed another link, which at the time of discovery had only read "Coming Soon".

Upon contacting Bobby Waters again about the video and website findings, this is what he responds.

From: Bobby Waters <[email protected]> 23:03 (2 minutes ago) 

Hi *,

Good work! 

I was already aware of the website and the video however I wanted to encourage you to go out there and look for it yourself. The website has been up for a few days and it seems that Exagen is trying to launch a site as part of them becoming more public. It seems like the website is currently only a default coming soon page but, I would expect the site to come online somewhere within the next week or two. 

Regards,
Bobby

This gives the info that the Exagen Laboratories site is coming online "within the next week or two."

Exagen Laboratories

On September 8th, at 8:03 UTC, https://exagen.org/ changed to say Website in developement, opening September 10, 2012.

Opening

On September 10th, at a currently unknown time, the aforementioned Exagen website was fully opened. When on the site, there are four links, the home page, an about page, projects page, and a careers page.

• The home page lists the fields Exagen specializes in and why.

The fields Exagen is successful in.

• The about page contains Exagen's Mission , which is:

Exagen's plan is to create a better future. We are working hard making revolutionary discoveries in medicine, technology, and general science. We want to make the world a better place by stepping on things such as cancer, down syndrome and other diseases and disorders that make life difficult. We want everyone to have a happy, long lived life.

Exagen has created over 20 different medicines, all making life a little bit better.

• The projects page lists 3 drugs in production by Exagen: Amantensin, ZTil, and Decontynal.

Amantensin is described as a drug being developed to help level out cholesterol levels in men over the age of fourty."

ZTil is described as a sleep aid being developed to help people suffering from Insommia.

Decontynal is described as a work in progress brain stimulant being developed with the goal of alleviating symptoms of schizophrenia.

Near the bottom of all pages on the website is a link to Exagen's Careers Page, which reads:

Getting started with Exagen careers

We are looking for talented individuals with majors in the fields of Bio-Chemistry, General Chemistry, Environmental Sciences, Medical Sciences, and Biomedical Engineering. If you're interested in working with Exagen, please email [email protected]

Test 1

On September 11th, at 11:49 PM UTC, users who emailed the careers address received a message back consisting of a link to a hidden page on the Exagen website. The page consisted of a white screen with a code on it.

IKOTISHUUHSWTUHEWATLE_AHGELIMHOR_LRHFDTOFFB_

The solution was found through double transposition, and when decoded, read the following.

IWALKTHROUGHTHEFIELDSWITHAMOUTHFULOFHERBS_

When players sent emails to [email protected] with the message I walk through the fields with a mouthful of herbs_ , they received the response:

I come out in times of epidemic.
I helped victims in one of most devastating pandemics known to man.

When the phrase Plague Doctor was sent to [email protected], players received an email containing the text .html. This led players to find the next step.

Plague Doctor

The plague doctor page contained an image, and the text:

HJTX3gAAAAOMx02LO2VqA83T3Wopao3jBQlWVwZ7V7u/KaoQ6Mvu1rYtOKhlsW4odYERbCNBDJnq43j1hRYtLuAb+h/16sLwpnWMwxLih0KXsD78hd5MiKtdae3cQU1/CcgRrjFKArssJHSnE3Bx+VlW6RfGYzrsS1FIGkjxJFTmPG2I3hMwcPnXZ2nZBsh5F487C7OwlLHbsG5SSi4m9H4ds/hUBKkpQKpiVk2JdfMU8f9Mj4oekwYIPGZLUZQg51hs9KM3J9H/LDtNyolSuDn86YaQCKbp

The image consists of 4 different objects, including the roman numeral 3, the Unicode logo, a clock stuck at 14:17, and a falling man, with a small "8" on his tie.

The four images found on the second puzzle.

The Unicode logo was found to be for a specific version of Unicode, released in 1998. The images combined gave players a string of numbers: 319982178. Using this tool and the string of numbers as a key, players received the solution Continue.

Continue

This discovery led players to this page, which only contains the text: urmrhsvw. This was found to be a substitution cipher, and decoded to finished, leading to a final page, which contained the text:

Congratulations, if you are reading this you have completed the Exagen hiring test. 

To continue with you application process please email [email protected] with the following code in the subject bar: 319982178 and we will get back to you shortly. 

Welcome

On September 14th, 2017, Players who had mailed the adress with the code received the following e-mail:

The e-mail received when you send the code to the test email adress

This email has two attached files: An NDA, and a resume:

Resume that came with the acceptance email

The email also contained a link to a new page: welcome.html. This page plays a video introducing you to the exagen labs, and telling you where you will be working. Transcription of video:

Welcome to Exagen Laboratories.
Congratulations on passing our hiring test.
At Exagen our plan is to create a better future.
We are working hard making revolutionairy discoveries in medicine, technology and general sience.
We want to make the world a better place by stepping on things such as cancer, down syndrome and other diseases and disorders that make life difficult.
We want everyone to have a happy, long lived life.
You are currently located in the employee briefing room. Take a moment to look around.
(camera pans out from screen to reveal a large room, slowly turning to the right to look out of 2 large windows into a hallway before turning back to the screen.)
You can find your designated office space on level 4, room 410.
Your employee orientation meeting will take place at 12pm in the employee lounge on level 3.
Thank you for joining us, we look forward to working with you.

During the last line, the screen glitches, making a noise and changing into the following image:

Glitched screen from welcome.html video

After the video plays, the page redirects you to an e-mail account inbox, containing 4 emails.

Email 1:

Welcome to Exagen, new Employee, this is your work email
Harold Ox ([email protected]) to me September 10, 2012 - 1:23 PM

Welcome Exagen Employee,

This is your email, you are to use this for internal messaging.

Do not use this email for personal messages, allowed domains are on a whitelist. 

We hope you enjoy working at Exagen. 
Harold Ox - CEO Exagen Labs

Email 2:

Greetings
Frank Burgess ([email protected]) to me September 11, 2012 - 11:32 AM

Hey John, Congratulations on getting hired. 

Things are pretty hectic here but I just wanted to say hello. 

I am in room 312 if you ever need anything. 

Regards, Frank

Email 3:

Presentation
Steven Giles ([email protected]) to me September 13, 2012 - 1:54 PM

Great work on the presentation today. I am very happy that Todd put you on the Amantensin development team.
Look forward to working with you. 

Regards, Steve

Email 4:

Fill out
Robert Studdard ([email protected]) to me Today - 10:27 AM

Just got this from Steven, I need you to fill it out and sign off on it. 

Download Attachment


Regards, Robert

It also contained a journal entry: journal entry 1:

[September 10th 2012] 

This all seems insane. From applying to a simple laboratory to signing NDAs and getting transported via Military helicopter to an underground research bunker. 
Better keep my head down.

The attachement mentioned in the 4th email is a pdf containing a pdf form for a new drug named Amantensin:

pdf containing FDA form for Amantensin

Numbers = ?

On September 15th, 2017, at 16:56 UTC, the players who e-mailed the test e-mail address with the code received the following email:

%%%%%%%%%%%%%%%%%%
HAHAHAHAHAHAH
%%%%%%%%%%%%%%%%%%
ITS IN THERE

        LOOK CLOSER

                  VERY CLOSE



NUMBERS = ?
%%%%%%%%%%%%%%%%%

This lead players to find that the numbers in the PDF, 6 9 14 4/1 20/5 24 1 7 5 14 is a Numbers-Letters cipher for FIND AT EXAGEN.

On September 19, 2017, at around 17:45 UTC, a new version of the PDF was found, and contained Morse hidden in the color channels:

This Morse decodes to IM IN HERE, CHANGED SOME THINGS.

Sept. 21 Preludes

On Septmeber 21, the email service received a new email from Steven Giles and a new journal entry from John Trevino. (For clarification, we, the participants, are John Trevino.)

The email read the following:

Hey John,
Just wanted to let you know that we will be having another Amantensin meeting on the 24th of September.
I will send you another email before the presentation so you can prepare yourself.

Regards,
Steve 

The journal entry then read:

[September 21st 2012]

Something was certainly off about that form. I emailed the address I discovered however, I still haven't received a response. Maybe someone is just trying to mess with me. 

The SSTV Revelation

On September 24, two emails were received, one stating the Amantensin meeting was canceled, and the other stating the same thing, but much more visually corrupted.

Basic cancellation email:

Hey John,
The meeting has been postponed for a few days.
Take some time to relax

Regards,
Steve 

The corrupted email:

HEy JoHN,
THE MEeting has been POSTponed for a fEw daaYys.
Take sOMe time to ...

Regards,
StEVe


exagen.org/webmail/-/sound.html 

The link lead to a blank web page, with SSTV audio playing in the background.

When decoded, the audio showed the following image.

The decoded SSTV signal.

After 2 days, users were finally able to get to the next step.

The link was https://exagen.org/webmail/-/youfoundme.html

The page contained a riddle of sorts, on top of a blue background. (See Right)

The youfoundme page.

The riddle reads the following.

Slowly I leave the world.
Yet still I exist.
It gets closer with every step.
Until it consumes me alive.

SYIU

As of September 30th, the corrupted email was changed, and a link to a transparent image containing 4 dashes was added. Users discovered that the 4 underlines lined up with 4 letters in the riddle, and spelled out SYIU , which led users to find this page.

The description for the SYIU drug.

The bottom of the description read Insert UNKNOWN = /-/ , which led users to also find https://exagen.org/webmail/-/UNKNOWN.html , a cryptically edited version of the welcome video.

At the 0:36 mark, grainy text can be seen in the video, as seen in the image below:

The text from the UNKNOWN video.

Using the image shown on the right the players managed to decode the greek characters and found out the string reads as follows: cf1e3b03

Cpiher used to decocde greek letters in the UNKNOWN video

After many hints from the PM, the players figured out that the string is actually hashed using the hashing type murmur3, with the decoded value truning out to be: hidden This led to the webpage hidden.html which auto-redirects to hidden.png. The image can also be seen below.

Image on the hidden.png site

This page is a work in progress and will be updated as more comes to light.