Exagen
| Exagen | |
|---|---|
| Exagen was an unofficial ARG made by Discord users. | |
| Type | [[List_of_Investigations#Independent|Independent]] |
| Creator | Prime and ICallHax |
| Discovered | 2017-08-16 |
Contents
Exagen is the prequel for Society X, and is made by the same puppetmasters.
The Beginning
On August 16th, 9:05 PM UTC, A discord user by the name of Charles J. Cruz posted a link in the Game Detectives, and SCX discord with a message.
Charles J. Cruz - Today at 9:05 PM The Government needs to stop lying. http://bobbywatersconspiracy.ga/
The site had a contact email, and a bitcoin address.
(The bitcoin address was removed shortly after)
Upon contacting the email, Bobby Waters responds:
From: Bobby Waters <[email protected]> 22:37 (43 minutes ago) Hi *, I have posted my website on many websites and social media platforms as a form of self promotion. And while I don't directly need help for my story on Exagen Laboratories, I would recommend for you to educate yourself on the issue. While Exagen has been pretty quiet for the whole 12 years that they have been allowed to operate on our tax dollars, they are slowly starting to become more public. I'm sure you'll be able to find more about them somewhere online. Regards, Bobby
Looking for "Exagen Laboratories" on youtube brought this link.
A frame from the video showed another link, which at the time of discovery had only read "Coming Soon".
Upon contacting Bobby Waters again about the video and website findings, this is what he responds.
From: Bobby Waters <[email protected]> 23:03 (2 minutes ago) Hi *, Good work! I was already aware of the website and the video however I wanted to encourage you to go out there and look for it yourself. The website has been up for a few days and it seems that Exagen is trying to launch a site as part of them becoming more public. It seems like the website is currently only a default coming soon page but, I would expect the site to come online somewhere within the next week or two. Regards, Bobby
This gives the info that the Exagen Laboratories site is coming online "within the next week or two."
Exagen Laboratories
On September 8th, at 8:03 UTC, https://exagen.org/ changed to say Website in developement, opening September 10, 2012.
Opening
On September 10th, at a currently unknown time, the aforementioned Exagen website was fully opened. When on the site, there are four links, the home page, an about page, projects page, and a careers page.
- The home page lists the fields Exagen specializes in and why.
- The about page contains
Exagen's Mission, which is:
Exagen's plan is to create a better future. We are working hard making revolutionary discoveries in medicine, technology, and general science. We want to make the world a better place by stepping on things such as cancer, down syndrome and other diseases and disorders that make life difficult. We want everyone to have a happy, long lived life. Exagen has created over 20 different medicines, all making life a little bit better.
- The projects page lists 3 drugs in production by Exagen: Amantensin, ZTil, and Decontynal.
Amantensin is described as a drug being developed to help level out cholesterol levels in men over the age of fourty."
ZTil is described as a sleep aid being developed to help people suffering from Insommia.
Decontynal is described as a work in progress brain stimulant being developed with the goal of alleviating symptoms of schizophrenia.
Near the bottom of all pages on the website is a link to Exagen's Careers Page, which reads:
Getting started with Exagen careers We are looking for talented individuals with majors in the fields of Bio-Chemistry, General Chemistry, Environmental Sciences, Medical Sciences, and Biomedical Engineering. If you're interested in working with Exagen, please email [email protected]
Test 1
On September 11th, at 11:49 PM UTC, users who emailed the careers address received a message back consisting of a link to a hidden page on the Exagen website. The page consisted of a white screen with a code on it.
IKOTISHUUHSWTUHEWATLE_AHGELIMHOR_LRHFDTOFFB_
The solution was found through double transposition, and when decoded, read the following.
IWALKTHROUGHTHEFIELDSWITHAMOUTHFULOFHERBS_
When players sent emails to [email protected] with the message I walk through the fields with a mouthful of herbs_ , they received the response:
I come out in times of epidemic. I helped victims in one of most devastating pandemics known to man.
When the phrase Plague Doctor was sent to [email protected], players received an email containing the text .html. This led players to find the next step.
Plague Doctor
The plague doctor page contained an image, and the text:
HJTX3gAAAAOMx02LO2VqA83T3Wopao3jBQlWVwZ7V7u/KaoQ6Mvu1rYtOKhlsW4odYERbCNBDJnq43j1hRYtLuAb+h/16sLwpnWMwxLih0KXsD78hd5MiKtdae3cQU1/CcgRrjFKArssJHSnE3Bx+VlW6RfGYzrsS1FIGkjxJFTmPG2I3hMwcPnXZ2nZBsh5F487C7OwlLHbsG5SSi4m9H4ds/hUBKkpQKpiVk2JdfMU8f9Mj4oekwYIPGZLUZQg51hs9KM3J9H/LDtNyolSuDn86YaQCKbp
The image consists of 4 different objects, including the roman numeral 3, the Unicode logo, a clock stuck at 14:17, and a falling man, with a small "8" on his tie.
The Unicode logo was found to be for a specific version of Unicode, released in 1998. The images combined gave players a string of numbers: 319982178. Using this tool and the string of numbers as a key, players received the solution Continue.
Continue
This discovery led players to this page, which only contains the text: urmrhsvw. This was found to be a substitution cipher, and decoded to finished, leading to a final page, which contained the text:
Congratulations, if you are reading this you have completed the Exagen hiring test. To continue with you application process please email [email protected] with the following code in the subject bar: 319982178 and we will get back to you shortly.
Welcome
On September 14th, 2017, Players who had mailed the adress with the code received the following e-mail:
This email has two attached files: An NDA, and a resume:
The email also contained a link to a new page: welcome.html. This page plays a video introducing you to the exagen labs, and telling you where you will be working. Transcription of video:
Welcome to Exagen Laboratories. Congratulations on passing our hiring test. At Exagen our plan is to create a better future. We are working hard making revolutionairy discoveries in medicine, technology and general sience. We want to make the world a better place by stepping on things such as cancer, down syndrome and other diseases and disorders that make life difficult. We want everyone to have a happy, long lived life. You are currently located in the employee briefing room. Take a moment to look around. (camera pans out from screen to reveal a large room, slowly turning to the right to look out of 2 large windows into a hallway before turning back to the screen.) You can find your designated office space on level 4, room 410. Your employee orientation meeting will take place at 12pm in the employee lounge on level 3. Thank you for joining us, we look forward to working with you.
During the last line, the screen glitches, making a noise and changing into the following image:
After the video plays, the page redirects you to an e-mail account inbox, containing 4 emails.
Email 1:
Welcome to Exagen, new Employee, this is your work email Harold Ox ([email protected]) to me September 10, 2012 - 1:23 PM Welcome Exagen Employee, This is your email, you are to use this for internal messaging. Do not use this email for personal messages, allowed domains are on a whitelist. We hope you enjoy working at Exagen. Harold Ox - CEO Exagen Labs
Email 2:
Greetings Frank Burgess ([email protected]) to me September 11, 2012 - 11:32 AM Hey John, Congratulations on getting hired. Things are pretty hectic here but I just wanted to say hello. I am in room 312 if you ever need anything. Regards, Frank
Email 3:
Presentation Steven Giles ([email protected]) to me September 13, 2012 - 1:54 PM Great work on the presentation today. I am very happy that Todd put you on the Amantensin development team. Look forward to working with you. Regards, Steve
Email 4:
Fill out Robert Studdard ([email protected]) to me Today - 10:27 AM Just got this from Steven, I need you to fill it out and sign off on it. Download Attachment Regards, Robert
It also contained a journal entry: journal entry 1:
[September 10th 2012] This all seems insane. From applying to a simple laboratory to signing NDAs and getting transported via Military helicopter to an underground research bunker. Better keep my head down.
The attachement mentioned in the 4th email is a pdf containing a pdf form for a new drug named Amantensin:
Numbers = ?
On September 15th, 2017, at 16:56 UTC, the players who e-mailed the test e-mail address with the code received the following email:
%%%%%%%%%%%%%%%%%%
HAHAHAHAHAHAH
%%%%%%%%%%%%%%%%%%
ITS IN THERE
LOOK CLOSER
VERY CLOSE
NUMBERS = ?
%%%%%%%%%%%%%%%%%
This lead players to find that the numbers in the PDF, 6 9 14 4/1 20/5 24 1 7 5 14 is a Numbers-Letters cipher for FIND AT EXAGEN.
On September 19, 2017, at around 17:45 UTC, a new version of the PDF was found, and contained Morse hidden in the color channels:
This Morse decodes to IM IN HERE, CHANGED SOME THINGS.
Sept. 21 Preludes
On Septmeber 21, the email service received a new email from Steven Giles and a new journal entry from John Trevino. (For clarification, we, the participants, are John Trevino.)
The email read the following:
Hey John, Just wanted to let you know that we will be having another Amantensin meeting on the 24th of September. I will send you another email before the presentation so you can prepare yourself. Regards, Steve
The journal entry then read:
[September 21st 2012] Something was certainly off about that form. I emailed the address I discovered however, I still haven't received a response. Maybe someone is just trying to mess with me.
The SSTV Revelation
On September 24, two emails were received, one stating the Amantensin meeting was canceled, and the other stating the same thing, but much more visually corrupted.
Basic cancellation email:
Hey John, The meeting has been postponed for a few days. Take some time to relax Regards, Steve
The corrupted email:
HEy JoHN, THE MEeting has been POSTponed for a fEw daaYys. Take sOMe time to ... Regards, StEVe exagen.org/email/-/sound.html
The link lead to a blank web page, with SSTV audio playing in the background.
When decoded, the audio showed the following image.
After 2 days, users were finally able to get to the next step.
The link was https://exagen.org/email/-/youfoundme.html
The page contained a riddle of sorts, on top of a blue background. (See Right)
The riddle reads the following.
Slowly I leave the world. Yet still I exist. It gets closer with every step. Until it consumes me alive.
SYIU
As of September 30th, the corrupted email was changed, and a link to a transparent image containing 4 dashes was added. Users discovered that the 4 underlines lined up with 4 letters in the riddle, and spelled out SYIU , which led users to find this page.
.png)
The bottom of the description read Insert UNKNOWN = /-/ , which led users to also find https://exagen.org/email/-/UNKNOWN.html , a cryptically edited version of the welcome video.
At the 0:36 mark, grainy text can be seen in the video, as seen in the image below:
Using the image shown on the right the players managed to decode the greek characters and found out the string reads as follows:
cf1e3b03
After many hints from the PM, the players figured out that the string is actually hashed using the hashing type murmur3, with the decoded value truning out to be:
hidden
This led to the webpage hidden.html which auto-redirects to hidden.png. The image can also be seen below.
As of October 6th, hidden.html updated to show a hint.
When editing the picture with paint, players found a w at the bottom right where blood could be found. This led to the webpage w.html. The only phrase that can be seen on the page is 4 below and 2 left.. Players had to refer themselves to welcome.html to solve the puzzle. Using the phrase when looking at the plan of the 4th Level from Exagen Laboratories, players got the number 008 which, upon entering it on the weblink as an .html, led to 008.html.
When looking at the html-code, players could see a comment on line 129.
Players then started to edit the webpage, only to reveal 4 specific dots. PM pointed out that nothing can be done at the time; players need to wait until new puzzles have been discovered.
Video
On the 6th of November, the webmail updated to show 2 new mails.
Steve Boudreaux ([email protected]) to me November 1, 2012 Hi John, I'm currently doing some last minute solution checks for the Amantensin tablet proportions. Would it be possible to talk tomorrow, just want to make sure I don't get anything wrong. Thanks, Steve. B
Ivan Johnson ([email protected]) to me October 17, 2012 Hey John, Just wanted to let you know we will be doing a test debriefing later this week Still not sure when, so I will let you know when the debrief comes up. Regards, Ivan
Also, when going back to the html code of 008.html, players could see a comment that read the following: video. If you were to put "video" into the standard format of the earlier urls. You would get to this website. The website itself is just a looping video that has 2 letters hidden in the video, and a puppet-head.
PM gave a hint that players needed a piece from a previous puzzle in order to solve this one. Going back to w.html, players could make why out of the 3 letters, which gave us why.html.
The only thing on the webpage is the cipher:
cmhncmhncmhncmhncmhncmh ncmhncmhnmcmhncmhncmhnc mhncmhnjmhncmhncmhncmhn cmhnmcmhncmhncmhncmhncm hncmhncmhncmhncmhncmhnc mhncmhncmhncmhncmhncmhn cmhncmhncmhnwcomhncmhncm hncmhncmhncmhnycmhncmhnc mhncmhncmhncmhncmhncmhn cmhnmcmhncmhncmhncmhncm hncmhncmhnwcmhncmhnckmhn cmhncmhn
Players were unable to find the CORRECT answer and thus PM gave the answer so the ARG could continue. Using ROT 20, the text would translate to:
wgbhwgbhwgbhwgbhwgbhwgb hwgbhwgbhgwgbhwgbhwgbhw gbhwgbhdgbhwgbhwgbhwgbh wgbhgwgbhwgbhwgbhwgbhwg bhwgbhwgbhwgbhwgbhwgbhw gbhwgbhwgbhwgbhwgbhwgbh wgbhwgbhwgbhqwigbhwgbhwg bhwgbhwgbhwgbhswgbhwgbhw gbhwgbhwgbhwgbhwgbhwgbh wgbhgwgbhwgbhwgbhwgbhwg bhwgbhwgbhqwgbhwgbhwegbh wgbhwgbh
This led to finding the 3 letters which would make up d i e. Putting "die" in the standard .html form, you will be brought here. This is what the page shows:
Later, the tab's name of die.html got updated to show DIE for 1073
The page itself says nothing that players think is important. However, there is a .wav file hidden within a zip file form the page. Upon putting this through spectrogram, you can see this:
This then led to players thinking about 5, thus entering the 5 in the standard .html form. This is where you'll be brought to. In this page, all that can be heard (there is nothing to be seen on the page) is another .wav file which, again, could be turned to an image using spectrogram.
Players could find 3 x's in the image, and put 3 in the .html form to give them a new webpage. The only thing that is on the page, is 0342
This page is a work in progress and will be updated as more comes to light.
