Difference between revisions of "Society X"

From Game Detectives Wiki
Jump to: navigation, search
[unchecked revision][checked revision]
m (The Rebirth?)
 
(35 intermediate revisions by 7 users not shown)
Line 4: Line 4:
 
| name = {{PAGENAME}}
 
| name = {{PAGENAME}}
 
| description = You are not alone.
 
| description = You are not alone.
| creator = Discord users Prime and ICallHax
+
| creator = Prime
| type = [[List_of_Investigations#Type|Independent]]
+
| creator2 = ICallHax
 +
| type = Unofficial
 
| status = Completed
 
| status = Completed
 
| image = File:scxlogo.png
 
| image = File:scxlogo.png
 
| discovered = 2016-10-26
 
| discovered = 2016-10-26
 
}}
 
}}
 +
__TOC__
 +
<span id="BackToTop"></span>
 +
<div class="noprint" style="text-align:center; border-radius:10px; box-shadow: 5px 5px; background-color:#CFCFCF; position:fixed; bottom:2%; left:1.5%; width:100px; padding:0; margin:0;">
 +
[[#top|Return to Top]]
 +
</div>
  
 
==Day 1==
 
==Day 1==
 
===The Beginning===
 
===The Beginning===
On October 26, 2016, at around 7PM EDT, a user (Prime) came into the GameDetectives Discord and said:
+
On October 26, 2016, at about 19:00 EDT, Discord user Prime came into the GameDetectives server, and said:
<blockquote>so i have a website, and it was getting DOSed (by one IP), I traced that ip and got to SocietyX.net, I looked through the source code and found a link to a password page. i posted it to the ohnickel discord, then while i was looking around at my sites files, i found "lol.html"
+
 
 +
<pre>
 +
so i have a website, and it was getting DOSed (by one IP), I traced that ip and got to SocietyX.net, I looked through the source code and found a link to a password page. i posted it to the ohnickel discord, then while i was looking around at my sites files, i found "lol.html"
 
https://itspri.me/ <<my website
 
https://itspri.me/ <<my website
  
Line 20: Line 28:
  
 
https://itspri.me/lol.html <<the file i found
 
https://itspri.me/lol.html <<the file i found
</blockquote>
+
</pre>
 +
 
 
===The Homepage===
 
===The Homepage===
The homepage for the SocietyX website shows the logo in ASCII art, with a video running in the background. Clicking on a specific character in the logo goes to [https://www.societyx.net/Bwb4wHHb8I.php a password page]. The source of the password page shows this:
+
The SocietyX [http://societyx.net/ homepage] displays the text "SocietyX.net" written in ASCII art, and displays a looping video in the background of the page. Clicking on a specific character in the "t" in society leads the user to a [https://www.societyx.net/Bwb4wHHb8I.php new page], which prompts the user for a password. The source of the password page contained the following text:
 
<pre> <!--
 
<pre> <!--
 
    __    __                                        _   
 
    __    __                                        _   
Line 38: Line 47:
 
-->
 
-->
 
</pre>
 
</pre>
 +
 
===The Password===
 
===The Password===
The password is given as flashing letters and numbers in the background of the homepage: Z8L0N2G
+
The correct password was found to be the string "Z8L0N2G," the characters of which are repeatedly displayed in the looping video on the homepage.
  
After entering the password, another string appears: gk1qk
+
Once the password was entered, another string appeared, "gk1qk." When entered into the prompt, it revealed the text:
  
That string can be entered into the prompt, which gives:
+
<pre>
<pre>Caw Caw, Tweet Tweet c:
+
Caw Caw, Tweet Tweet c:
 
Together, but not together.
 
Together, but not together.
 
9a78211436f6d42~5ec38f5c4e02270801f3524f8
 
9a78211436f6d42~5ec38f5c4e02270801f3524f8
 
</pre>
 
</pre>
9a78211436f6d42~5ec38f5c4e02270801f3524f8 is a Sha1 hash for @9a78211436f6d42, which leads to a twitter account with one tweet:
 
<pre>u4sNeZB3ua.47425e4490d1548713efea3b8a6f5d778e4b1766
 
  
c: <3</pre>
+
9a78211436f6d42~5ec38f5c4e02270801f3524f8 is a Sha1 hash for @9a78211436f6d42, which lead to a [https://twitter.com/9a78211436f6d42 Twitter account] that had made a single tweet:
47425e4490d1548713efea3b8a6f5d778e4b1766 is another Sha1 hash for "php". This leads to [https://www.societyx.net/u4sNeZB3ua.php another page], titled "Love."
+
 
The page slowly prints text, that reads:
+
<pre>
<pre>~$ echo "I love SocietyX."
+
u4sNeZB3ua.47425e4490d1548713efea3b8a6f5d778e4b1766
 +
 
 +
c: <3
 +
</pre>
 +
 
 +
47425e4490d1548713efea3b8a6f5d778e4b1766 was found to be another Sha1 hash for "php." This lead to [https://www.societyx.net/u4sNeZB3ua.php another page], titled "Love." The page then slowing printed text, which read:
 +
<pre>
 +
~$ echo "I love SocietyX."
 
I love SocietyX.
 
I love SocietyX.
  
Line 101: Line 116:
 
Sometimes, the answer is you.
 
Sometimes, the answer is you.
 
</pre>
 
</pre>
 +
 
===Smart Little Butterflies===
 
===Smart Little Butterflies===
 
The last message from "Love" leads to [https://www.societyx.net/qut1eLkzbp.php another password prompt.] The password is the user's IP.
 
The last message from "Love" leads to [https://www.societyx.net/qut1eLkzbp.php another password prompt.] The password is the user's IP.
Line 321: Line 337:
  
  
Discord user faa8146 found a [https://www.reddit.com/r/gamedetectives/comments/59remz/hello/ reddit post by the PM] that reads:
+
A player found a [https://www.reddit.com/r/gamedetectives/comments/59remz/hello/ reddit post by the PM] that reads:
 
<pre>hi guys!!! YQ== I'm new, I was bg== wondering what this subeA==reddit is for?????? aQ==I'm new to reddit and dont know how to ZXQ= use it! help meQ==??!
 
<pre>hi guys!!! YQ== I'm new, I was bg== wondering what this subeA==reddit is for?????? aQ==I'm new to reddit and dont know how to ZXQ= use it! help meQ==??!
 
</pre>
 
</pre>
Line 425: Line 441:
  
 
In addition to this, a spectogram revealed "C," "JO," and "4" between the words.
 
In addition to this, a spectogram revealed "C," "JO," and "4" between the words.
 
[[File:Scxspectogrambrkdwn.jpg]]
 
  
 
This clue took a while to decipher, which made the PM impatient.
 
This clue took a while to decipher, which made the PM impatient.
Line 509: Line 523:
 
</pre>
 
</pre>
 
They are lyrics from a song by Arts the Beatdoctor & Bless of SHAHMAN, titled "Part of the Crow." The song's lyrics primarily deal with death.
 
They are lyrics from a song by Arts the Beatdoctor & Bless of SHAHMAN, titled "Part of the Crow." The song's lyrics primarily deal with death.
Discord user Shadow Spade found [https://www.societyx.net/4f14c08f988ebf91b846da810b1a1b99e988623e the link to the next page] by encrypting the word "death" using sha1. This leads to a page with a massive button that says "download death," leading to societyx.png. When societyx.png is manipulated, there is a string of data at the very top of the image:
+
Players found [https://www.societyx.net/4f14c08f988ebf91b846da810b1a1b99e988623e the link to the next page] by encrypting the word "death" using sha1. This leads to a page with a massive button that says "download death," leading to societyx.png. When societyx.png is manipulated, there is a string of data at the very top of the image:
  
 
[[File:Societyxmanipulated.gif]]
 
[[File:Societyxmanipulated.gif]]
Line 528: Line 542:
 
415ab40ae9b7cc4e66d6769cb2c08106e8293b48
 
415ab40ae9b7cc4e66d6769cb2c08106e8293b48
 
</pre>
 
</pre>
This passage uses multiple different encryption methods, including sha1,md5, md4, NTLM, and some others. Instead of continuing to translate this passage, Discord user Lexicon found [https://www.societyx.net/60eb7e5f19f749bff6c73caea6de7fb0b54f27f8 the link], which is a sha1 of the word "darkness." This page shows a video called "Crow.mp4." In the metadata for this video, there is a strange string:
+
This passage uses multiple different encryption methods, including sha1,md5, md4, NTLM, and some others. Instead of continuing to translate this passage, a solver found [https://www.societyx.net/60eb7e5f19f749bff6c73caea6de7fb0b54f27f8 the link], which is a sha1 of the word "darkness." This page shows a video called "Crow.mp4." In the metadata for this video, there is a strange string:
  
 
[[File:Crowmeta.png]]  
 
[[File:Crowmeta.png]]  
  
Discord user A4 found that the string is part of a URL for an unlisted YouTube video, called "..................................," found at [https://www.youtube.com/watch?v=R2lGqS8jYbE this URL]. The text in the description of the video (7e6f31cfc162d6c21b116b6b0e1e3eb5718a6841) leads to [https://www.societyx.net/7e6f31cfc162d6c21b116b6b0e1e3eb5718a6841 another page on the SocietyX website.] There is no content in the page, but the page itself is titled "soon," implying that we have to wait once again.
+
A player found that the string is part of a URL for an unlisted YouTube video, called "..................................," found at [https://www.youtube.com/watch?v=R2lGqS8jYbE this URL]. The text in the description of the video (7e6f31cfc162d6c21b116b6b0e1e3eb5718a6841) leads to [https://www.societyx.net/7e6f31cfc162d6c21b116b6b0e1e3eb5718a6841 another page on the SocietyX website.] There is no content in the page, but the page itself is titled "soon," implying that we have to wait once again.
  
 
==Day 12==
 
==Day 12==
Line 538: Line 552:
 
===STILL HERE===
 
===STILL HERE===
  
On November 4, Discord user Anorak discovered that the "soon" (https://www.societyx.net/7e6f31cfc162d6c21b116b6b0e1e3eb5718a6841) page had changed again. In it, a video is now embedded, on which flash the words "STILL HERE" and the date "11/6/16," implying that something will happen on November 6.
+
On November 4, a player discovered that the "soon" (https://www.societyx.net/7e6f31cfc162d6c21b116b6b0e1e3eb5718a6841) page had changed again. In it, a video is now embedded, on which flash the words "STILL HERE" and the date "11/6/16," implying that something will happen on November 6.
  
 
===Your Turn===
 
===Your Turn===
Line 547: Line 561:
 
Towards the end of the conversation, SCX said "I miss you," but deleted it very quickly afterwards.
 
Towards the end of the conversation, SCX said "I miss you," but deleted it very quickly afterwards.
  
As of November 7, the Soon page changed yet again, into a prompt asking for a username and password. Thanks to Discord user faa8146 and the usage of SQL injection, the credentials were found to be:
+
As of November 7, the Soon page changed yet again, into a prompt asking for a username and password. Using SQL injection, the credentials were found to be:
  
 
<pre>
 
<pre>
Line 563: Line 577:
 
This link leads to https://www.societyx.net/09bc7b2dcc9a510f4ab3a40c47f7a4cb77954356, which has a download button. When the download button is clicked, the page goes to a mega.nz page for "scx.ova," which is 745 mb. The .ova extension signifies a virtual machine file. However, the file only opens in VMware, and not VirtualBox.
 
This link leads to https://www.societyx.net/09bc7b2dcc9a510f4ab3a40c47f7a4cb77954356, which has a download button. When the download button is clicked, the page goes to a mega.nz page for "scx.ova," which is 745 mb. The .ova extension signifies a virtual machine file. However, the file only opens in VMware, and not VirtualBox.
  
Within the .ova file Discord user faa8146 found the following picture as the desktop background:
+
Within the .ova file players found the following picture as the desktop background:
  
 
[[File:GlitchX.jpg]]
 
[[File:GlitchX.jpg]]
Line 610: Line 624:
 
</pre>
 
</pre>
  
Within the registries of the VM file, Discord user faa8146 found the text:
+
Within the registries of the VM file, solvers found the text:
  
 
<pre>
 
<pre>
Line 678: Line 692:
 
</pre>
 
</pre>
  
When put together, it says: "Im shriveled in my shell, lonely but ready, to become who I am, to become my real self." The solution to this riddle was found by Discord user A4, revealing the page https://www.societyx.net/caterpillar. The title consists of an ASCII caterpillar, and contains the text "d8de455cd8129f6efc0a896419e2bcb6."  
+
When put together, it says: "Im shriveled in my shell, lonely but ready, to become who I am, to become my real self." The solution to this riddle was <code> caterpillar </code>, revealing the page https://www.societyx.net/caterpillar. The title consists of an ASCII caterpillar, and contains the text "d8de455cd8129f6efc0a896419e2bcb6."  
  
This was found to be a Snefru hash, translating to "you are getting 063c0217," leading to the page https://www.societyx.net/063c0217. "063c0217" was found by Discord user Shadow Spade to be a snefru hash, and translated to the word "close." This, like the last page, has the same ASCII caterpillar as a title. The contents of the page are the text:
+
This was found to be a Snefru hash, translating to "you are getting 063c0217," leading to the page https://www.societyx.net/063c0217. "063c0217" was found by solvers to be a snefru hash, and translated to the word "close." This, like the last page, has the same ASCII caterpillar as a title. The contents of the page are the text:
  
 
<pre>
 
<pre>
HJTX3gAAAANEakCtjQcCwDQ02ejz8BzBcUxm+0KgwsFDulGPr71UnHC7xN754rpzjEDaAv9XIZvnKb4P4eUhOvzDNuh4S9rVvNkZvWgrxx70uEOsxBGE/BVQ+/zhg+0lCl2DqKswe3aPQ86whsXr/3ntz9qfu+qmlzNiAqm+uvzMXZj904nSFChE+c0lO26ZxXS3hhZsVZDVWD8UrhxMXuH4EJMCw73wDzaKAuDG8me8GYgEEr5q+Zey0ypxhgjvKtPwbt11hmSo0vdPWd25l+Un4F38YKHNmzcdOU885S9vebSxInZJcyg0wGXPmwx5vd916BU5GQU=
+
HJTX3gAAAANEakCtjQcCwDQ02ejz8BzBcUxm+0KgwsFDulGPr71UnHC7xN754rpzjEDaAv9XIZvnKb4P4eUhOvzDNuh4S9rVvNkZvWgrxx70uEOsxBGE/BVQ+/zhg+0lCl2DqKswe3aPQ86whsXr/
 +
3ntz9qfu+qmlzNiAqm+uvzMXZj904nSFChE+c0lO26ZxXS3hhZsVZDVWD8UrhxMXuH4EJMCw73wDzaKAuDG8me8GYgEEr5q+Zey0ypxhgjvKtPwbt11hmSo0vdPWd25l+Un4F38YKHNmzcdOU885S9vebSxInZJcyg0wGXPmwx5vd916BU5GQU=
 
</pre>
 
</pre>
  
Line 716: Line 731:
 
</pre>
 
</pre>
  
Discord user Shadow Spade translated the morse to say "they are sick."
+
Players translated the morse to say "they are sick."
  
 
===Sick===
 
===Sick===
  
By hashing the word "sick" in MD5 with the password "theyaresick," Discord user Amkorra found the page https://www.societyx.net/6de7382d33c5a20dad65c6f9d835aec029f67fca. The title of the page is "more soon. close.," and plays peaceful music over a video of waves crashing.
+
By hashing the word "sick" in MD5 with the password "theyaresick," players found the page https://www.societyx.net/6de7382d33c5a20dad65c6f9d835aec029f67fca. The title of the page is "more soon. close.," and plays peaceful music over a video of waves crashing.
  
Within the metadata of the audio file playing on this page, Discord user Brendan found the following text:
+
Within the metadata of the audio file playing on this page, solvers found the following text:
  
 
<pre>
 
<pre>
Line 735: Line 750:
 
</pre>
 
</pre>
  
While SCX fixed the hash, the author of the music was found by Discord user Falko:
+
While SCX fixed the hash, the author of the music was found by the participants:
  
 
<pre>
 
<pre>
Line 743: Line 758:
 
</pre>
 
</pre>
  
After a little while, Discord user TheKingJaffa found there to be text in a frame of the video, revealing another hash:
+
After a little while, players found there to be text in a frame of the video, revealing another hash:
 
 
 
[[file:N7dVsoI.png]]
 
[[file:N7dVsoI.png]]
  
Line 761: Line 775:
  
  
Discord user A4 tried to translate this into an English version:
+
Some players tried to translate this into an English version:
  
 
<pre>
 
<pre>
Line 779: Line 793:
 
</pre>
 
</pre>
  
This prompted Discord user Blinky to find the font of the Greek hash (http://fontzone.net/font-details/greek-normal), which was called "Greek Normal." Using this font, the AES hash was translated to be:
+
This prompted players to find the font of the Greek hash (http://fontzone.net/font-details/greek-normal), which was called "Greek Normal." Using this font, the AES hash was translated to be:
  
 
<pre>
 
<pre>
Line 837: Line 851:
 
=="I am the Anomaly."==
 
=="I am the Anomaly."==
  
On December 13, 2016, Discord user Brendan discovered that the source had changed to contain the B64 "R3VyIE5hYnpueWwgdmYgam5ncHV2YXQuLi4=," which translates to "The Anomaly is watching." Anomaly is a character in the Lost Memories ARG, implying that the two are merged.
+
On December 13, 2016, players discovered that the source had changed to contain the B64 "R3VyIE5hYnpueWwgdmYgam5ncHV2YXQuLi4=," which translates to "The Anomaly is watching." Anomaly is a character in the Lost Memories ARG, implying that the two are merged.
  
 
Later on the same day, SCX sent another message in the Discord:
 
Later on the same day, SCX sent another message in the Discord:
Line 847: Line 861:
 
</pre>
 
</pre>
  
Discord user Lexicon found this to be an MD5 hash for "infinite." This leads to the link https://www.societyx.net/infinite, which shows a looping video of the infinity sign, and several words repeated, as found by Discord user Brendan:
+
Solvers found this to be an MD5 hash for "infinite." This leads to the link https://www.societyx.net/infinite, which shows a looping video of the infinity sign, and several words repeated.
  
 
<pre>
 
<pre>
Line 858: Line 872:
 
==Recovered Files/The End==
 
==Recovered Files/The End==
  
"The Final Moments" page updated with a "Recovered Files" button, which downloads a RAR file with a password. Discord user Arca guessed the password, which was "1234." The file extracted is "--1.txt" which contains "a1ea5461c70014e5c7cb6ddff30988ca62142804", a SHA-1 of destruction
+
"The Final Moments" page updated with a "Recovered Files" button, which downloads a RAR file with a password. A player guessed the password, which was "1234." The file extracted is "--1.txt" which contains "a1ea5461c70014e5c7cb6ddff30988ca62142804", a SHA-1 of destruction
  
 
societyx.net/a1ea5461c70014e5c7cb6ddff30988ca62142804 is a page with a button labeled  
 
societyx.net/a1ea5461c70014e5c7cb6ddff30988ca62142804 is a page with a button labeled  
Line 884: Line 898:
 
* --------.rar is passworded with an unknown password. Looking at the file in a hex editor shows that the rar contains --------.txt
 
* --------.rar is passworded with an unknown password. Looking at the file in a hex editor shows that the rar contains --------.txt
  
After bruteforcing, Discord user faa8146 found the password of the rar to be "192345," and the contents of the text file to be:
+
After bruteforcing, a player found the password of the rar to be "192345," and the contents of the text file to be:
  
 
<pre>
 
<pre>
Line 890: Line 904:
 
</pre>
 
</pre>
  
Discord user faa8146 found this to be ascii85 encoding, decrypting to a broken postimg link:
+
Solvers found this to be ascii85 encoding, decrypting to a broken postimg link:
  
 
https://postimg.org/gallery/1esvd0i1q/
 
https://postimg.org/gallery/1esvd0i1q/
Line 900: Line 914:
 
</pre>
 
</pre>
  
This turned out to be hex for another post image link: https://postimg.org/gallery/25m2261cu/. This leads to a gallery of the glitched SCX logo, and what Discord user Anorak found to be an email, "[email protected]." However, this seemingly led to a dead end.  
+
This turned out to be hex for another post image link: https://postimg.org/gallery/25m2261cu/. This leads to a gallery of the glitched SCX logo, and what players found to be an email, "[email protected]." However, this seemingly led to a dead end.  
  
Discord user faa8146 discovered that there was a 7zip file hidden within "scx29.jpg." This file was not passworded, and contained a 3D model of a plague doctor mask, and a passworded rar file. The 3D file has the name "b1c1d8736f20db3fb6c1c66bb1455ed43909f0d8," which is sha1 for "me."  
+
Solvers discovered that there was a 7zip file hidden within "scx29.jpg." This file was not passworded, and contained a 3D model of a plague doctor mask, and a passworded rar file. The 3D file has the name "b1c1d8736f20db3fb6c1c66bb1455ed43909f0d8," which is sha1 for "me."  
  
 
[[File:plaguemask.png]]
 
[[File:plaguemask.png]]
Line 922: Line 936:
 
</pre>
 
</pre>
  
This lead to the page https://www.societyx.net/cc88d6531c448e2b71d475f129ff0485245acaa9, titled "I'm Sorry." In addition, Discord user faa8146 found the page https://www.societyx.net/thanks, which thanked everyone in the Discord for their participation, suggesting that the ARG has concluded. It is not clear whether it was supposed to conclude, or if it was unexpected.
+
This lead to the page https://www.societyx.net/cc88d6531c448e2b71d475f129ff0485245acaa9, titled "I'm Sorry." In addition, a player found the page https://www.societyx.net/thanks, which thanked everyone in the Discord for their participation, suggesting that the ARG has concluded. It is not clear whether it was supposed to conclude, or if it was unexpected.
  
 
Later on, a button titled "log" appeared at the bottom of the thanks page. This lead to the file "Log-2124.txt," and contained a series of diary entries:
 
Later on, a button titled "log" appeared at the bottom of the thanks page. This lead to the file "Log-2124.txt," and contained a series of diary entries:
Line 976: Line 990:
 
</pre>
 
</pre>
  
Multiple discord users sent emails to this address, each of which received a different response. If "I won't leave." is sent, the user will receive an email saying "Yes you will." Discord user MonoDj(#0650) received [https://cdn.discordapp.com/attachments/241067658924130306/288129742652047361/Screen_Shot_2017-03-05_at_8.04.23_PM.png an email] saying "You are the one. Xajin wants you," [https://cdn.discordapp.com/attachments/241067658924130306/288131408675995649/Screen_Shot_2017-03-05_at_8.11.16_PM.png an email] saying "they need you," and [https://cdn.discordapp.com/attachments/241067658924130306/288132316398616587/Screen_Shot_2017-03-05_at_8.14.44_PM.png an email] saying "they just do496e7475af3e4ca0fbe0e592ed807bfff1a50450," but the hash was not decoded. Finally, Mono received [https://cdn.discordapp.com/attachments/241067658924130306/288135297739259905/Screen_Shot_2017-03-05_at_8.26.43_PM.png another email] with a phone number in the header. When called, it typically went to voice mail, but for some, short breaths could be heard before it was hung up. Then, morse could be heard, which has yet to be decoded or recorded.  
+
Multiple discord users sent emails to this address, each of which received a different response. If "I won't leave." is sent, the user will receive an email saying "Yes you will." a player received [https://cdn.discordapp.com/attachments/241067658924130306/288129742652047361/Screen_Shot_2017-03-05_at_8.04.23_PM.png an email] saying "You are the one. Xajin wants you," [https://cdn.discordapp.com/attachments/241067658924130306/288131408675995649/Screen_Shot_2017-03-05_at_8.11.16_PM.png an email] saying "they need you," and [https://cdn.discordapp.com/attachments/241067658924130306/288132316398616587/Screen_Shot_2017-03-05_at_8.14.44_PM.png an email] saying "they just do496e7475af3e4ca0fbe0e592ed807bfff1a50450," but the hash was not decoded. Finally, Another player received [https://cdn.discordapp.com/attachments/241067658924130306/288135297739259905/Screen_Shot_2017-03-05_at_8.26.43_PM.png another email] with a phone number in the header. When called, it typically went to voice mail, but for some, short breaths could be heard before it was hung up. Then, morse could be heard, which has yet to be decoded or recorded.  
  
 
After this, scx said to join the voice chat on the Discord server. He did not speak, but he played the same morse from the phone number before leaving again. In the end, Discord user Prime entered the chat, and revealed that he and ICallHax were the puppetmasters of the ARG: Prime talked through scx, while ICallHax created the website. He said that the ARG was over, but they would do something similar again soon.
 
After this, scx said to join the voice chat on the Discord server. He did not speak, but he played the same morse from the phone number before leaving again. In the end, Discord user Prime entered the chat, and revealed that he and ICallHax were the puppetmasters of the ARG: Prime talked through scx, while ICallHax created the website. He said that the ARG was over, but they would do something similar again soon.
 
==The Rebirth?==
 
 
On August 16, 9:05 PM UTC Time, A discord user by the name of Charles J. Cruz posted a link in the Game Detectives, and SCX discord with a message.
 
 
<pre>
 
Charles J. Cruz - Today at 9:05 PM
 
The Government needs to stop lying. http://bobbywatersconspiracy.ga/
 
</pre>
 
 
The site had a contact email, and a bitcoin address.
 
 
(The bitcoin address was removed shortly after)
 
 
Upon contacting the email, Bobby Waters responds:
 
 
<pre>
 
From: Bobby Waters <[email protected]> 22:37 (43 minutes ago) 
 
 
Hi *,
 
 
Thank you for the support. I would love to chat with you today however, I am currently busy looking into the Exagen Laboratories story I have been doing on the site.
 
 
Regards,
 
Bobby
 
</pre>
 

Latest revision as of 03:06, 6 June 2018

Main Page > List of Investigations > Society X

Society X
Completed
Scxlogo.png
You are not alone.
Type Unofficial
Creators Prime & ICallHax
Discovered 2016-10-26

Day 1

The Beginning

On October 26, 2016, at about 19:00 EDT, Discord user Prime came into the GameDetectives server, and said:

so i have a website, and it was getting DOSed (by one IP), I traced that ip and got to SocietyX.net, I looked through the source code and found a link to a password page. i posted it to the ohnickel discord, then while i was looking around at my sites files, i found "lol.html"
https://itspri.me/ <<my website

http://societyx.net/ <<hacking site

https://itspri.me/lol.html <<the file i found

The Homepage

The SocietyX homepage displays the text "SocietyX.net" written in ASCII art, and displays a looping video in the background of the page. Clicking on a specific character in the "t" in society leads the user to a new page, which prompts the user for a password. The source of the password page contained the following text:

 <!--
	     __     __                                        _   
             \ \   / /                                       | |  
              \ \_/ /__  _   _    __ _ _ __ ___   _ __   ___ | |_ 
               \   / _ \| | | |  / _` | '__/ _ \ | '_ \ / _ \| __|
                | | (_) | |_| | | (_| | | |  __/ | | | | (_) | |_ 
                |_|\___/ \__,_|  \__,_|_|  \___| |_| |_|\___/ \__|
                                 _                  
                                | |                   
                            __ _| | ___  _ __   ___   
                           / _` | |/ _ \| '_ \ / _ \  
                          | (_| | | (_) | | | |  __/_ 
                           \__,_|_|\___/|_| |_|\___(_)
-->

The Password

The correct password was found to be the string "Z8L0N2G," the characters of which are repeatedly displayed in the looping video on the homepage.

Once the password was entered, another string appeared, "gk1qk." When entered into the prompt, it revealed the text:

Caw Caw, Tweet Tweet c:
Together, but not together.
9a78211436f6d42~5ec38f5c4e02270801f3524f8

9a78211436f6d42~5ec38f5c4e02270801f3524f8 is a Sha1 hash for @9a78211436f6d42, which lead to a Twitter account that had made a single tweet:

u4sNeZB3ua.47425e4490d1548713efea3b8a6f5d778e4b1766

c: <3

47425e4490d1548713efea3b8a6f5d778e4b1766 was found to be another Sha1 hash for "php." This lead to another page, titled "Love." The page then slowing printed text, which read:

~$ echo "I love SocietyX."
I love SocietyX.


~$ echo "I love SocietyX."
I love SocietyX.


~$ echo "I love SocietyX."
I love SocietyX.


~$ echo "You are here, and we are here."
You are here, and we are here.


~$ echo "I love SocietyX."
I love SocietyX.


~$ echo "I love SocietyX."
I love SocietyX.


~$ echo "I love SocietyX."
I love SocietyX.


~$ echo "Your curiosity must get the better of you sometimes."
Your curiosity must get the better of you sometimes.


~$ echo "I love SocietyX."
I love SocietyX.


~$ echo "I love SocietyX."
I love SocietyX.


~$ echo "I love SocietyX."
I love SocietyX.


~$ echo "<a href="qut1eLkzbp.php">Sometimes, the answer is you.</a>"
Sometimes, the answer is you.

Smart Little Butterflies

The last message from "Love" leads to another password prompt. The password is the user's IP.

Entering it gives the text Aren't you a smart little butterfly!. Additionally, the following appears in the source code of the page:

!--  _--_                                     _--_
/#()# #\         0             0         /# #()#\
|()##  \#\_       \           /       _/#/  ##()|
|#()##-=###\_      \         /      _/###=-##()#|
 \#()#-=##  #\_     \       /     _/#  ##=-#()#/
  |#()#--==### \_    \     /    _/ ###==--#()#|
  |#()##--=#    #\_   \!!!/   _/#    #=--##()#|
   \#()##---===####\   O|O   /####===---##()#/
    |#()#____==#####\ / Y \ /#####==____#()#|
     \###______######|\/#\/|######______###/
        ()#y#/      ##\_#_/##      \#S#()
       ()#1#(__-===###/ _ \###===-__)#O#()
      ()#F#(   #  ###_(_|_)_###  #   )#C#()
      ()#K(---#__###/ (_|_) \###__#---)I#()
      ()#r#( / / ##/  (_|_)  \## \ \ )#E#()
      ()##Y#\_/  #/   (_|_)   \#  \_/#T##()
       \)##SO#\ -)    (_|_)    (- /#OY##(/
        )//##B.php|    / | \    |*OOOX#\(
        |/_####_/    ( /X\ )    \_####_\|
       /X/ \__/       \___/       \__/ \X\
      (#/                               \#)-->

The text in the bottom right of the butterfly leads to y1FKrYSB.php. The page reads Well, that's it. You've won. Congrats.

The title of the page is 8utt3rfl1, which leads to another .php link. Upon visiting the page, it begins to draw a butterfly. The background fades to white, revealing the text I <3 SCX. Viewing the page source shows this:

<!--
	     __     __
             \ \   / /
              \ \_/ /__  _   _    __ _ _ __ ___
               \   / _ \| | | |  / _` | '__/ _ \
                | | (_) | |_| | | (_| | | |  __/
                |_|\___/ \__,_|  \__,_|_|  \___|
                                 _
                                | |
                            __ _| | ___  _ __   ___
                           / _` | |/ _ \| '_ \ / _ \
                          | (_| | | (_) | | | |  __/_
                           \__,_|_|\___/|_| |_|\___(_)
-->

I HATE SCX

The butterfly page leads to a link, I<3SCX.html. After about twenty minutes, the page started to change. At first, the page changed from fading to white to fading to red. Eventually, the I <3 SCX changed to I HATE SCX.

The PM began to use the page to communicate:

YOU GUYS WERE QUICK, I WASN'T EXPECTING IT

MAYBE WE SHOULD WORK TOGETHER

OR MAYBE I'LL GIVE YOU A NEW CLUE

I KNOW YOU'RE FREAKING OUT, SPAMMING F5 LIKE THE LITTLE BUTTERFLY YOU ARE.

At this point, the Discord users began to try to attempt to learn if the PM was in Discord with them. Discord user Lucario posted you know it :wink: , which was immediately posted on the page.

The PM began to post more messages:

I love you too Lucario

sorry my dad called me, which was another quote from a Discord user.

get off my website

Finally, the text went blank, and was then replaced with:

See you tomorrrow? You guys might get a surprise tomorrow <3 :)

Day 2

First discovered at 8AM EDT, the I<3SCX page had updated. The comment now read v=ObU98LCo_Xs , pointing to a youtube video.

A frame of the video contains a sha1 hash, ce91ec4cccd5ee41c080fa62d2bceb0b41a18445, which reads "ihatex," leading to a page of the same name.

A garbled text-to-speech reads You're smart, and I was not expecting it. I know you all, you cute little bugs. The metadata of the mp3 reads SMART LITTLE PUPPY ARENT YOU... 482bcddc8fe53ed1e68c77a95aab5f83

It contains an md5 hash for "discord," which leads to a page that redirects to an invite link to a server named "scx," with one channel, "#2-," with the description "you get two minutes."

Discord

After about an hour, a user (scx#7056) began to speak in chat. A full log follows:

Brendan: echo "I love SocietyX."
Brendan: I love SocietyX.
Brendan: oh yeah tru you can't have non-tagged bots anymore
Brendan: hm

scx: I love SocietyX

Brendan: I love SocietyX
B.: I love SocietyX

scx: I do too

B.: Why do you love SocietyX

scx: It is not that I love SocietyX, It is that SocietyX loves me.
scx: It exists
scx: And does not
scx: We are it
scx: And it is us

holyhearted: so
holyhearted: if it's a society
holyhearted: who is part of it

scx: It is a thing and it is not

holyhearted: well that's just
holyhearted: really weird

scx: The world is weird

holyhearted: no, just you
Brendan: savage
A4: what does "you get 2 minutes" mean?
A4: and how do we proceed further

scx: We are all it.
scx: Everyone is a part of it now

Brendan: spooopy

scx: Everything 
 Screams
  in 
   my
    dreams
      tonight.

Brendan: okay now we getting creepy

scx: That is all you need to know.

“Everything screams in my dreams tonight”, is a quote from Suzanne Collins’s Mockingjay. It is unknown if that is relevant at this time.

After noon, SCX said something again:

TronLegacy1: wait...
TronLegacy1: scx mentioned something
TronLegacy1: it exists but it does not
TronLegacy1: It's like the elder scrolls in the elder scrolls
TronLegacy1: they have all ways existed but always never have

scx: It is not that someone created it, but rather that an alternate meaning is present

Later, SCX posted another message, 7a3gh64m. It leads to a page titled "It's Everywhere" containing a riddle:

What has no hands but grips you tight and squeezes out your grit? 
What whispers warnings in your ear and makes you lose all wit? 
What has no fangs yet bites down hard and causes valor’s bleed? 
What makes the indomitable spirit of man concede?

The answer to this riddle was "fear". Hashing this with sha1 lead to a new page with a hidden comment:

<!--Hey Babe, Wanna Chat at 5?-->

Hovering over the o in the A in fear gave a prompt: "They're Watching." Some users noticed the cheet module loaded on this page, without a call. However, this was quickly removed.

Anxiety

5 hours later, SCX came into #2- to chat.

scx: Hey babe.

Lucario: hey hey

scx: How was your day?

Tron: Good, how are you

scx: I'm good.

Prime: Who is watching?

scx: They are watching.

Tron: Who is?

scx: they are.

Tron: Who are "they"

scx: They.

Lucario: Why are you doing this?

scx: Why not.
¯\_(ツ)_/¯

scx: Who am I?
I am you.

Tron: Who is Society X?

scx: SocietyX is a revolution.

Lucario: what kind of revolution?

scx: A Society Revolution.

ICallHax: what is the next clue?

scx: babe, if I dont respond right away, im browsing reddit btw
whats the next clue?
I don't know.

Tron: K babe, but will we see you again?

scx: I don't know.

faa8146: https://www.reddit.com/r/gamedetectives/comments/59remz/hello/

scx: You're quick. Props.
I must go now. Love you babe 😘


A player found a reddit post by the PM that reads:

hi guys!!! YQ== I'm new, I was bg== wondering what this subeA==reddit is for?????? aQ==I'm new to reddit and dont know how to ZXQ= use it! help meQ==??!

There are snippets of Base64 in his post, which decode to a n x i et y, which leads to another page titled "THEYRE AROUND ME," with text reading "THEY'RE ALL AROUND ME. HELP ME. HELP."

The page plays an audio file that contains a spectrogram that reads zUiAUtQ8. This led to another page titled ".", with text only reading "Yes."

Additionally, taking the B64 snippets and removing the "=" seemed to lead to a page with the text "What is life? .....................it's never ending pain." with an HTML comment of:
<!--HeLp-->

Shortly after, scx came back into discord:

faa: scx, are you here?

scx: i am here.

B.: Would you like to talk

scx: Why would I risk my anonymity.

The Lone Mimikyu: How do you feel, @scx?

scx: Lonely.

Tron: Any good emotions?

scx: No.

PinkSkie1: Can we help you?

scx: No.

Mimikyu: Why don't you?

scx: Why do I not what?

Mimikyu: Feel any good emotions;

scx: Sometimes, I feel as though I am two.

Tron: The man with two souls. A ref to Doctor Jec and Mr Hide

scx: 'Man.'

Halke234: What are you?

scx: I am neither.
I am nothing.
I am Emptyness.
I am darkness.
I am alone.
I am fear
and I am feared.
Fear is everywhere.
But that's okay.
We all deal with it.

Pink: We have nothing to fear but fear itself?

scx: We have nothing to fear, but fear itself. Yes.
But what is fear?
Is it the inevitably of death? A misuse of imagination?

Tron: Or is it Fear itself?

scx: That is a loop. It just does not check out.

Mimikyu: We are told to fear all our life.

scx: I don't fear death.

Pink: What do you fear?

scx: I fear myself.

The Next One

Discord user ICallHax's version of societyx.net updated to show You're next on the main page.

Shortly thereafter, it was discovered that Hax's website, fragstorm.net, also contains a "lol.html" page that mirrors Prime's.

On SCX's discord, both Prime and Hax have a role titled "Loved." Additionally, SCX has the role of "unloved."

Day 3

null.mp4

The video embedded in zUjAUtQ8 is called "null.mp4", and is 42 seconds long. Various words and phrases are in the video, and have different counts:

IAMDYING 1
hOLD 1+2
(Lonely?) Unhappy 1
Sad 1
dREAMING 1+2+4
hELL 1+1+3
Anger 1
Unhappy 1
Depressed 1
12481631 1
Kill 1+1+1
5 YEARS 5

In addition to this, a spectogram revealed "C," "JO," and "4" between the words.

This clue took a while to decipher, which made the PM impatient.

scx: I'M DONE
T͡he̸ Mimikyu: With what?
Prime: with what
scx: I
scx: AM
scx: DONE.
Fruitbread: no you’re scx
T͡he̸ Mimikyu: What are you done with?
TronLegacy1: @scx INSTRUCTIONS NOT CLEAR
ICallHax: ?
scx: I SWEAR
Yeti: nice 1 bread
scx: YOU GUYS ARE IMBICILS
Fruitbread: thx @Yeti
Prime: rood
TronLegacy1: ....
T͡he̸ Mimikyu: @scx  I am truly sorry for the memes.
TideSinger: Im offended
TideSinger: My memes are dank
CrystalShyps 💤: can’t even spell imbicile right, ironic
scx: SHUT THE FUCK UP
scx: SHUT
Shypwreck: LMAO
scx: THE FUCK UP
TideSinger: Shhhhh guys
T͡he̸ Mimikyu: I ruined this.
scx: FIGURE IT OUT.
!!"Ą͝͝ńǫ̶̕r̨a͏k̨̢͜": I like your stuff It looks cool too bad I cant change audio to something legible
scx: THIS CLUE IS EASY
faa8146: Are you dying?
scx: FIGURE
scx: IT
scx: OUT.
...
scx: I'm lonely.
scx: and Sad.
TronLegacy1: (EVERYONE SHUT UP)
scx: I'm missing something.
T͡he̸ Mimikyu: Its ok, @scx
T͡he̸ Mimikyu: We all feel lonely.
scx: You're missing something.
TronLegacy1: I am missing a mind
!!"Ą͝͝ńǫ̶̕r̨a͏k̨̢͜": C    J0    4
scx: We're missing something.

On 29 Oct 2016, the source of zUjAUtQ8 was found to be different than the original non-HTML page, and it showed:

<body class="fade a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a   ">
    <video playsinline autoplay loop poster="#000000" id="bgvid">
    <source src="media/null.mp4" type="video/mp4">
</video>
</body>

In addition to this, the word "Anxiety" was spelled out in different pieces throughout the code.

From this addition to the code, we were able to find the next clue, which was at the URL. This was found by combining the letters found in the spectrogram and the first letter of every word/phrase repeated in null.mp4.

The URL leads to a timer, which counts down to approximately 18:00:00 on 31 Oct 2016. However, for Prime, the countdown ends at 21:00:00 on 29 Oct 2016. It was thought that this was related to Prime's role of "loved" in the scx Discord server. However, ICallHax, who also has this role, saw that the countdown ends on 18:00:00 on the 31st as well, so does not seem to be related to the "loved" role.

Death

During the two days before the countdown ended, the PM, SCX, did not show up to talk to us at 17:00:00 PST.

After the timer was finished, the page updated to be titled sorry i'm late with a new string of sha1 hashes:

 8e3b005ff3fb5cab6fff6a93b36ac8faaca621f6
becce3c77d0792aebddc03d75f3c591d8c1c46d1 
43c310799fa753f8a43bf826ebce5e765c3ca804

The hashes decode to read:

Remaining strong
Till the day
That the faith is gone

They are lyrics from a song by Arts the Beatdoctor & Bless of SHAHMAN, titled "Part of the Crow." The song's lyrics primarily deal with death. Players found the link to the next page by encrypting the word "death" using sha1. This leads to a page with a massive button that says "download death," leading to societyx.png. When societyx.png is manipulated, there is a string of data at the very top of the image:

Societyxmanipulated.gif

When this section of the image is cropped and saved as a bitmap file, the string of binary is easily readable:

This binary translates to:

3c363836cf4e16666669a25da280a1865c2d2874
0cc175b9c0f1b6a831c399e269772661
7a1b96563495a2286ab79687369c07b3
8254c329a92850f6d539dd376f4816ee2764517da5e0235514af433164480d7a
a87d8f7ff9267bad515057f7a7f772c469d2536b70f1e8e770f9a5581922b986520a3d7
1d952f30593bcfa2318bfeb0d
4992A157B9ECC2A7D2066FEFF64967D3
5335f048bddebe600ae6edb89b36da3a2d7c18bc53b83e2fa577cc9a4f262fc1c3741830955303a0158e7d48be7965f8
2c1ee68372215b1ce064426b5cdbd4ef2581ace0dd3b21fa2be27f364827242e83f68b68be03f5b3e24be5d1b4315f98a0a96d19713fb3a19dc455fb6adc3431
415ab40ae9b7cc4e66d6769cb2c08106e8293b48

This passage uses multiple different encryption methods, including sha1,md5, md4, NTLM, and some others. Instead of continuing to translate this passage, a solver found the link, which is a sha1 of the word "darkness." This page shows a video called "Crow.mp4." In the metadata for this video, there is a strange string:

Crowmeta.png

A player found that the string is part of a URL for an unlisted YouTube video, called "..................................," found at this URL. The text in the description of the video (7e6f31cfc162d6c21b116b6b0e1e3eb5718a6841) leads to another page on the SocietyX website. There is no content in the page, but the page itself is titled "soon," implying that we have to wait once again.

Day 12

STILL HERE

On November 4, a player discovered that the "soon" (https://www.societyx.net/7e6f31cfc162d6c21b116b6b0e1e3eb5718a6841) page had changed again. In it, a video is now embedded, on which flash the words "STILL HERE" and the date "11/6/16," implying that something will happen on November 6.

Your Turn

On November 6th, at around 20:51:00, SCX came on again, after a week long absence, for 4 minutes.

Here is the conversation.

Towards the end of the conversation, SCX said "I miss you," but deleted it very quickly afterwards.

As of November 7, the Soon page changed yet again, into a prompt asking for a username and password. Using SQL injection, the credentials were found to be:

Username: SocietyX
Password: ' OR '1=1

Once this is done correctly, the text below displays at the top of the page:

Welcome User: SocietyX
Your next order of business is: 09bc7b2dcc9a510f4ab3a40c47f7a4cb77954356

This link leads to https://www.societyx.net/09bc7b2dcc9a510f4ab3a40c47f7a4cb77954356, which has a download button. When the download button is clicked, the page goes to a mega.nz page for "scx.ova," which is 745 mb. The .ova extension signifies a virtual machine file. However, the file only opens in VMware, and not VirtualBox.

Within the .ova file players found the following picture as the desktop background:

GlitchX.jpg

In addition, there is a file on the desktop called "log.txt," which includes the text:

January 4th 1998:


	No progress yet, starting to think that this was pointless.


January 18th 1998:


	WHY????


January 24th 1998:


	WHERE IS IT??? I know it's here, I can hear you.


January 25th 1998:
	
	I had to hide it in here, I can't risk them finding out. I know they are watching.


January 26th 1998:


In addition, the recycling bin contains a shortcut called "59ea424568c393a39971aac664b73d9f" to a deleted text file with the same name. This is a MD5 hash for "somewhere." When the text file was recovered, it was found to contain the text "5e1b680f8a9c42f3d085628d63d80c26," which is a MD5 hash for "chase me."

On November 9, 2016, scx sent the following messages in the Discord:

scx: @everyone It is deeper then you think. No photos, videos, sounds. You will find it at the bottom of the ocean where you least excpect it hidden deep within the system.
…
scx: Look deeply inside what I gave you.
…
scx: The vm I sent contains everything needed in your journey. Look deep inside. That is all.

Within the registries of the VM file, solvers found the text:

[HKEY_USERS\.DEFAULT\Network]
@="69b75c1522d4926b75f0adbc74938f17"

This is an MD5 hash for the word "plague," and leads to the page https://www.societyx.net/plague on the SCX website.

Plague

This page has a title "." and contains the content:

      m
I

dlvrs
 eeih

n
i

y
m

,lh
les

yeo
lnl

tb
 u

,de
yar

o
t

eoe
mcb

ow
 h

I

,a
 m

o
t

eoe
mcb

y
m

le
ar

.ls
 fe

When put together, it says: "Im shriveled in my shell, lonely but ready, to become who I am, to become my real self." The solution to this riddle was caterpillar , revealing the page https://www.societyx.net/caterpillar. The title consists of an ASCII caterpillar, and contains the text "d8de455cd8129f6efc0a896419e2bcb6."

This was found to be a Snefru hash, translating to "you are getting 063c0217," leading to the page https://www.societyx.net/063c0217. "063c0217" was found by solvers to be a snefru hash, and translated to the word "close." This, like the last page, has the same ASCII caterpillar as a title. The contents of the page are the text:

HJTX3gAAAANEakCtjQcCwDQ02ejz8BzBcUxm+0KgwsFDulGPr71UnHC7xN754rpzjEDaAv9XIZvnKb4P4eUhOvzDNuh4S9rVvNkZvWgrxx70uEOsxBGE/BVQ+/zhg+0lCl2DqKswe3aPQ86whsXr/
3ntz9qfu+qmlzNiAqm+uvzMXZj904nSFChE+c0lO26ZxXS3hhZsVZDVWD8UrhxMXuH4EJMCw73wDzaKAuDG8me8GYgEEr5q+Zey0ypxhgjvKtPwbt11hmSo0vdPWd25l+Un4F38YKHNmzcdOU885S9vebSxInZJcyg0wGXPmwx5vd916BU5GQU=

In addition to this hash, morse code seems to be playing on the page, from a file called "---.wav."

----- .---- ----- .---- ----- .---- ----- -----
 
----- .---- .---- ----- .---- ----- ----- -----
 
----- .---- .---- ----- ----- .---- ----- .----
 
----- .---- .---- .---- .---- ----- ----- .----
 
----- ----- .---- ----- ----- ----- ----- -----
 
----- .---- .---- ----- ----- ----- ----- .----
 
----- .---- .---- .---- ----- ----- .---- -----
 
----- .---- .---- ----- ----- .---- ----- .----
 
----- ----- .---- ----- ----- ----- ----- -----
 
----- .---- .---- .---- ----- ----- .---- .----
 
----- .---- .---- ----- .---- ----- ----- .----
 
----- .---- .---- ----- ----- ----- .---- .----
 
----- .---- .---- ----- .---- ----- .---- .----

Players translated the morse to say "they are sick."

Sick

By hashing the word "sick" in MD5 with the password "theyaresick," players found the page https://www.societyx.net/6de7382d33c5a20dad65c6f9d835aec029f67fca. The title of the page is "more soon. close.," and plays peaceful music over a video of waves crashing.

Within the metadata of the audio file playing on this page, solvers found the following text:

HJTX3gAAAAM; Xe9Z3Oy+uTYXxmuJ+TPnqPfeS5GrESv9iagoJzGsdRyB8csabpkkkSXtr9468wXbPCaAarpfYCuZI5Mgs23EEvJZ; pje4KkfKkwau; dcSc4UogxB5SuP74eaB84certXYCfPgJN8xF2Y+dmI50K6CKdywyDnsO1FJvFnEon2MGQc6ZsfGiCakHFzZTXr6rsN3MYYNpQLfPJ63rZwnUJuxc; KF7HEdl8izxtecRb+5CndL9qT...; 

After a few hours of trying to crack the B64 hash on November 13, 2016, SCX came on and said:

scx - Today at 7:18 PM
It's broken. Wait.

While SCX fixed the hash, the author of the music was found by the participants:

Title: Across a Sea
Artist: oOoOO
Album: Without Your Love

After a little while, players found there to be text in a frame of the video, revealing another hash: N7dVsoI.png

This hash appears to be Base64, and consists mostly of Greek characters. The transcribed version of the hash is:

ΗϑΤΞ3γΑΑΑΑΜΨΟΝδτvσυμΧΞΩα259βδεΔ7ηΛϕ8ξσIΣΓΗ
5ΜΦΥΩΩδΦΩοΦαζλΝψϕιη2ΡμγΛεΓ1αλκ8ϖ1Ξ/ϕΘμθ3Ε9α
σχΣ2ϑση7ΜΙρϖπΓωοΜτΚϕΤπΦλιγΖξιΥ1ΚφΤΨΨΜΑ/67ΒρσθΙΙΜ
γ0ντΩ+ιΩΝηιΟρβΠΣυΖ3ΞρΥΖχ29ϖωΟΟα4κ7ζυΚνΝΑτ+ε
ΝΚρου5ζΔκ9δι1ϑτ96ΔϑλΑΖΓΧΕξαΗαΥχηΙΒνϖΥ/ΣΕ/Φ9Ν5δα
φ6/ςΜΤ4κΔΟΖαΛΦ4υκοΑε9κ/ΦϑαϑΑΩΔφ2Χγ/ρζ75ΤΣ5ϖΔΦ+3
ζλϕ6ΓΔΠρ7ΑΡΩκΟ96Χητ1Υ=


Some players tried to translate this into an English version:

GxSN3aAAAALWOMbrkqsjVNXY259ZbcD7eKy8lqIRCG
5LUTXXbUXmUYdiMvyge2QjaKcC1Yih8z1N/yHjf3E9Y
quR2xqe7LIoznCwmLrJySnUigaFlgT1JtSWWLA/67BoqfIIL
a0krX+gXMegOoZPRsF3NoTFu29zwOOY4h7dsJkMAr+c
MJoms5dDh9b1xg96DxiDxAFCVElYGYTueIBkzT/RE/U9M6bY
t6/pLS4hDOFYKU5shmAc9h/UxYxAXDt2Va/od75SR5zDU+3
diy6CDo7AQhO96Ver1T=

On November 18, 2016, SCX gave another hint:

J'ai font un puzzle.

This prompted players to find the font of the Greek hash (http://fontzone.net/font-details/greek-normal), which was called "Greek Normal." Using this font, the AES hash was translated to be:

HJTX3gAAAAMYONdtnsumCXWa259bdeD7hLf8xsISGH5MFUWWdFWoFazlNyfih2RmgLeG1alk8v1X
/fQmq3E9ascS2Jsh7MIrvpGwoMtKfTpFligZxiU1KjTYYMA/67BrsqIIMg0ntW+
iWNhiOrbPSuZ3XrUZc29vwOOa4k7zuKnNAt+eNKrou5zDk9di1Jt96DJlAZGCExaHaUchIBnvU/
SE/F9N5daj6/VMT4kDOZaLF4ukoAe9k/FJaJAWDj2Cg/rz75TS5vDF+3zlf6GDPr7ARWkO96Cht1U=

The password of this hash was found to be the artist of the music in the previous page "oOoOO," revealing the text "Y93sMgrOtD." This leads to the page https://www.societyx.net/Y93sMgrOtD, which has a title of "end it all," and contains the text:

Why have I done this? Why am I still alive. help me. help.

Day 20

After a week with no contact, SCX returned to the Discord on December 1st, 2016, with a single message:

scx - Yesterday at 1:22 AM
735b3b2d
@everyone ...

This was found to be a farmHashFingerprint32 hash, and translated to say:

the key to waiting is patience

Later on the first, SCX posted another message:

scx - Yesterday at 10:47 PM
@everyone ...
863a42a944c93a3dd793fa0d6f4ae8d52c1161b0

scx - Yesterday at 10:47 PM
You know the drill.

This leads to this page on the website, which has the text:

PLEASE STANDBY_

"THE FINAL MOMENTS"

SOCIETYX


In addition, the text "863a42a944c93a3dd793fa0d6f4ae8d52c1161b0" is a sha1 hash for "standby," and the page's title consists of three periods.

"I am the Anomaly."

On December 13, 2016, players discovered that the source had changed to contain the B64 "R3VyIE5hYnpueWwgdmYgam5ncHV2YXQuLi4=," which translates to "The Anomaly is watching." Anomaly is a character in the Lost Memories ARG, implying that the two are merged.

Later on the same day, SCX sent another message in the Discord:

scx - Yesterday at 10:52 PM
9973653bcbccee1bc5b133b43978979f
@everyone ...

Solvers found this to be an MD5 hash for "infinite." This leads to the link https://www.societyx.net/infinite, which shows a looping video of the infinity sign, and several words repeated.

different
separate
unique
infinite

Recovered Files/The End

"The Final Moments" page updated with a "Recovered Files" button, which downloads a RAR file with a password. A player guessed the password, which was "1234." The file extracted is "--1.txt" which contains "a1ea5461c70014e5c7cb6ddff30988ca62142804", a SHA-1 of destruction

societyx.net/a1ea5461c70014e5c7cb6ddff30988ca62142804 is a page with a button labeled

??????????????????????????u??`?????_l????°??o?????gs???????_???????´???¯???^???????_?????????????????-?????????

Which downloads the file "logs.rar."

This rar isn't passworded, and contains 4 files:

    --------.rar
    ....jpg
    ..txt
    log - 2124.txt
  • ..txt contains the text "secret"
  • ....jpg is a blank black image, verified to contain nothing else
  • log - 2124.txt contains a long string encrypted with TripleSec, unknown password. An online decrypter for trying passwords can be found at https://md5hashing.net/crypto
  • --------.rar is passworded with an unknown password. Looking at the file in a hex editor shows that the rar contains --------.txt

After bruteforcing, a player found the password of the rar to be "192345," and the contents of the text file to be:

BQS?8F#ks-E,Tf>Bl.K8DfTJDB45UmATE&L0kGELA2%^PEA%

Solvers found this to be ascii85 encoding, decrypting to a broken postimg link:

https://postimg.org/gallery/1esvd0i1q/

Not long afterwards, Discord user ICallHax discovered the page https://www.societyx.net/deathiscoming, which contained:

68747470733a2f2f706f7374696d672e6f72672f67616c6c6572792f32356d3232363163752f

This turned out to be hex for another post image link: https://postimg.org/gallery/25m2261cu/. This leads to a gallery of the glitched SCX logo, and what players found to be an email, "[email protected]." However, this seemingly led to a dead end.

Solvers discovered that there was a 7zip file hidden within "scx29.jpg." This file was not passworded, and contained a 3D model of a plague doctor mask, and a passworded rar file. The 3D file has the name "b1c1d8736f20db3fb6c1c66bb1455ed43909f0d8," which is sha1 for "me."

Plaguemask.png

The 3D model had 4 codes written on it:

01101011
01101100
01101001
01101100

This is binary for the word "kill," which is the password for the rar. Within the rar was a file called "scx.dll," which would not open in any version of windows, even though it was supposed to. After a week of trying, scx posted the following message:

scx - Yesterday at 9:11 PM
@everyone  cc88d6531c448e2b71d475f129ff0485245acaa9

This lead to the page https://www.societyx.net/cc88d6531c448e2b71d475f129ff0485245acaa9, titled "I'm Sorry." In addition, a player found the page https://www.societyx.net/thanks, which thanked everyone in the Discord for their participation, suggesting that the ARG has concluded. It is not clear whether it was supposed to conclude, or if it was unexpected.

Later on, a button titled "log" appeared at the bottom of the thanks page. This lead to the file "Log-2124.txt," and contained a series of diary entries:

Log Entries:

December-12-2124: It's over. They are launching the final bombs on North America today. There will be no survivors. The Decontynal keeps us relatively sane while we live out our last few shitty days in this laboratory. We all have our ups and downs, Rachel almost killed Adam yesterday out of pure rage which developed almost instantly. I checked our Decontynal reserves today and it looks like we have just enough left to be able to function sanely for another couple of days before we become mad just like those things on the surface.

	---
	---
	---

December-13-2124: The bombs hit us yesterday. Everything on the surface is gone. Europe isn't any better either. From what the drones gathered before running out of fuel, everything there is also just fire and rubble. We lost Jannet today as well. Found her lying dead on the floor with a gun in her hand. I overheard John and Rachel talking about overdosing and leaving this wasteland together.
I guess this really is the end of the world.

	---
	---
	---

December-14-2124: I sent the message. I was finally able to connect to the satellite and try to get the attention of what we now call "Delta E51". I know there is nothing I can do to save us or our world, but I can at least try and warn the others through all these openings. Ever since we first made contact we have been able to communicate with other worlds which we would never have been able to even see but now that we know how to contact each other I can warn them about what happened to us. 

	---
	---
	---

December-15-2124: I am the last one left. John, Rachel, and Adam are gone and I am now alone. We also ran out of Decontynal. I guess today will be my last day. If anyone reads this please don't make our mistakes, we screwed up and now I have to live with billions of people dying and turning insane all because of us. I am sorry.

	---
	---
	---

December-16-2124:

The End?

On March 5, 2017, SCX posted a new image, and wrote:

scx - Last Sunday at 12:26 AM
Please don't leave me like everyone else.

scx - Last Sunday at 12:28 AM
Please don't leave

This image was revealed to contain a QR code, which, when scanned, reveals:

[email protected]
I won't leave.

Multiple discord users sent emails to this address, each of which received a different response. If "I won't leave." is sent, the user will receive an email saying "Yes you will." a player received an email saying "You are the one. Xajin wants you," an email saying "they need you," and an email saying "they just do496e7475af3e4ca0fbe0e592ed807bfff1a50450," but the hash was not decoded. Finally, Another player received another email with a phone number in the header. When called, it typically went to voice mail, but for some, short breaths could be heard before it was hung up. Then, morse could be heard, which has yet to be decoded or recorded.

After this, scx said to join the voice chat on the Discord server. He did not speak, but he played the same morse from the phone number before leaving again. In the end, Discord user Prime entered the chat, and revealed that he and ICallHax were the puppetmasters of the ARG: Prime talked through scx, while ICallHax created the website. He said that the ARG was over, but they would do something similar again soon.