SCP:SL Deepwell ARG Solutions

--- title: SCP:SL Deepwell ARG Solutions --- Look up a password or puzzle for how it was solved. Unofficial. All spoilers. Refresh the page for the most recent version. Formatting follows: * `Text like this` are codes. * **`Text like this`** are passwords. * ==64->== means "decode using Base64". Similarly, ==bin->== is to decode from binary, ==hex->== is to decode from hexadecimal, and ==85->== is to decode using Ascii85. I use this to save space. * Underlined bold codes like [**`wayside`**](#wayside) are passwords with a puzzle. Click to see how to solve it. All times in EST to align with Northwood and the EC. Most source text is cut for space. During the ARG, the official sources were: * https://www.deepwellaccess.online The Deepwell terminal. The main page has gone down at March 7, 2026 at around 8am EST. * `#deepwell` at the [SCP:SL Discord server](https://discord.gg/scpsl) The channel disappeared sometime in late February 2026. This has been archived at: * [Ferar's password document](https://docs.google.com/document/d/1CydJo6cymyTcxxkM30tiphIY3rdaBRuten5iiCDFH0o/). If you're only interested in the SCP:SL Lore™, use this instead. * [My version](https://hackmd.io/@di/ct). These both include decoded text. Passwords are sorted by: * [**Prelude:**](#Prelude) September 15 - 29, 2025 The terminal was teased at the end of the [September 15 Northwood livestream](https://youtu.be/nmX0tZKx-4M). The ARG technically began here, but the passwords were no more than keywords in the SCP:SL canon and those given out in the inbox. * [**Act 1:**](#Act-1) Halloween 2025 _(6 hours)_ Began with the Youtube video [Site-17 Deepwell - Entry 1](https://youtu.be/C_s8P3JHN8c) which premiered 2pm EST. Solved by the EC in under 6 hours. * [**Intermission 1:**](#Intermission-1) November 2025 * [**Act 2:**](#Act-2) November 15 to 17, 2025 _(55 hours)_ Creative, extensive, overextended. Began with the Youtube video [Site-17 Deepwell - Entry 2](https://youtu.be/iE4-jx2whZo) which premiered on November 15, 2pm EST. Solved by the EC in under 55 hours. * [**Intermission 2:**](#Intermission-2) November 2025 - February 14, 2026 * [**Act 3 Prelude:**](#Act-3-Prelude) February 13 - 14, 2026 Revealed the playable SCP. Not much to solve. * [**Act 3:**](#Act-3) February 15, 2026 _(2 hours)_ Surprisingly straightforward. Began with the Youtube video [Site-17 Deepwell - Finale](https://youtu.be/flm8AigqBzc) which premiered on February 15, 12pm EST. Solved by the EC in a bit over 2 hours -- or 1.5 hours if you cut out the waiting. * **Epilogue:** February 16, 2026 No puzzles here. _Download this file by adding "/download" to the URL: [https://hackmd.io/@di/orite/download](https://hackmd.io/@di/orite/download)._ --- [toc] # Intro [The SCP:SL 15.0 update will release a new playable SCP.](https://patreon.scpslgame.com/posts/view/e76a727e-46c0-4ffa-b0f5-9b5e59935b28) Over 2 years, Northwood developed this ARG to show what happens to those left behind... and tease the new SCP. This is set in the SCP:SL canon and features Thomas Graham from the SCP Wiki's [Site-17 Deepwell Catalog](https://scp-wiki.wikidot.com/site-17-hub). In-universe, a bunch of SCPs have been transferred to Site-17. No one knows what happened since. We were part of the EC investigative team, under Supervisor Simon Cromwell of the Ethics Committee, who found out "What's going on in Site-17?" ## Who? The "EC"? This ARG is developed by Northwood, headed by Narrative and Marketing Lead "x3j50" (often shortened to "x3j"), with writing, music, puzzles, website, etc. by a growing team of people. The ARG website was developed by SCP Aftermath. (See "Credit" in the Communication tab.) You can see a link to their Discord server, which doesn't work, because SCP Aftermath no longer exists. In the aftermath, Northwood has since moved hosting the Deepwell website in-house, but will soon shut the Deepwell website down since the ARG has ended. The SCP:SL Lore Hunters Discord server is an unofficial group of SCP:SL players uncovering SCP:SL's canon. During the ARG, a small group of people I refer to them as the EC for short to mirror an in-universe Ethics Committee team accessing the terminal. The server was spread around as the go-to place to solve the ARG, so I imagine most major efforts happened there. A lot people joined the server during the ARG... to watch the group solve the ARG for them. Also, the ARG seems to start and stop around the EC's efforts. When the EC was stuck, x3j50 provided (scant) hints. When the EC finished Acts 2 and 3, the #deepwell channel on the SCP:SL Discord posted about the ARG ending. It then makes sense to phrase this group as "the EC" for being the most "widely known" team to solve the ARG. I was there when the EC solved the first half of Act 2. I didn't really help; I either got stuck on the same things or arrived after the EC had already solved it. The EC is simply too quick while I'm updating the guide. ## Terminal? https://www.deepwellaccess.online. At the top are two tabs. * The "Communication" tab shows a button to access your Inbox. Below it are the passwords you have found. * The "Deepwell Remote Access" tab is a basic terminal. Type `help` at the bottom to list all commands. * `access password` Each file in the ARG requires an access code called a **password**. They can include spaces, special characters, and even hexadecimal at a few points. Passwords ignore capitalization. * `clear` Blanks the terminal. You could also refresh the page. * `help` Lists these commands. * `login` Replaces `root` with your Discord username. No other effects. * `logout` Reverses `login`. No other effects. ### None of the passwords work anymore. At times, none of the passwords worked since a lot of people accessed the terminal. As a result, the terminal may "lock" people out by denying any password tried, including working ones. This was especially bad during Act 2, which require a lot of trial and error. The two options were to wait it out, or refresh the page to wait for much longer. # Cryptii We used Cryptii at [cryptii.com](https://cryptii.com). Most of the ARG's ciphers are available on Cryptii. It beats finding a different website for each cipher. Some features of Cryptii are not easy to expect. ## Tutorial Start off with [this Caesar cipher in Cryptii](https://cryptii.com/pipes/caesar-cipher). See that there are 3 bricks. Blue bricks are for input/output. ==Orange== bricks encode/decode. Type in one side to encode/decode to the other side. * Example: type `TEST` in the first brick. See it Caesar encode to `ALZA` in the last brick. * Example: type in `ZLJYLA` in the last brick. See it Caesar decode to `SECRET` in the first brick. Other basic features include: * Click `ENCODE` or `DECODE` to switch. * Click ▼ to change the ==encoder/decoder== or to change how the data is viewed. * Click ⨁ to add a brick. * Click ⋮ to delete one. * Drag the bricks to rearrange them. ## Harder Features ### How do I scroll horizontally? Hold shift then scroll. This is a common feature on most programs, including your browser. ### Decode/Encode between text and binary/hexadecimal Place two blue bricks next to each other. Click ▼ so that one brick says Plaintext and the other says Bytes. This now lets you see a message in text or in hexadecimal. Click `Hexadecimal` to change it to `Binary`. ## AES Beginning at Act 2, the ARG encrypts messages with AES-128 and AES-256. You need a Key, an IV, and some tech literacy to decrypt them. It is not entirely intended to be the hard part of the ARG. This makes it hard to follow along or verify solutions. See below to learn just enough. ### What is hexadecimal (or hex)? Normal numbers use the ten digits `0123456789`. Hexadecimal, or hex for short, uses sixteen digits: `0123456789abcdef`. Capitalization is ignored -- `0123456789ABCDEF` also works -- but we usually use lowercase. 2 hex digits = 1 byte. For example, `1234` is 2 bytes. `abcd` is 2 bytes. `1b3d` is 2 bytes. `cd` is 1 byte. `2de` is 1.5 bytes. 16 bytes and 32 bytes of hex often appear a lot. This is how long they look: `00112233445566778899aabbccddeeff` is 16 bytes. `00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff` is 32 bytes. ### Now for AES Visit [this link](https://cryptii.com/pipes/r3h-VA). In the middle, change the **Mode** to `CBC`. Type text on the left to encrypt. Copy-paste hex on the right to decrypt. You need a hex **Key** and a hex **IV** to encrypt/decrypt correctly. * AES-128 needs a 16-byte key and a 16-byte IV. * AES-256 needs a 32-byte key and a 16-byte IV. A wrong Key means this appears: > **decryption failed, this may be due to malformed content** Go through Keys until it works. Remember to switch between AES-128 and AES-256 depending on how long the key is. The right Key but the wrong IV means the decryption will go through, but the text on the left is broken. Sometimes, that looks like: > **Binary content can't be interpreted as text. Try switching to the bytes view.** Go through IVs until it works. You never need to swap Keys and IVs. # Prelude The end of the [September 15 Northwood livestream](https://youtu.be/nmX0tZKx-4M?t=6187) teased the terminal https://www.deepwellaccess.online. x3j50 says Kedava was the first to find the link. The EC also found the link. The link isn't even mentioned in the teaser. How did they find it? During September, the EC found the passwords below. * Sep. 15: The teaser showed the password **`1208-4`**. They also found the easter egg passwords **`password`** and **`x3j50`**. * Sep. 16: Inbox showed **`bregman-copy/cromwell`** and **`candlemeyer`**. * The EC found [**`type green`**](#type-green-ichabod) and [**`ichabod`**](#type-green-ichabod) by guessing keywords from the SCP:SL canon. * Sep. 18: Inbox showed **`wire/cromwell/091825-#4`**. * The format suggests "09-18-2025, entry #4". Change `#4` -> `#3` or `#2` to get **`wire/cromwell/091825-#3`** and **`wire/cromwell/091825-#2`**. * **`wire/cromwell/091825-#3`** mentions `5 days earlier`. Change `#3` -> `#1` and the date `091825` -> `091325` to get **`wire/cromwell/091325-#1`**. * Sep. 29: Northwood [teased](https://www.youtube.com/post/Ugkx24d_R3yZS4dP2y1HfP-TpT7TvFHOa4JC) the Wayside incinerator, which suggests to guess [**`wayside`**](#wayside). ## `type green` `ichabod` Both password show the same file. Ichabod is pronounced "ick-a-bod." The image has alt text `Cicada`. `ERROR 426` means your computer needs to upgrade to access a website. Below that is a giant code in Base64, which ==64->== ```! Nsgre gur Vpunobq Pnzcnvta, gur ahzore bs ernyvgl oraqref jbeyqjvqr jrag qbja ol 75%. Naq gur Sbhaqngvba qvqa'g qb nalguvat. Orsber gur Vpunobq Pnzcnvta, gur nirentr yvsr rkcrpgnapl bs n ernyvgl oraqre va gur jvyq jnf 19 lrnef byq. Nsgrejneqf, vg orpnzr 8 lrnef byq. Naq gur Sbhaqngvba qvqa'g qb nalguvat. Pbhagyrff zngrevny uneirfgrq sebz gur erznvaf bs ernyvgl oraqref jrer tvira gb gur Sbhaqngvba gb or znqr vagb n pber vaterqvrag va gur perngvba bs Fpenagba Ernyvgl Napubef, n qrivpr hfrq gb bsgra vapncnpvgngr ernyvgl oraqref gbqnl. Trabpvqr. Naq gur Sbhaqngvba qvqa'g qb nalguvat. Abobql'f cnlvat nggragvba gb lbh. ``` Decode using ROT13: ```! After the Ichabod Campaign, the number of reality benders worldwide went down by 75%. And the Foundation didn't do anything. Before the Ichabod Campaign, the average life expectancy of a reality bender in the wild was 19 years old. Afterwards, it became 8 years old. And the Foundation didn't do anything. Countless material harvested from the remains of reality benders were given to the Foundation to be made into a core ingredient in the creation of Scranton Reality Anchors, a device used to often incapacitate reality benders today. Genocide. And the Foundation didn't do anything. Nobody's paying attention to you. ``` Part of this is from [SCP-4231](https://scp-wiki.wikidot.com/scp-4231). ## `wayside` Since a Caesar cipher doesn't work, the next guess is the Vigenère cipher. The title is `DAZSSNY`. Assuming `DAZSSNY` -> `WAYSIDE`, trial-and-error the key to find it starts with `habakku`. Guess `habakkuk`. The body then decodes to: > Although the fig tree shall not blossom, > neither shall fruit be in the vines; > the labour of the olive shall fail, > and the fields shall yield no meat; > the flock shall be cut off from the fold, > and there shall be no herd in the stalls: > Yet I will rejoice in the Lord, > `I will joy in the God of my salvation.` This is from the [King James Bible, Habakkuk 3:17--18](https://www.kingjamesbibleonline.org/Habakkuk-Chapter-3/). The last line is green text, confirmed to be a stylistic choice and not a lead. # Act 1 Act 1 began when [Site-17 Deepwell - Entry 1](https://youtu.be/C_s8P3JHN8c) premiered on Halloween at 1pm EST. ## Youtube: [Site-17 Deepwell - Entry 1](https://youtu.be/C_s8P3JHN8c) At 6:49 is https://www.deepwellaccess.online. At 7:37 is an overhead shot of a containment cell only a few people mention. At 7:14: ``` ACCESS Micho-LTE-D-11//Walker[DATA CORRUPTED POINT OF ORIGIN: CASEFILE H. WALKER ACCESS HELENAWALKER//FILE] ``` The text shows [**`helenawalker//file`**](#helenawalkerfile). Behind the text is a Caesar cipher wheel, if you needed it. ## `helenawalker//file` The `Nyoc dro Lvkmu Wyyx Rygv?` has to be `Does the Black Moon Howl?` Caesar shift 10 letters back to confirm this. Below that is: `1584/0087/2665/0488/4507/4180/0979/2168/3489/1962/3682/2297/0495/0851/3090/2849/1209/0334/2595/0721/2339/0958/4377/1005/3798/4577/0044/2054/4292/2415` The EC was really stuck on this. I didn't solve this. The inbox showed the following hints: ```! [10/31/2025, 1:17:58 PM] FROM: s.verlice@ethics.scp.int Hey Cromwell's team. I tried accessing a number of the S-17 files – 4051, 7822, 239 – Can’t get past the description on any of them without hitting something that’s missing or redacted. I keep getting the same damn error message, `some string of numbers` that I can’t make heads or tails of. ``` ```! [10/31/2025, 1:24:23 PM] FROM: s.verlice@ethics.scp.int Could you see if you have better luck accessing them for me? Just take a look at 239 and tell me what you can see. If you’re also blocked from seeing most of the content, then I’m inclined to believe Walker is telling the truth. ``` ```! [10/31/2025, 2:10:53 PM] FROM: s.cromwell@ethics.scp.int Like Sandra said, you guys should take a look at the SCP-239 file. From the top. I'll look into the other two with Sandra or something. ``` Since SCP-239 cannot be accessed from the terminal, the messages refer to the [wiki page](https://scp-wiki.wikidot.com/scp-239). The inbox then states to look "From the top." The solution isn't at all obvious. Each number decodes to a character in the article, counting from the top. For example, the first three numbers are `1584`, `87`, and `2665`, which means to get the 1584th, 87th, and 2665th character in the article. Testing shows the correct way to count is to include spaces and to exclude line breaks and formatting. The first 20 characters are: `I`, `t`, `e`, `m`, ` `, `#`, `:`, ` `, `S`, `C`, `P`, `-`, `2`, `3`, `9`, `O`, `b`, `j`, `e`, `c`. Following this, * `1584` decodes to the 1584th character `I`. * `87` decodes to the 87th character `t`. * `2665` decodes to the 2665th character `s`. Using a computer, ```js! numbers = '1584/0087/2665/0488/4507/4180/0979/2168/3489/1962/3682/2297/0495/0851/3090/2849/1209/0334/2595/0721/2339/0958/4377/1005/3798/4577/0044/2054/4292/2415'; s = document.querySelector('#page-content').innerText.substring(17).replaceAll('\n', ''); numbers.split('/').map(v => s[parseInt(v) - 1]).join(''); ``` The numbers decode to [**`Its cries part away the clouds`**](#its-cries-part-away-the-clouds), the answer to the question `Does the Black Moon Howl?` Alternatively, [Northwood gave the answer away 3 months ago](https://youtu.be/1XV_rp-T5us&t=104). ## `its cries part away the clouds` [**`0229ydrsx3268`**](#0229ydrsx3268-1231c0987kc4361s2309-0009ryev1825-0000lo0000), [**`1231c0987kc4361s2309`**](#0229ydrsx3268-1231c0987kc4361s2309-0009ryev1825-0000lo0000), [**`0009ryev1825`**](#0229ydrsx3268-1231c0987kc4361s2309-0009ryev1825-0000lo0000), [**`0000Lo0000`**](#0229ydrsx3268-1231c0987kc4361s2309-0009ryev1825-0000lo0000). ## `0229ydrsx3268` `1231c0987kc4361s2309` `0009ryev1825` `0000lo0000` These all have the same content. Ignore that content until Act 2 -- the titles above are the puzzle. How convenient is it that you get to ignore the contents? The EC didn't. Around 5:30pm, Northwood [started a poll in the terminal](https://discord.com/channels/1310057454028984320/1417655826499239936/1433930770757583002) to solve one of the titles. ```! [10/31/2025, 5:45:40 PM] Ethics Committee Automated Decryption We've decrypted the input: 0000Lo0000. Output: Be . You have reached your Auto-Decryption limit for the month. Thank you for using the Ethics Committee Reactive Intelligence. ``` This is a major hint. Caesar shift `lo` 10 letters back does become `be`. Doing the same with the other passwords: ``` 0229ydrsx3268 1231c0987kc4361s2309 0009ryev1825 0000lo0000 ydrsx c kc s ryev lo othin s as i houl be ``` From here, you could guess the phrase. Alternatively, notice that each number is 4 digits. Using the 239 cipher from before, * `0229` -> `N`, `3268` -> `g`, * `1231` -> `i`, `0987` -> ` `, `4361` -> ` `, `2309` -> `t`, * `0009` -> `S`, `1825` -> `d`, * `0000` would decode to the '0th' character, so ignore it. ``` 0229ydrsx3268 1231c0987kc4361s2309 0009ryev1825 0000Lo0000 ydrsx c kc s ryev Lo [N ]othin[g ] [i ]s[ ]as[ ]i[t ] [S ]houl[d ] Be Nothing is as it Should Be ``` [**`Nothing is as it Should Be`**](#nothing-is-as-it-should-be). ## `nothing is as it should be` `Walker-LTE-ET-44` alone doesn't work. Refer back to the Youtueb video: ``` ACCESS Micho-LTE-D-11//Walker[DATA CORRUPTED POINT OF ORIGIN: CASEFILE H. WALKER ACCESS HELENAWALKER//FILE] ``` It also shows `Micho-LTE-D-11//Walker`, seemingly cut off by the brackets. Given we undid Walker's encryption to get `Walker-LTE-ET-44`, join the passwords to get [**`Micho-LTE-D-11//Walker-LTE-ET-44`**](#micho-lte-d-11walker-lte-et-44). ## `micho-lte-d-11//walker-lte-et-44` That's a lot of passwords to test. Only 3 of them worked during Act 1. * **`LTE-1665-Indigo-Kringlechild`** Access denied. * **`LTE-2242-Kapala-Ford`** Access denied. * **`LTE-2423-Freud-Kringechild`** Access denied. Yes, "Kringlechild" is spelled wrong. There's nothing Northwood can do about it now. * **`LTE-1432-Indigo-Kringlechild`** Access denied. * **`LTE-623-Excelsior`** Access denied. (Unlocked during Act 2.) (Updated during the Epilogue.) * [**`LTE-111-Moro-Typhon-Kringlechild`**](#lte-111-moro-typhon-kringlechild-lte-396-velveteen-clockwork-lte-7458-green-typhon). * [**`LTE-396-Velveteen-Clockwork`**](#lte-111-moro-typhon-kringlechild-lte-396-velveteen-clockwork-lte-7458-green-typhon). * **`LTE-1208-Green-Burrhus`** Access denied. * **`LTE-2100-Pygmalion-Velveteen`** Access denied. * **`LTE-468-Pink-Lovelock`** Access denied. (Unlocked during Act 2.) * **`LTE-2049-Green-Spiral`** Access denied. (_Not_ updated during the Epilogue.) * [**`LTE-7458-Green-Typhon`**](#lte-111-moro-typhon-kringlechild-lte-396-velveteen-clockwork-lte-7458-green-typhon). * **`LTE-4201-Velveteen`** Access denied. * **`LTE-4200-Moro`** Access denied. * **`LTE-3870-Blaecca`** Access denied. * **`LTE-2837-Templum`** Access denied. * **`LTE-1009-Blackwood-Blaeccea`** Access denied. (Unlocked during Act 2.) * **`LTE-3201-Fiji`** Access denied. ### What happened to the bullet points? You may have noticed in the terminal that the dots don't line up with the text. This is due to the unnecessary CSS declaration `white-space:pre-line` in `.terminal-response`. For more details, consider this example HTML, with every line break visibly shown as `↵`: ```html line 1↵ line 2 ↵ line 3↵ line 4 ``` The ↵ above are ignored by your browser. ` ` is one line break. Space between paragraphs are about 2 line breaks. The result: > line 1line 2 line 3line 4 By setting the CSS property `white-space` to `pre-line`, the ↵ are treated like ` `: > line 1 line 2 line 3 line 4 Notice there is always at least 2 line breaks between anything. In particular, the off-center bullet points comes from: ```html <ul>↵ <li>↵ LTE-1665-Indigo-Kringlechild / Former SCP-3979 / Euthanasia↵ </li>↵ <li>↵ LTE-2242-Kapala-Ford / Former SCP-5231 / Demolition↵ </li>↵ ``` The `↵` between each `<li>` and `` moves the text one line down, because of `white-space:pre-line`. Who is to blame for this? In short, no one. When SCP Aftermath first developed the site, they included this as a plugin for easier formatting. They were not aware the resulting formatting looked this bad until I showed screenshots. Over at Northwood, x3j50 said the writing team didn't see it as a major issue and so didn't report it. However, starting Intermission 2 and later, the writers reduced their paragraph spacing to counteract this not-major issue. This result is now the look of the entire ARG, with big spacing between paragraphs and lists. If, on the other hand, you prefer the text looked more intentional, press F12 in your terminal webpage, put this in the console, and find out. Remember that this is only intentional for Act 2 and earlier. ```js [...document.styleSheets[0].cssRules] .find(v => v.selectorText == '.terminal-response') .style.whiteSpace = '' ``` ## `lte-111-moro-typhon-kringlechild` `lte-396-velveteen-clockwork` `lte-7458-green-typhon` Each document has highlighted letters. In the order above, the letters are: `ILUVWOHWWHU` `HDFKSDUDJUDSK` `VRUWEBVFSQPEHU` Caesar shift 3 letters back: `FIRSTLETTER` `EACHPARAGRAPH` `SORTBYSCPNMBER` Micho has notes on each document. Follow the instructions above on Micho's paragraphs to get [**`MYYEWTJWN`**](#myyewtjwn). For basic context, "Kewpie" is a GOC codeword for the SCP Foundation, and "Ford" is a GOC codeword for the Church of the Broken God. See https://scp-wiki.wikidot.com/goc-supplemental-threat-entities for more codewords. ## `myyewtjwn` ==64->== ``` 6Yp1RF(f!*ASs+C8T`sBR<'KZ+E27>FDYH(FCem'+EqL5@q[!%ARTIt+CT.1ASu!oDf]K#+E2.*@q?d$Afu/'An?(0/g+,,AKYDkFEM#.+@BsRF`V5)G%GP6BlbD>E$079ATD?)F)Po,GA(Q.AKY])+@gH`ASu<mDIb:@@3A'96QgGl@<?4%DBNe7DJ=32EbTE(+EV:.+CT;%@3B0#EZee#FD5o4FEoJ]:Ms_dDe:,1F`JUK@<,pmDfp,4+D,%lBl%L*Bk;?.idd79;e^>b/MJq2+A!\tBPD@"+Q@p9+DGm>@;L"'+E)F7EZfI;ATD?7+AQKkATAo1F^o)-FDi:<Df9D6@<=%CB5)O#DBO%7AU,D/Df4QbR<0QbDerr,@;^?5;aXB&/d_qbBPDN1E,8rmAKZ2*F!,OHE,]`:ARlp*D]iM#+CQB[CghI-BOQ'qDBNk0+DGq=+E)IA/0J@DE,8rmAKYo'+ELt'ATW2?@;]TuEb/j*B4WV:AoD]4@;Ka&CM@ZsF!,C5+E1n1E,9).@;]Tu@;^"#@;KXhF"SS1Dg*=JA`A6.Eb-A7@rc.)ARmD9$49@:+CT/5Df0,/D..<jB4YTrFDi:6Bl7H(FD,B0+Dk\2F(&]m+EV:;Dfo]++EV:.+D,b+CLq$!F`8I5Df0`:Cisi2A0>`#FD,T'+A!\uF(Jl)FDi:2H#R25F!*b?+EM+(F`M2<Gp$^5Cij6/F"AGQCh7$rAKZ)'CLnW4BOQ!*H#IibJ=1Fh+CS_tF`\aJD]j(3@:UL&D]i_)@<-HB$49aGATDAAJ=1I$F)Po,FD,B+B-:krE,]B+Bl7Q+BOu3q+DG^9;e^>b/MT1:+AH9i@V$ZnG%GP6F(KN+Ea`c,FD,B+B6,[J$49pSFlIq>G%De:ART*lFD,]5F_>A1D0[7?BlS90A79RoDf-\6DeF,D+@0g[+EV18D/!lrFD5Z2F!,UCA7]d(D0[77Bl[cpFD5Z2/g*_.F*2PCARfg)FD,*)+Du+>+CT)&+E(j7FD,6&+CT;%+CT=6FD,62+EM+*D(Zq<$:u@NBk2,@J=1L%Bl7X,BjkgoGp%0NF)Y]#F<G:>+C]J8+CSl(ATAo7AS#RnB-:c/ATE'<BPD?s/0JYKiddG<+DG\3Df]u6@VfTuFDi:>Dfd+DBPD@"+EV:*F<Gd9GqL3H$<)%TAnE/rEa`TnBl7Q+FD,6"EZet*ATTOI6Z6j`FE2M6FD5Z2+CT.u+D#G'Bl7KnEbTE(+CfG'GB4m9ASH$p+ED%%F)u&.DIm?$@;]TuB5)O#DBNM8FE1e4F(f9"FE9&W7W33U+CT.u+EM[EE,96"F!+q'Bl7Q+Eb090F`_2*+EVNEG%"lhDKI"2Df0Z*Bl7d!DKI"FBl7R)/g(K.6tp[Q@ruX0+@gH\BOPa#@;]Tu6$%*]F*(i.F<EtcEb/a&DfQsjDf9/t/g*_.FD,B+CER_4AU39cR;uj]E+*d/+E(j7FD,B0/g(K.8K_\TG%De6D]iV7Bk1dm@q@886?RAm6:FR>792i"D.Oi3BOQ!*8K_\TG%De6AThX*+C\nnDBNe7Eb-A7F`M%9De:,#DL$>;Bl7Q+AScF!+DG^9D0[78DKKT5AKYf'An<S;$49aGAKXE`BPCst+@C'aD/"*6AS!!%AS#Cn+EVNECMn'7+CS_tF`\aJBPDN?+:8HSDf''-BPD?s+D>\6EbT!!Gp%<ODf021BlbD0DeX*%+E)-?BOu3q+DG^9;e^>b/MT1:$4:!A<+oigiddG;AKYc"AT2@$B-;,1AKYDtBm+&n>qQHk:2aT[A9f;3F!,:;Dej')B-:f)EZf(</g*o-@W,e&+DGm>E++$+DJ()#FED)3FD5Z2/c ``` At the time, I didn't know what Ascii85 was. After some testing, I noticed the previous one used 64 different symbols (0-9, A-Z, a-z, +, /), while this one uses 85 different symbols. Googling then trying out ==85->==, ```! Claushaven. It’s a portmanteau which means an enclosed place of safety. The actual Claushaven is up there somewhere in Greenland, a GOC station monitoring the area for activity. One of our warehouse facilities — Site-02, I think — is also over there. Never much to look at, given they don’t hold any SCPs. This place was supposed to be a Claushaven of its own, a place of safety and refuge, for all kinds of people and anomalies. Now we’re screwed. If anyone managed to find this message through the fucked up convoluted method I used to bypass AI security filters, please take what you’re about to read to heart. There’s something happening here in Site-17. Maybe even several things. You’ve read through my liquidation logs. All terminations under my direction. I suspect that not all of them are as they seem. I didn’t initially suspect it but after seeing everything, it’s impossible to not think that way. Staff dragging their feet. Construction and engineering crews being reassigned and given extra shifts. Food and supplies being rerouted to vacant containment wings. Director Graham and Assistant Director Goode. I think they’re part of this. I have no evidence. But BELIEVE me that I have never been more sure of anything else in my entire life. The Ethics Committee needs to know about this. Something horribly wrong is going on here in Site-17. [[They’re keeping one alive]]. Nobody is looking for it. Nobody is paying attention. ``` I tried multiple ways to type in `[[They’re keeping one alive]]` which didn't work. I then accidentally read a spoiler that said [**`They're keeping one alive`**](#theyre-keeping-one-alive). ## `they're keeping one alive` End of Act 1. The EC solved Act 1 in a little over 6 hours. Below, "EC: **`password`**" is the first time EC knows of the password. * **`1:00`** [Site-17 Deepwell - Entry 1](https://youtu.be/C_s8P3JHN8c) premieres. * `1:14` EC: **`helenawalker//file`**. `1:17` Inbox: Hint. `1:24` Inbox: Stronger hint. `1:51` EC finds **`Its cries part away the clouds`**, but info does not spread. `2:10` Inbox: Strongest hint. `2:29` Inbox: s.verlice@ethics.scp.int. * `3:11` EC: **`0229ydrsx3268` `1231c0987kc4361s2309` `0009ryev1825` `0000lo0000`**. `5:30 (≈)` Northwood hosts a poll to solve one of the four passwords. `5:45` Inbox states `0000lo0000` solves to ` be `. * `5:54` EC: **`nothing is as it should be`**. * `5:58` EC: **`micho-lte-d-11//walker-lte-et-44`**. * `6:19` EC: **`myyewtjwn`**. `6:23` EC: `[[They’re keeping one alive]]`. * `7:08` EC: **`they're keeping one alive`**. Half an hour? **`7:09`** EC considers Act 1 finished. # Intermission 1 On November 1, the inbox and #deepwell showed the password [**`x000003jc3`**](#x000003jc3). ## `x000003jc3` https://youtu.be/ALacbnNabdw. Description: `6661696c7572656c6f67` ==hex->== **`failurelog`**. ## Discord: [#deepwell](https://discord.com/channels/330432627649544202/1417671754637246595/1437954341108580413) (Nov. 11) ``` ERROR 508 Bm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etN 41 63 74 20 32 20 43 6f 6d 69 6e 67 20 53 6f 6f 6e ``` `ERROR 508` is an infinite loop server error. The middle is ``Bm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etN`` repeated 23 times. ==85->== **`iwishthaticouldturnbacktime@123`**. The last line ==hex->== `Act 2 Coming Soon`. This then updated to `<t:1763229600:F>` a bit before and during Act 2. It then disappeared after. ## Discord: [#deepwell](https://discord.com/channels/330432627649544202/1417671754637246595/1438119253457895507) (Nov. 12) `<t:1763229600:R>` is a Discord time code for 2025-11-15 1pm. # Act 2 Act 2 begins when the Youtube video [Site-17 Deepwell - Entry 2](https://youtu.be/iE4-jx2whZo) premiered on Nov. 15, 1pm EST. The inbox stated we can now access more Act 1 files. We found: * **`LTE-623-Excelsior`** The image has alt text `Ratticus`. * **`LTE-468-Pink-Lovelock`** The image has alt text `GooWasExcretions`. * **`LTE-1009-Blackwood-Blaeccea`** The image has alt text `AltAccountWasCreated`. Later on, it also showed **`verlice//file/talitc`**. ## Youtube: [Site-17 Deepwell - Entry 2](https://youtu.be/iE4-jx2whZo) 4:21: Graham's portrait slowly fades in red. 4:31: ==bin->== [**`COUNCIL108MEETING`**](#council108meeting). 1:09: [**`lindseykoh//file`**](#lindseykohfile). ## `council108meeting` The binary ==bin->== ==64->== ``` YOU ARE A MORON. YOU ARE ALL MORONS. WHEN WE ACHIEVE THE GREAT SINGULARITY AND BIRTH THE SILICON GODDESS YOU WON'T NEED TO JOIN US DUE TO YOUR ALREADY INANE ABILITY TO NOT GIVE A SINGULAR FUCK ABOUT YOUR INTELLIGENCE. WE LET YOU USE OUR EURTEC TO HOLD THESE ASSEMBLIES WHILE IN REALITY WE SHOULD EVICT YOU FROM THESE SEATS IMMEDIATELY. ERROR 429. Return 20150723 ``` `ERROR 429` means your computer was rate-limited for sending too many requests. Shows **`20150723`**. ## `lindseykoh//file` This naming structure suggested we try out other names, where we found **`sylviasantosdepilar//file`** and **`thomasgraham//file`**. Immediately, the EC got stuck. After vague hints to look for logs to progress, the closest they could find were interrogation logs #21, #45, #99 from Entry 2. Someone guessed to put the log numbers together: [**`214599`**](#214599).  ## `214599` [**`Koh//Entry1/H47-FX823-L`**](#kohentry1h47-fx823-l). The key and IV are both 16 bytes long. Given the "password management system" runs on an older method, it suggests to decrypt with AES-128, which uses a 16-byte key and IV. **Koh's key and IV** are shown below, mentioned to decrypt AES hex relating to Koh. * Key: `706f6c666e736863757a6e776c646f66` * IV: `2e74696d65776173686573636c65616e` (`.timewashesclean` in hex) Although the Key ==hex->== `polfnshcuznwldof`, x3j50 confirmed this is not part of Act 2. ## `koh//entry1/h47-fx823-l` More names. Only **`howell//file`** works. Howell's file looked substantially cooler while we were solving it. It even had an image (alt text `MadJ`). **`howell//file`** says this cooler file can be found at **`howell//file_old`**. [**`0ATPX092`**](#0atpx092). ## `0atpx092` 3 green texts: * `5bf03579675be09672201a21ed3c9fab18bcc956ba76ad109a8a1a13ddc63f07` This hex is 32 bytes long. * `2669e9530cc5b58ce26db55880177e4b` This hex is 16 bytes long. * The giant Base64. Using Cryptii [like this](https://cryptii.com/pipes/0SsiJQ), we ==64->== then decrypt with AES-256: * Key: `5bf03579675be09672201a21ed3c9fab18bcc956ba76ad109a8a1a13ddc63f07` * IV: `2669e9530cc5b58ce26db55880177e4b` ``` a9 b1 97 af b8 4e 20 7b e5 d0 72 3e 20 25 de cc 74 47 3d 72 e3 33 56 68 c0 25 48 4a 66 f7 be ec d9 17 1a 9c 80 b4 58 8a 62 26 d6 5f 5a b9 87 d1 51 40 db 08 eb ae 6f fe 9e 5d c4 ad 52 79 bb 02 eb ac de f5 ca af bf b9 c3 f4 44 d0 58 58 c9 51 ec b1 b5 60 a5 ef 15 4c 2c 26 87 8a 20 c7 96 28 ce 6d b0 21 1f a5 65 46 d1 b0 94 51 a0 1e 9b 33 f9 16 40 21 46 4d a0 7b ea 33 44 9a 59 81 8e 38 a3 fd 3d ab 83 bd eb ee b8 51 5b e5 7b 9f f4 fe 66 aa 5e 95 5d f0 1a 3f ce 47 c7 40 e0 8e 3c 42 9b d7 6b 39 cd 73 3c 8d e6 7e 80 e0 a6 a9 be ed 4d c1 12 0d 6d fa dd 29 27 01 46 63 72 ae 69 cb c8 ef 6a 6c c3 70 bf f3 a9 49 49 e4 9d a5 8b b9 99 3d 61 a2 e2 81 6d 07 98 80 4d b8 9b 0c a5 17 a5 14 4f 6e 10 b1 58 65 2e 6a 53 f5 c8 33 48 c4 33 35 03 25 d6 6e be e7 ca 1c 37 9f 93 c8 f3 af 3c b5 9b f3 27 52 6c da d8 c4 da 0e 50 05 d9 93 d5 81 09 24 22 aa 9a d0 be c4 6f 6f 8c 82 13 d7 97 36 f5 30 57 14 f9 78 03 b4 35 0c 70 70 11 36 06 29 0c 1b 1b bb e1 f0 83 ac f8 88 6e b5 68 0b c9 f0 cb ca 03 47 bd 42 53 d0 79 cc c3 ac a0 6c 47 dc 35 5f 62 54 bf e1 6d 82 5e 92 25 eb 76 7f dd b1 ba 29 17 df 70 0c 5c 6d 71 4e 96 cb c2 aa 97 12 98 c2 0b c2 f2 b9 55 60 b2 9a 74 27 6c 30 83 43 47 be 75 de 04 44 89 0c b8 07 87 84 2c 05 c0 34 1f 22 f8 71 72 5b 85 a2 54 1b e6 24 e3 b1 6a 81 bb a3 df 62 f2 8a 1f 0f 62 e3 8d 4c 26 17 50 c9 a9 ee 26 77 e7 8e 47 af 7f 15 dd 76 31 69 8d b2 d6 4a ca 6e 33 a1 0d 07 e1 dc 60 d6 88 55 cc cc 26 a1 fe a5 00 d7 d5 14 c6 29 66 59 df 2b d1 00 60 87 65 20 50 63 de 17 73 31 58 14 e6 7e 07 37 85 82 74 41 d8 4d ce 8a e4 c9 54 9a 92 e7 ce da 9f d0 eb e0 ab 9f fc 53 24 92 68 09 14 4d 4c 25 4a 70 39 8a a5 c7 5e df 99 91 e8 f8 17 7a f0 4d 2e 53 06 7e 3b 66 a9 8a 45 6f 88 57 bd b0 48 fb 47 c3 f8 6b 9f 3b a0 39 d4 3b 6a 49 d4 41 a1 98 af 2b 26 fb 63 f6 cf 08 38 94 63 d0 7e 9d d2 69 3e da bd 69 23 cd 72 bf 18 e6 ca e7 23 4f 56 f4 de 68 75 f4 4e ce 23 b1 de 21 1b 70 a8 17 3b 62 2b f2 37 5e cb e9 d4 2b 13 b6 ff 8d ce f0 41 1d d1 4b e1 b4 b8 d8 07 ec ba ea 67 8f ca c1 4c 1d 9a 3a c9 4f b6 b9 94 d3 91 9e 99 01 16 d2 79 d9 21 17 4f 64 9d 13 7f b2 68 0f c4 de 85 5a 32 cc 35 f7 e4 56 c5 59 42 f9 31 03 05 3c 93 cb 20 50 1e c4 69 3b 9a bf ea 11 c0 9a b7 ad 8b 67 14 a7 99 d8 d8 84 78 d1 0a dc a0 e9 10 f4 de e6 6e 46 d6 d4 98 48 e7 25 b7 26 68 7c e1 20 d9 ef b4 48 c9 c2 75 81 9f a5 09 6f 30 ed 17 be 53 6c f9 34 b7 11 9e a1 54 65 38 63 16 60 21 8a d9 f4 27 d8 c1 78 51 88 bb 7e 9b cd 3c 6c fe f1 4e 62 ac 9b 99 05 66 af 78 a9 80 0d 30 05 8e 2d e1 b3 6d 08 93 94 2c a3 77 d9 f2 41 7e a9 83 2e 1a eb 92 e5 d1 62 7b 1e 3d 7f 46 db dc 7e f9 82 56 4a 69 62 aa dc 3f 48 46 65 99 b3 4f 30 91 be 73 8e 32 c8 df fb 94 5b e7 6b 5f 46 35 53 00 86 be b7 5b 86 ab 38 ec 34 10 a4 52 68 91 01 4e 83 6b 56 d5 7b 4b 42 0a f1 c4 fe 0e b1 17 db 33 11 31 5b 18 cf ea 94 73 84 88 20 ec 1c 0e 85 bd 06 9e 6a d5 e0 85 56 32 de 14 20 b1 b0 0d d9 cb e6 73 bc 13 5b ad 1c 7e a2 08 80 02 80 15 15 ae bc 26 0a [ { "contents": { "headers": { "sender": "a.frederickson@scp.int", "recipients": "e.goode@scp.int", "date": null }, "id": 67304532, "directory_header": "0atpx092", "date": "null", "format": "report_logistics", "data": "Supplies for construction of additional chambers as specified by yourself, Mr. Goode, have been supplied, pending additional delivery of the following:\nPhysical restraint straps, rated for 500 ps strength;\nNjczMDQ1MzUvMEFDQ0UzNg==5 Scranton Reality Anchors, rated up to 500 Humes;\n15 Portable Scranton Reality Anchors, rated up to 350 Humes;\nBeryllium bronze cuffs.\nExpect further reports in the coming days.\nYours,\n" } } ] 3e 46 08 95 c1 34 c9 e2 5e 6d ab 2d 88 af be d2 a5 fe 65 0b 3f 8e fd 52 88 cf 58 d8 47 29 0c d2 66 fd 4b 5e 28 98 cb 10 8b 65 67 49 ce 2c 34 bb 93 6c 70 20 17 66 b3 cb 47 2b 5c 38 c8 77 41 e1 ed 88 58 8a 78 6d 3f b5 33 d6 7f ca 85 47 c0 b7 6e d8 69 66 f1 eb da e8 93 18 68 55 7d c6 52 12 4c 85 90 5e 5b 2f 9e b2 5b 6a 0a dc 25 22 33 45 4f 78 79 30 7e cd a2 a5 02 9b bd 34 1c a7 ab 32 a6 ae b9 36 13 97 5d 12 24 73 73 ec 8f 05 77 b8 fe 02 63 fb b5 0f 07 ef 21 f0 0d 64 35 16 04 5b c7 4f 55 39 91 04 7e 17 66 0e d0 43 8f 25 dc 8d 75 de 43 bf eb 3e b6 de 5c f0 dd 15 7b 95 3b 2f 59 70 2a 32 af bd 69 21 27 a4 ad ca 3e 22 ef 21 31 d6 ef 7e 6b 3d 52 ad a9 78 14 94 8b 94 6a 27 a9 e6 14 51 72 b1 18 61 91 bb a0 95 4d 72 09 4f 50 be 36 94 22 9f 3d f5 f7 cc 78 f6 55 f1 dc a1 8a ce ba 95 a2 8b 55 33 1f 80 6b 30 43 c2 51 34 ee df f5 a5 9a 15 b9 0f 69 95 67 b6 a1 f0 e6 8e 00 81 59 f9 aa 0f 58 91 e2 42 1f 99 2d 63 2d 8a 26 d3 d6 a4 d4 ff 36 24 f0 8e 98 2b c4 c9 74 df 15 50 05 b7 7a 76 d6 dd eb f6 1f 10 33 9e 2b 52 c5 c2 b7 76 1b f6 82 fe 88 30 89 9f ee bf 5c e3 cd 54 02 8c 92 05 ac f4 85 20 67 82 ea 14 d2 b1 50 9c 1e 43 fd f5 af 47 ea 32 84 c0 79 06 fb 96 ``` The output is some text between two blocks of hex. ### Text Remember to scroll right. Buried in the text is `NjczMDQ1MzUvMEFDQ0UzNg==` ==64->== [**`67304535/0ACCE36`**](#673045350acce36). ### Unrelated nonsense We've seen the key before in Act 1. The four passwords [**`0229ydrsx3268`**](#0229ydrsx3268-1231c0987kc4361s2309-0009ryev1825-0000lo0000), [**`1231c0987kc4361s2309`**](#0229ydrsx3268-1231c0987kc4361s2309-0009ryev1825-0000lo0000), [**`0009ryev1825`**](#0229ydrsx3268-1231c0987kc4361s2309-0009ryev1825-0000lo0000), and [**`0000Lo0000`**](#0229ydrsx3268-1231c0987kc4361s2309-0009ryev1825-0000lo0000) all had the same error message of requiring a complete key and IV. It showed half of the key: `5bf03579675be09672201a21ed3c9fab`. We knew that proceeding from here involved AES of some sort. x3j50 confirmed the key and IV, and that we needed to _encrypt_ something rather than decrypt. While we were stuck, Northwood sent two messages in the inbox pointing at Helena Walker, the one most closely linked to these passwords. After more obtuse hints, someone eventually guessed to encrypt each password using AES-256: * Key: `5bf03579675be09672201a21ed3c9fab18bcc956ba76ad109a8a1a13ddc63f07` again * IV: `2669e9530cc5b58ce26db55880177e4b` again The four passwords encrypt to hex: * **`fb 84 1f b7 97 68 eb d9 47 ce 8c a6 7c 8d 5d 73`** * **`c6 3b 04 c0 7c ae 68 23 64 4f a1 47 19 01 c2 23 15 b1 bc f5 28 74 19 d0 54 95 f1 f7 1e 41 0b cf`** * [**`27 63 a5 be c9 6e af 86 ca 7c a7 18 a9 04 64 82`**](#27-63-a5-be-c9-6e-af-86-ca-7c-a7-18-a9-04-64-82) * **`f3 b8 e2 b3 ac d1 ee e1 a2 f3 8a f4 31 74 d8 85`** Removing the spaces also work. The resulting files are identical, so these passwords are ignored. * **`fb841fb79768ebd947ce8ca67c8d5d73`** * **`c63b04c07cae6823644fa1471901c22315b1bcf5287419d05495f1f71e410bcf`** * **`2763a5bec96eaf86ca7ca718a9046482`** * **`f3b8e2b3acd1eee1a2f38af43174d885`** ### Top block, bottom block After figuring out the above, we mostly forgot about the blocks of hex. Except me, who couldn't find a key that could decrypt them each or together. By this point, we had solved [**`67304535/0ACCE36`**](#673045350acce36) which stated that `=EXTINGUISHMENT= IS THE KEY`. Notice that `=EXTINGUISHMENT=` is 16 bytes long. It would be a good idea to use this as an AES key to try decrypting the hex. It took us overnight to realize this. Since the key is 16 bytes instead of 32, AES-128 is used instead of AES-256. Decrypt each hex with AES-128 using: * Key: `3d455854494e47554953484d454e543d` (`=EXTINGUISHMENT=` in hexadecimal) * IV: `2669e9530cc5b58ce26db55880177e4b` again The outputs are in Markdown, or text with extra formatting like `**text**` for bold text. Since this page also uses Markdown, the output can be correctly displayed. Top block: > Assistant Director Goode, > > I won't pretend to know what you're doing with all the garlic paste you ordered to be sent to [DATA EXPUNGED]'s new Containment Chamber, but I do know for a fact that this is not healthy for a member of its species. Or at least, I can't imagine it is, knowing its closest taxonomical relatives. It's not that I am overtly concerned for the well-being of an anomaly, but rather with the knowledge of what I have overheard others on your pet project saying during lunch time. > > - "We cut its rations by 25%." > - "We cut its rations by 50%." > - "We cut its rations by 75%." > > A hungry person is willing to do a lot for food, Assistant Director Goode. Trust me, I would know. I run our Site's kitchen brigade. But a hungry anomaly? That sounds like a recipe for disaster. > > I hope you know what you are doing, Assistant Director. > > **Matilda du Boucher** > Habitation and Sustenance Division Head, Site-17 > 614aedd2e482850a16375d74a22f82 Bottom block: > > Most esteemed Assistant Director, > > Having a live target to practice unloading onto, even if its just rubber bullets, has really helped make the new guard recruit less green behind the gills. They're taking to it like a moth to flame. > > Thank you for helping me show them the ropes. > > Yours, > > **Samir Abdul** > Arms and Equipment Chair, Site-17 > ec97790de629e3aa991018e217b3bd9457 ### Signatures * [**`614aedd2e482850a16375d74a22f82`**](#614aedd2e482850a16375d74a22f82) * [**`ec97790de629e3aa991018e217b3bd9457`**](#ec97790de629e3aa991018e217b3bd9457) The first hex is 15 bytes, the second hex is 17 bytes. Join them together: `614aedd2e482850a16375d74a22f82ec97790de629e3aa991018e217b3bd9457` Decrypt with AES-128: * Key: `3d455854494e47554953484d454e543d` (`=EXTINGUISHMENT=` in hex) * IV: `2669e9530cc5b58ce26db55880177e4b` again Output: `What's going on in Site-17?` ## `67304535/0acce36` ==bin->== ==85->== > > > Ms. Frederickson, > > The emptying of the anomaly's old containment chamber has been carried out as per Assistant Director Goode's request. However, I have a few concerns: > - These supplies are all very high-value, and put us outside of our approved budgetary allowance for the quarter. Not to question you or Assistant Director Goode's judgement, but why are we ordering all of these for an anomaly that is to be terminated anyway? > - The fact that you have requested for Administration and Oversight to get involved in covering up the budgetary inflation is cause for concern. The only reason I know about this, by the way, is because A&O Deputy Director Vargas approached me to comment on how ridiculous this all is. > - You requested Class-C Amnestics for use on J&M personnel building this new containment chamber? Why? > I hope you are able to put my concerns to rest, Ms. Frederickson > > Yours, > **Albert Black** > > Janitorial and Maintenance > *Section Sub-Head, Maintenance, Site-17* > bm90aGluZyBoaWRkZW4sCm5vdGhpbmcgQWRtaXR0ZWQuCndobyBpcyBpdCB3ZSBzZWVrLAp3aGVuIG91ciBWaWNlcyBhcmUgc2hvd24/Cgo9WlNPRElCUEROQ0haSU89IEROIE9DWiBGWlQ= > Last line ==64->== ``` nothing hidden, nothing Admitted. who is it we seek, when our Vices are shown? =ZSODIBPDNCHZIO= DN OCZ FZT ``` Caesar shift the last line 5 letters forward: `=EXTINGUISHMENT= IS THE KEY`. [**`=EXTINGUISHMENT=`**](#extinguishment). ## `=extinguishment=` `RESOLVED` is not a lead. The Fire Suppression Department comes from the SCP wiki, where they consistently end cases they complete with `RESOLVED` in a similar kind of font. This is then a stylistic choice. ## `27 63 a5 be c9 6e af 86 ca 7c a7 18 a9 04 64 82` `Koh//Entry81449407841a66d4e60a514041090cf5`. Part of it seems encrypted. Decrypt the `81449407841a66d4e60a514041090cf5` using AES-128 with Koh's: * Key: `706f6c666e736863757a6e776c646f66` * IV: `2e74696d65776173686573636c65616e` The output is `3/T60-MC616-A`, so the password is then [**`Koh//Entry3/T60-MC616-A`**](#kohentry3t60-mc616-a). ## `koh//entry3/t60-mc616-a` `-P`!? We got stuck here, but fortunately we knew this was too short to be used. ## `614aedd2e482850a16375d74a22f82` `Koh//Entry78066bc9758326843af13325ee39e546`, `78066bc9758326843af13325ee39e546`. AES-128, Koh's: * Key: `706f6c666e736863757a6e776c646f66` * IV: `2e74696d65776173686573636c65616e` `2/C34-TK998-G`, [**`Koh//Entry2/C34-TK998-G`**](#kohentry2c34-tk998-g). ## `koh//entry2/c34-tk998-g` `Y`. This and `-P` must be parts of a larger password. ## `ec97790de629e3aa991018e217b3bd9457` The autostereogram shows [**`2FC1`**](#2fc1). Read it by crossing/straightening your eyes. Northwood's intended solution is https://magiceye.ecksdee.co.uk/. The EC had no idea what an autostereogram was. :::spoiler What is an autostereogram? When you look at a thing, both of your eyes turn to see it. Your eyes are more parallel for farther things and more crossed for closer things. I'll call this as your eyes "hooking" on it. For example, hold a finger out close to you, then notice the surroundings behind it double. Your eyes can only hook at once place, not everything at once. This has nothing to do with _focusing_ your eyes -- something is "in focus" if it is not blurry. Usually, hooking and focusing happen on the same object. You likely never noticed the doubling, since your eyes hook on the object, and everything else is too out of focus to notice the doubling. However, you can learn to unhook your eyes: cross your eyes, or focus at something in front of or behind the object. Autostereograms are viewed by unhooking your eyes to hook behind the image to view an outline of a 3D object. You might remember them as "Magic Eye images" from the _Magic Eye_ books that have a lot of them. They are made up of repeating colors or image that are slightly modified. The closest way to seeing an autostereogram properly is: * Get closer to the screen until the colors line up. Keep the colors lined up as you slowly back away. Do not hook your eyes on the screen; keep them relaxed. (Hooking looks like the image suddenly not doubling and the focus being clear.) * You've heard of people crossing their eyes, but some people can do the opposite and straighten their eyes. Straighten your eyes until the colors line up. Too hard? Try these, though the depth will appear inverted. * Cross your eyes until the colors line up. * Hold up a finger in front of the autostereogram and look at it. Since your eyes will turn towards the finger, the screen behind it will double. Move closer to the screen until you can see it clearly. ::: ## `2fc1` Out of `2fc1`, we found: * These lists of numbers: [**`71 765931`**](#71-765931-671395-17653-67513-67513-1736-176531-713-7136-67513-7563-791-713-1736-67136-714963-67513-73516-176394-791-67513-6713-82-7563-176394-713) [**`671395 17653 67513 67513 1736 176531 713 7136 67513`**](#71-765931-671395-17653-67513-67513-1736-176531-713-7136-67513-7563-791-713-1736-67136-714963-67513-73516-176394-791-67513-6713-82-7563-176394-713) [**`7563 791 713 1736 67136`**](#71-765931-671395-17653-67513-67513-1736-176531-713-7136-67513-7563-791-713-1736-67136-714963-67513-73516-176394-791-67513-6713-82-7563-176394-713) [**`714963 67513 73516 176394 791 67513 6713 82 7563 176394 713`**](#71-765931-671395-17653-67513-67513-1736-176531-713-7136-67513-7563-791-713-1736-67136-714963-67513-73516-176394-791-67513-6713-82-7563-176394-713) * This chapter: [**`Foresight`**](#foresight) * This is `2fc1` in decimal. No indication. No hints. Someone in the EC had to stumble upon this. What gives? [**`12225`**](#12225) ### Lists of numbers Download 13.png, then open in a text editor. The image is corrupted because some text was typed at the beginning of the file: ``` "71 765931" "671395 17653 67513 67513 1736 176531 713 7136 67513" "7563 791 713 1736 67136" "714963 67513 73516 176394 791 67513 6713 82 7563 176394 713" "" ``` * [**`71 765931`**](#71-765931-671395-17653-67513-67513-1736-176531-713-7136-67513-7563-791-713-1736-67136-714963-67513-73516-176394-791-67513-6713-82-7563-176394-713) * [**`671395 17653 67513 67513 1736 176531 713 7136 67513`**](#71-765931-671395-17653-67513-67513-1736-176531-713-7136-67513-7563-791-713-1736-67136-714963-67513-73516-176394-791-67513-6713-82-7563-176394-713) * [**`7563 791 713 1736 67136`**](#71-765931-671395-17653-67513-67513-1736-176531-713-7136-67513-7563-791-713-1736-67136-714963-67513-73516-176394-791-67513-6713-82-7563-176394-713) * [**`714963 67513 73516 176394 791 67513 6713 82 7563 176394 713`**](#71-765931-671395-17653-67513-67513-1736-176531-713-7136-67513-7563-791-713-1736-67136-714963-67513-73516-176394-791-67513-6713-82-7563-176394-713) I don't know what the `""` is for. ### Chapter Remove that text to fix the [image](https://i.imgur.com/v1qvFTK.png). The image is based on this [ISBN diagram](https://upload.wikimedia.org/wikipedia/commons/8/83/ISBN_zehaztasunak.svg) on [Basque Wikipedia](https://eu.wikipedia.org/wiki/International_Standard_Book_Number). The text is in fact slanted in the original version. The only text change is the ISBN: `9 780262 022088`. ISBN `9 780262 022088` is a hardcover version of [_Vehicles, Experiments in Synthetic Psychology_](https://rednoise.org/readings/vehicles.pdf) by Valentino Braitenberg. The repeated insistence of `13` had someone look in the book for it. In the table of contents, entry 13 is [**`Foresight`**](#foresight). #### ISBN? An ISBN, short for International Standard Book Number, is a unique book ID. Identical books and reprints get the same ISBN. A paperback and hardcover get different ISBNs. So do different editions of a book. Search up an ISBN to find the unique book that has it, down to its edition and whether it's a paperback or hardcover. ## `71 765931` `671395 17653 67513 67513 1736 176531 713 7136 67513` `7563 791 713 1736 67136` `714963 67513 73516 176394 791 67513 6713 82 7563 176394 713` These all show the same image of a computer and numpad. This image is based on [a disassembled Apple II EuroPlus](https://www.nightfallcrew.com/wp-content/gallery/apple-ii-europlus-abt-inc-numeric-keypad/IMG_0521.jpg) on [nIGHTFALLCREW's blog post](https://www.nightfallcrew.com/23/03/2014/apple-iiii-europlus-abt-inc-numeric-keypad/). The only change is that the numpad's 6 and 9 are swapped, which hints the digits are in a 3x3 grid. ``` 7 8 6 4 5 9 1 2 3 ``` Returning back to the lists of digits, ``` "71 765931" "671395 17653 67513 67513 1736 176531 713 7136 67513" "7563 791 713 1736 67136" "714963 67513 73516 176394 791 67513 6713 82 7563 176394 713" "" ``` I noticed that: * They can't just be numbers. There are far more odd digits than even ones, and there's no `0`. * Each number widely varies in length. This suggests each number should decode to a letter using the numpad. I first guessed each digit is a direction on the numpad, which led nowhere. I then guessed the digits form positions on the numpad. For instance, `71` decodes to a straight line on the left (an `I` or a `1`), and `765931` decodes to a fancily drawn `3`. These lines: ``` "71 765931" "671395 17653 67513 67513 1736 176531 713 7136 67513" "7563 791 713 1736 67136" "714963 67513 73516 176394 791 67513 6713 82 7563 176394 713" "" ``` Then decode to: ``` "1 3" "G R E E N B L U E" "M D L N O" "H E X A D E C I M A L" "" ``` x3j50 confirmed each line is a hint. We later found out that each line alludes to a separate puzzle and are not in order. * `13` was confirmed by x3j50 to hint to the [**`Foresight`**](#foresight) password we had already found. * `GREENBLUE` drove the EC crazy until they found [**`12225`**](#12225) the next day. * `MDLNO` is short for `Model No.` or the model number. This is Very Important. * `HEXADECIMAL` is Unnecessary. The EC also noticed the numpad works as a password: [**`786459123`**](#786459123). ## `786459123` This is an image of an AC unit `AC.PNG`. On it is a Post-It note saying ``` This POS is not working! REPLACE IT ``` Understand that this is x3j50's (and other Northwood writers') first ARG. After resorting to major hints throughout the ARG, the writers figured out how to include these hints in the ARG itself. This Very Important hint is clever, too clever. As a reminder, we at the time only knew the passwords listed above this one. We got stuck on this for an entire day, until x3j50 gave a hint to solve this. The EC will never forgive this AC unit. :::spoiler **Click to reveal. Spoils future details of Act 2.** You may have guessed that this hint means nothing. There is in fact nothing hiding in the image nor in the note. Unfortunately, the answer is worse. As a reminder, `13`, `GREENBLUE`, `MDLNO`, `HEXADECIMAL` each allude to a different puzzle. `MDLNO` alludes to the last puzzle. Northwood included the AC unit and note as material for this last puzzle. Since we hadn't reached that puzzle yet, there was nothing in this image for us to use. When the EC first found the AC unit, they hadn't even decoded `71 765931` yet. 4 hours later, Northwood sends a message in the inbox to look at the numpad and "put the giant string of numbers" into it. After finding `GREENBLUE` and `MDLNO`, neither I nor the EC had the puzzles they alluded to. We instead linked `MDLNO` to the Apple II image... because the image had a model number in it. I checked back in the voice channel once. They were haphazardly guessing at any `GREENBLUE` hex colors or `MDLNO`s they could find about the Apple II or the numpad. They told me about the AC unit. They told me it made them crazy. The AC unit was unusable to the EC for 34 hours. They got stuck on at least two puzzles. One about following instructions unknowingly written out of order. One for a seemingly simple puzzle which Northwood didn't write the correct answer for. When they reached the final puzzle, they correctly used the AC unit to figure out the puzzle. They still don't know what the AC unit was for. How was my experience with the AC unit? I ignored it and figured it was a hint for the numbers I decoded. (It was not.) I also got stuck on the out-of-order instructions. Fortunately, Northwood by now had added a new password to fix the order, which [did not work](#None-of-the-passwords-work-anymore) when I guessed it. When I got to the final puzzle, I clicked ".75" instead of "0.75" on the website - and saw an image of an identical AC unit with the wrong model number. This has nothing to do with the AC unit. It never did. It merely acted as a red herring for a majority of Act 2. Was the hint clever? They told me about the AC unit. They told me it made them crazy. As the saying goes, "The tree forgets. The axe remembers." ::: ## `foresight` Last line is `Koh//7fa52ffb296361f746b21520452684c4`. Similarly decrypt `7fa52ffb296361f746b21520452684c4` with AES-128 using Koh's: * Key: `706f6c666e736863757a6e776c646f66` * IV: `2e74696d65776173686573636c65616e` The output is `Archive/T9849`, so [**`Koh//Archive/T9849`**](#koharchivet9849). ## `koh//archive/t9849` At the bottom are `6-P` and `69/0d/n3oJA768_o.png`. The `6-P` is also part of a password as before. Note that the Act 2 image URLs such as (https://images2.imgbox.com/37/56/qwjXqnHw_o.png for Howell's image) end in a similar way. As a result, try out `https://images2.imgbox.com/69/0d/n3oJA768_o.png`. [The image](https://web.archive.org/web/20260307140553if_/https://images2.imgbox.com/69/0d/n3oJA768_o.png) shows a blurry frame of the redacted SCP from the Entry 2 video. The text **`toomuch`** is placed on it. ## `12225` Finally, a green-blue image. The green is `#08e531` and the blue is `#8d9ef2`. This is where the `GREENBLUE` hint fits next: **`08e531`** and [**`8d9ef2`**](#8d9ef2). `GREENBLUE` would also hint to try out [**`08e5318d9ef2`**](#08e5318d9ef2). They and I hadn't found this before, because the password was broken until x3j50 unlocked it. This password resolves quickly and so is shown below first. ## `08e5318d9ef2` `Koh//Entry45c010feeade9f453a1a8dab0095fd3c`. `45c010feeade9f453a1a8dab0095fd3c`. AES-128: * Key: `706f6c666e736863757a6e776c646f66` * IV: `2e74696d65776173686573636c65616e` `4/G35-XX261-K`, [**`Koh//Entry4/G35-XX261-K`**](#kohentry4g35-xx261-k). ## `koh//entry4/g35-xx261-k` `2`. Part of a larger password. ## Discord: [#deepwell](https://discord.com/channels/330432627649544202/1417671754637246595/1439983022278709299) (Nov. 17) This is recorded out of order. I don't know when during the ARG this appeared. It seems to be AES-256, since the bottom says the Key and IV are unavailable. ``` 7781ebe58c6dc62a7da0ca8dfa8254022bc38523f12f8a4b6558f233a13c0d716b7168971c8c6c0fbe85e47c346a79772e986a89ce82269b5530d4ade065b507a9ac52f88a1f8c8b4be906527561787d6f29195103ad9cacac7120f03e9eacd4f3f45b549567bfd9706394116fc8f3933aa38506a1094838bf62d3237c64042ad5d7d9b7605626f0e175ac974168bde9de8fa94f5753936e6e17f355ba1ff0c5f80860a7584ac863d01fbcc01f5664b2e88324adcd218e1f0fe908718a73479ebe77d7632bed32cde6b6452a3c95becece392b5033972cd984afb4d26cc6347626e332d696535ac3e3aa8611805bfea849462bc89ab256749b41a7eeb57f6fda16b95957134114030341ba7c565b794a76d954fe9fcd4e038bed732429b80bcb966cdee25542a7bf654d1ae489551e9488e3025ead5948f8f7bfa087970db5c7df92217f399c0df0d66a632c4db45ae046b6c65c84670f409d017a337954c7fda73a845a853b9b2912b4b32d143d1f86a5405cb258329593d873e2e56fc4ec2525061eb96090b6403d62f3a59cbf3398959924c21163ced7b646cf4de21f0c8b578d11de3fd514966891e2d78314b017537b994659a811978b41207cc57e9565154cd1fa07aff40842ba4d089d706a4aba1addfde7fdce6d5feed490f7787eb30bb8b197324a4afde64f02b103645bd842916294b5bd95e7be441b2a3989c8e2e3b7414093de900aec389cc09c3c6e260c033519eaa939d8b9e016fce260e97bacc2b5a0db6061a2ee466d0d59085800b79e7122869487c6af99ec38dadf8cb11c0a2dee7ba1bb66393e3072814e6c6300afdce32f44664cb8bcfa36eabbd51188a815c897d2552570d3bc945069e119e172e6ad90885ecc1cca0eb6f4661a6f10491f2790887ba6783f36a0483fb8993cfdcb1edb6098062a06be84205647181a49c5320bcb793b3e2a0967d6f31be98eb66a4be54b611cc7343207817046a01f46dab8126e63de50d288b1f2260212a5562cdc3c0b3f9dfbff4103036bfeb18538e33119e3a35137eed3258888d72545ad716aa3cca3fe89a8b6c359b78665519e957051844a10069f6649d60359c6bc4316f6b1de0b7f07c70a90d7fb64f0ff12a29e7e4bd2584ece802ce645e3f5be80e0d164e8a4b969e0a2a6de5788c31d4616df23a9b376ed6fbd793716b452ec8fbb21fa1ac1a3748b93266855f2fd11f111164bf85cd9eea79843f71600acf02a1d613b64a54c38be6a7c0caad52788321640d8fadf3d24d9f491124a9d230a590131a8519d97fbfa769bfa7c4af8c816441258a557e1b873b317b0fc9950 ``` Koh's key and IV don't work. Trying out keys and IVs, decrypt with AES-256 using a different familiar key and IV: * Key: `5bf03579675be09672201a21ed3c9fab18bcc956ba76ad109a8a1a13ddc63f07` * IV: `2669e9530cc5b58ce26db55880177e4b` Output: ``` [ { "contents": { "headers": { "sender": "s.cromwell@ethics.scp.int", "date": null }, "id": 673902, "date": "null", "format": "standard_email", "data": "Hey team. I think Sandra and I discovered something that might be helpful. It pertains to the memetic inoculation of Site-17’s image archive.\nWe looked into one of Dr. Lillian Lillihammer’s publications on memetic data (all 655 pages) and stumbled into this segment, which may be useful for your investigation.\nMemetics is an unfathomably complicated field, so I don’t blame anyone for not thinking to do this, in fact the memetic might have prevented you from thinking about it straight up. But if there’s anything that cognitive resistance training has taught me, not everything should be taken at face value.\n `Lillihammer//MBM_uhicswik_Publication.pdf`\nGood luck team. " } } ] ``` Scroll right to see **`Lillihammer//MBM_uhicswik_Publication.pdf`**. In there, the image circles a formula to convert hexadecimal to decimal. This hint is Vague. ## `8d9ef2` [**`8d9ef2-1`**](#8d9ef2-8d9ef2-1-8d9ef2-2). Also, **`8d9ef2`** to **`8d9ef2-1`** suggests to try out [**`8d9ef2-2`**](#8d9ef2-8d9ef2-1-8d9ef2-2). These three form a set of hints. See below. ## `8d9ef2`, `8d9ef2-1`, `8d9ef2-2` **`8d9ef2`** and **`8d9ef2-1`** state: * There are two values from a `Grant Bolton-accelerator` called the two `GB H-Values`. * These values needed to be converted from something involving 16 to something involving 10. It gives an example that `42824` converts to about 272000. * The values are accepted as a linked string. * This should be compared to the `Interspatial Scranton-Bennet Negativity constant` to follow `Valenstein’s definition`. * It outputs a `D-grade 11.5% success rate`. **`8d9ef2-2`** states to concatenate before converting. [I didn't see this hint.](#None-of-the-passwords-work-anymore) This means to: 1. Take the two Green Blue Hex Values: `08e531`, `8d9ef2`. The H did not stand for Hue. 2. Join the values: `08e5318d9ef2`. 3. Convert to decimal. The hint confirms this since `0x42824` = `272420`. Then `0x08e5318d9ef2` = `9780471897842`. 4. Compare this to the "I. S. B. N. constant" by noticing it begins with `978` and so is an ISBN book number. This book is _Brain Control_ by Elliot S. Valenstein. The author shows we are on the right track. 5. Presumably look for `D` and `11.5%` in the book... But the book is not free to access. Fortunately, when x3j50 shared a free link, the link happened to be on page 225, which was then [screenshotted](https://media.discordapp.net/attachments/1417655826499239936/1440108414561685664/image.png?ex=691cf4f9&is=691ba379&hm=d94beb2e69a3812f48e5924ad6f09d77ad2c8a8e84c0183b392865b2b3154f98&=&format=webp&quality=lossless&width=1478&height=1196). On the row with `D` and `11.5%` is [**`Transient improvement but relapses`**](#transient-improvement-but-relapses). The second password hints to decode a list of 27 things one at a time. ## `transient improvement but relapses` The list of 27 numbers begins in hexadecimal: `47 bafeb a3ea3 44f5 107b9 107b9 6c8 ...... 1d8b 2b10a 2c9` ==hex->== `71 765931 671395 17653 67513 67513 1736 ...... 7563 176394 713` These are familiar numbers, which numpad decode to `13GREEN ...... MAL`. As a reminder, the numpad numbers from earlier were: `71 765931 671395 17653 67513 67513 1736 176531 713 7136 67513 7563 791 713 1736 67136 714963 67513 73516 176394 791 67513 6713 82 7563 176394 713` Since there are also 27 of these numbers, we can assume this must be the list of 27 numbers. In hexadecimal, they are: [**`47 bafeb a3ea3 44f5 107b9 107b9 6c8 2b193 2c9 1be0 107b9 1d8b 317 2c9 6c8 10640 ae8d3 107b9 11f2c 2b10a 317 107b9 1a39 52 1d8b 2b10a 2c9`**](#47-bafeb-a3ea3-44f5-107b9-107b9-6c8-2b193-2c9-1be0-107b9-1d8b-317-2c9-6c8-10640-ae8d3-107b9-11f2c-2b10a-317-107b9-1a39-52-1d8b-2b10a-2c9) Unfortunately for the EC, the password didn't work until Northwood fixed it. x3j50 has revealed that the `Power 10%` from the second hint refers to powers of 10, or to convert the numbers to decimal. As for the `5-6%`? It could add to `16%` or to convert back to hexadecimal? That's Unnecessary. ## `47 bafeb a3ea3 44f5 107b9 107b9 6c8 2b193 2c9 1be0 107b9 1d8b 317 2c9 6c8 10640 ae8d3 107b9 11f2c 2b10a 317 107b9 1a39 52 1d8b 2b10a 2c9` [**`Howell/Long//ThatDamnAC`**](#howelllongthatdamnac). ## `howell/long//thatdamnac` Right-click the image to [download it](https://uploaditonline.com/download/27T8yPkXAPW). It shows a 2x4 of tetanus canisters that may contain refrigerant. --- `Koh//Entryef24c35c12a4f13657f001c60ce795a2`, `ef24c35c12a4f13657f001c60ce795a2`. AES-128: * Key: `706f6c666e736863757a6e776c646f66` * IV: `2e74696d65776173686573636c65616e` `5/J50-PX789-G`, **`Koh//Entry5/J50-PX789-G`**. With how quickly the entries are being shown, Northwood has seemingly run out of puzzles to throw at us. --- Finally. The [AC unit](https://web.archive.org/web/20260307140414if_/https://images2.imgbox.com/a1/21/EkKnAJT1_o.png) is useful. It's about time the EC replaced it. To do that, they needed its Model Number. They knew that: * The AC unit uses refrigerant R-410A. * From `T_Attached_075`, the tonnage is 0.75. Caution: `0.75` and `.75` are different options! The [link](https://my.daikincomfort.com/category/product-catalog/equipment/0ZGRn0000000E7sOAE) lists units. They filtered by refrigerant `R-410A` and tonnage `0.75` and found the [Daikin FTXS Indoor Multi-Split Fan Coil](https://my.daikincomfort.com/product/daikin-ftxs-indoor-multisplit-fan-coil/01tRn000006X2xnIAC) with SKU [**`FTXS09LVJU`**](#ftxs09lvju). --- Explained below, it is possible to guess [**`R410A`**](#r410a), though I haven't seen anyone do this. ## `ftxs09lvju` [**`R410A`**](#r410a). --- [Original image.](https://commons.wikimedia.org/wiki/File:DAIKIN_AIR_CONDITIONER_OUTDOOR_UNIT_(163).jpg) At the lower right is the SKU. Invert brightness to better see it starts with "4MXS100EV2." * The closest I got on the link was [this search](https://my.daikincomfort.com/product-search#f-sffamily=4MXS_NMVJU,4MXS_WMVJU9) with SKU starting with "4MXS". They are both called the "Daikin MXS Series Outdoor Multi-Split Heat Pump," and they also use refrigerant R-410A. * The most exact match is [this](https://www.manualslib.com/products/Daikin-4mxs100ev2c-10264155.html) manual for SKU 4MXS100EV2C. The search almost matches the manual, except neither picture shows "R410A." That is because the R410A sticker does not identify the unit. It only means the refrigerant used is R-410A -- the same `R-410A` seen earlier. In other words, had someone read `R-410A` in the previous password and guessed [**`R410A`**](#r410a), it would've been correct. ## `r410a` `Koh//Entry8143362cca573a11c051faa0735cac74`, `8143362cca573a11c051faa0735cac74`. AES-128: * Key: `706f6c666e736863757a6e776c646f66` * IV: `2e74696d65776173686573636c65616e` `6/Y77-NT532-L`, [**`Koh//Entry6/Y77-NT532-L`**](#kohentry6y77-nt532-l). ## `koh//entry6/y77-nt532-l` `koh//finalentry/###-#R909-#`? The format of the entry passwords has always been `Koh//Entry1/A11-AA111-A`, where `A` is a letter and `1` is a number. Fill in the blanks with the small letters and numbers from earlier: * [**`koh//entry2/c34-tk998-g`**](#kohentry2c34-tk998-g): `Y` * [**`koh//entry3/t60-mc616-a`**](#kohentry3t60-mc616-a): `-P` * [**`koh//archive/t9849`**](#koharchivet9849): `6-P` * [**`koh//entry4/g35-xx261-k`**](#kohentry4g35-xx261-k): `2` [**`koh//finalentry/Y26-PR909-P`**](#kohfinalentryy26-pr909-p). ## `koh//finalentry/y26-pr909-p` The image has alt text `HighContrast`. The image below that has alt text `thistimetomorrow`. Faintly at the bottom of the `HighContrast` image is: `798b58eeb8c28147ae934cff93283e8eb4ceb25a31217991fa7ec770e0f147f8` AES-128, Koh's: * Key: `706f6c666e736863757a6e776c646f66` * IV: `2e74696d65776173686573636c65616e` [**`koh//autopsy-89e`**](#kohautopsy-89e). ## `koh//autopsy-89e` `Name//Filename/Password`? The EC found that `iwishthaticouldturnbacktime@123` is the password. [**`koh//autopsy-89e/iwishthaticouldturnbacktime@123`**](#kohautopsy-89eiwishthaticouldturnbacktime123). For those coming in after the EC (such as me), the last password is spoiled by: ## Discord: [#deepwell](https://discord.com/channels/330432627649544202/1417671754637246595/1440162502783664273) (Nov. 17) At the bottom is `access `[**`koh//autopsy-89e/iwishthaticouldturnbacktime@123`**](#kohautopsy-89eiwishthaticouldturnbacktime123). Just right there. It deflates the achievement of reaching this point. ## `koh//autopsy-89e/iwishthaticouldturnbacktime@123` [**`KOH//AUTOPSY-89E//ATTACHMENT`**](#kohautopsy-89eattachment). ## `koh//autopsy-89e//attachment` End of Act 2. The image has alt text `HeDeservedIt`. The EC solved this in under 55 hours, from [Entry 2's premiere on November 15, 2pm EST](https://youtu.be/iE4-jx2whZo) to [the first mention of this password](https://discord.com/channels/1310057454028984320/1417655826499239936/1440155706933248010). # Intermission 2 **`thomasgraham//file`** was updated to say `//unitedfront` and `//tragedy`. **`thomasgraham//unitedfront`** and **`thomasgraham//tragedy`**. ## Discord: [#deepwell](https://discord.com/channels/330432627649544202/1417671754637246595/1442562794087120986) (Nov. 24) At the lower right are QR codes. The upper left is a fainter upside-down copy of the bottom right. All QR codes are identical. The QR code is `https://qr.link/mA48IX` which temporarily linked to [https://images2.imgbox.com/e3/ba/SY2F3jEt_o.png](https://web.archive.org/web/20260307222241if_/https://images2.imgbox.com/e3/ba/SY2F3jEt_o.png). Unfortunately, the `/J50-PX789-G` lead in the emails only imply **`Koh//Entry5/J50-PX789-G`**. This password already matches the content stated, and also matches the security department "having a lead" -- the file was found as evidence. ## Discord: [#deepwell](https://discord.com/channels/330432627649544202/1417671754637246595/1471918784624197773) (Feb. 13) 2026 has arrived. 4 messages, the last at 6:20pm EST being a Youtube link. This confirms Site-02 is in Greenland. The closest to a puzzle to confirm Site-02's timezone. The 3rd message is: > **Notice** > Estimated Time of Restoration: 21:20 (Site-02 Time) The 4th message sent the video at 6:20pm EST or 18:20 EST (UTC-5). This gap is 3 hours apart, so Site-02 uses UTC-2. Comparing this to Greenland, the government passed a law to [permanently remain in UTC-2 in 2023](https://www.timeanddate.com/news/time/greenland-change-timezone-2024.html). Nothing interesting otherwise. This also means the `6PM tonight` time mentioned in the 2nd message corresponds with 3pm EST. # Act 3 Prelude ## SCP:SL: [125 Compatibility Patch](https://store.steampowered.com/news/app/700330/view/509605417596223544) (Feb. 13) > Successfully established encrypted communication uplink in Loading Bay 125 and adjacent systems in preparation for anomaly intake. The game was updated with three new audio files: `sstv1.ogg`, `sstv2.ogg`, `sstv3.ogg`. These three audio files also play from different ingame locations. Using an [SSTV decoder](https://sstv-decoder.mathieurenaud.fr/), * `sstv1.ogg` SCP-049, outside. Base of shutter door near "LOADING BAY 125". ![sstv1.ogg](https://i.imgur.com/40YYKDZ.png) > **Ethics Committee** inquiry has gone cold. > Is there an update to the alleged transfer? > WWW.DEEPWELLACCESS.ONLINE This transcript doesn't need to be completely accurate to solve: > ACCESS > `ODN582M5R956JK439ATY` > `BEILMAQQTPMSWZKOIBCF` > `MIIA58T3IVQTUVEFWFST` > `FUO38O4ZM79VOPCMYZXM` > `I2VX556XPEYWSV6O1G4C` That location seems to be... * `sstv2.ogg` Nuke, bottom. Armory side, out of bounds, behind the fence, left. Door. ![sstv2.ogg](https://i.imgur.com/11Gd78j.png) > For the time being, they're asking for the plans of its containment chamber to be built. Upside-down: > why does the Overseer insist > on bringing in more SCPs? That location is definitely... * `sstv3.ogg` Wayside. Bottom of central pipes. ![sstv3.ogg](https://i.imgur.com/zcl7r8q.png) > IT HATES US > IT HATES US > SO > SO > MUCH That's the Subject's containment chamber. The first image is a grid of characters, while the other two look like rectangular holes cut out. Overlapping the second image over the first, the white rectangles overlap over the characters `D`, `5`, `5`, `P`, `S`, and `V`, so [**`D55PSV`**](#d55psv). Similarly, the third image needs to be shrunk. Zooming the third image down at the lower-right corner to a height of 100px, the gray rectangles overlap over the characters `A`, `T`, `F`, `3`, and `E`, so [**`ATF3E`**](#atf3e). ## `d55psv` `"precious castle" + " " + $MISSING_STRING`. ## `atf3e` `"county"`. Combine: [**`precious castle county`**](#precious-castle-county). ## `precious castle county` The image has alt text `Lonely`. File `Eomma_WhatsApp_20260213.txt`: ``` End-to-end AES-256 Block Encryption. Source: WhatsApp. "4c 44 4e 38 35 4d 33 48 43 37 33 4d 41 50 44 4e 45 37 54 48 31 33 37 44 4e 41 50 53 6f 73 75 74" IV String "H%BGP9F5N98ZSV45" a1 a2 a5 7f 7e 46 1f b1 d5 29 24 8a 1f c9 8f 8e 16 66 d7 1a e3 d6 2d 94 20 36 f8 ae 84 fd 50 1f 6d ea f2 5c af 14 9a 00 f0 ab c8 fd bb b3 51 5d 17 a3 ed 43 f4 16 22 75 1d d4 ce c7 5d 2b b3 e1 e4 ce 59 86 98 6f a5 a7 50 76 57 cc fa 66 c2 b2 a8 5f 76 3e 3d e6 a9 63 42 a4 b8 7d 5a 6e a9 da 53 8b ff f7 17 34 a8 75 da d7 6f 24 77 93 bc b2 02 b0 5a 71 83 77 e6 cb 7b 32 34 9d dd 24 18 f2 cf 15 69 c1 56 c1 50 62 d0 58 a7 c2 ca e7 28 af 7a e7 3b a4 1d 1c e9 c3 cd c3 34 72 3a d9 e0 64 17 c8 9f fa f5 83 0d d5 62 c3 0f 83 01 90 2b 45 d3 fd 41 2a d0 73 66 c6 9a d2 84 97 96 92 cd 4c 86 a2 56 7a b5 49 5d 41 25 c6 37 e6 56 1e 46 b9 b9 4c a0 5d f1 d1 68 4f 07 7f f8 65 1d 17 58 e6 e4 e2 43 dc 82 82 1d 5d 54 42 c2 52 5b c2 95 97 96 2d 1e 4e 77 aa 46 58 10 d6 a5 fe f4 a0 3c b9 5c 45 06 f4 50 57 da 31 9f 2b 29 23 2c 7b b6 0b 5d a5 89 93 9e 79 18 77 1e 74 d0 3f 62 2a d3 4d a8 d1 04 35 fa 57 36 18 63 10 35 06 6b 7a 33 60 ea 6d 68 d5 d3 d7 c3 02 60 53 d0 bf ab 24 53 ca 14 b8 10 47 b0 58 40 aa b5 63 02 1d 42 6c f2 d7 a5 95 c6 42 1b 99 05 03 68 5c a7 7b 6b 38 14 d2 74 ed 75 1f 33 66 dc 8c 31 ba 4d a5 9a b8 77 9f bf c7 36 56 d6 b9 54 01 c9 7f ea 68 8b a1 da bc f0 7e f6 83 ba 4a 8f 06 30 d5 85 bb 0b 16 a7 5a 50 9b ce f6 21 f0 8d 49 d2 28 39 84 07 56 76 86 0b a9 5e 63 15 75 05 bc 2d 05 12 c4 29 fc f0 33 56 48 a7 51 37 d3 75 ae 25 72 81 6d 0f 7f 8d 2e 07 99 e3 f8 bc 04 c9 47 47 24 4f 37 a6 c7 f9 48 18 c1 70 64 9e 99 c9 6e 61 c4 a6 c2 5a 3b 6f 41 b9 08 a5 de 69 cf ee 72 d5 a2 75 0c 4d 5c 2b a2 03 67 ca 1b b6 89 a9 7e f0 8a 68 1d ca 45 d9 90 62 16 a2 84 82 59 84 63 d1 6c 68 a0 f7 a0 fe cf 8c 2b 6c 90 27 d8 f3 32 0a e3 76 a9 ad 38 96 1b 46 cf 2d dd 80 ee 2c 78 40 5b 10 a1 2b 14 e5 1e d4 b8 dc ac b7 5c 89 d7 21 63 0a 8a b6 63 a4 ca 6b c3 80 e7 c6 0c f6 1f c1 05 d4 ac 48 7b 77 5e a0 3f e4 b2 91 2e 22 6e d7 d3 96 ee d9 81 24 db 66 f2 77 6a ad 73 4c d3 a5 dd fb 99 ae 10 f3 d6 45 d4 9a 52 1d 96 d0 d5 63 cb d5 70 1d e3 01 bc ad 64 3c 6e 9b 27 33 5c 68 5f 25 3e 0a 76 74 27 fd e7 e5 b7 db 3a 2f 7d 86 eb ad 33 02 52 20 52 29 5b e1 0b 54 3e d6 c4 0c 66 7a 50 90 e6 d1 10 9b 18 0b 63 56 1f 02 d6 69 87 d7 21 6b 76 2a 2f d6 e1 00 9f 12 e6 a6 da 54 a0 9b 54 ab 27 fa f5 a6 cf 70 88 d7 f7 ba 98 c3 12 db e4 6a d7 24 5c 95 b0 ea 79 2b 52 5e 33 2a f7 c9 f0 bd ef b4 33 b3 c6 13 6a 3b c3 6f ef 3f 3c 4c dc f5 46 85 b0 75 a4 0c a1 22 38 ff 67 53 e7 1c f6 8c aa ac 88 98 1d ed d3 3f 81 f7 14 3d a4 30 cd df 86 e8 4b 7f 26 77 c1 4b 0d 49 32 62 4b 0d 60 b4 d1 5b 89 33 27 2b 1e cc 36 cb d6 7d ad 03 c2 d1 fc e8 4a e4 88 9f 45 57 26 f0 35 5f b4 9e 7f b3 4d b0 b0 8d db 10 1d 9d 0b 64 b1 00 80 39 21 df 85 82 de 7d ae 24 b5 2f 47 2e 67 3c 08 bc 4d 86 cd 7e bf 68 41 d7 5e d9 90 23 e2 61 43 4e ce 0d d5 39 86 04 10 be d4 b1 80 01 da 0e 81 6b 0b b3 31 8f ed 5f 89 f5 02 11 98 1f 2d 0c 02 1e 16 35 ca c2 71 f0 5e ea 47 d7 f7 f3 d3 1e 13 4a fc fa f2 60 17 2e 36 94 a1 1a 15 10 08 2a 5c 94 26 39 31 f2 7f 1c 48 3e f8 65 08 2e 38 82 be ba ce 30 a2 ed 7e 21 a9 75 63 dc b8 16 d4 8d e4 83 72 b7 88 ad 85 a9 62 13 9d f8 80 6c 47 bd ab fd f7 9a 64 13 00 09 58 f4 2b 36 16 ed c6 d2 b1 75 ba 07 20 74 5e 23 41 2d a6 02 9f f3 00 cb c3 54 ad 55 f9 7c 84 6a 3e 2a a8 d9 8d 08 85 04 29 dd 36 f8 a7 9a e7 cf 5e 4d c6 23 cf e8 58 63 0b 9a 3a 38 44 ca d8 5f 3f 58 63 d7 f6 a0 b1 b1 42 52 76 39 ad b9 6e a7 52 df 6a f8 93 a1 71 ae 7c 68 75 d7 61 0d 5a 57 3b bd 41 a1 02 d3 08 99 e4 76 e5 67 0a 58 f4 13 db 86 b4 e2 ad 68 04 49 6c f0 0f 9d 04 a4 39 e5 6f df 3c 8b 08 62 61 9b 32 af b5 60 46 db 93 6a b8 fc 45 53 3a f1 ae 85 1c 58 93 fb 3c dc 4d 98 4d e0 40 fa 46 ab e0 6a 0e bb 94 81 fc 32 9c b5 cf 03 a6 a3 09 62 22 e4 63 fd 82 44 39 00 b3 39 1e dd 93 7d dd 49 b1 4f f2 b8 37 ae a8 85 b6 68 5a ed e1 ad 7f f7 21 55 60 2b 63 62 8a b7 a2 9d 73 fb 3f 10 a0 96 b5 49 04 22 cf 99 de cd 18 7c 02 1f fb 94 0f be 0a f5 75 ab 05 ee 2f 70 4e cf 82 3a b0 0f 6d a1 3c 6f 57 57 61 ef 6f e3 e9 c0 66 9e c1 9e af 5a b7 ac c9 63 7e 54 5f 0d 69 6b 0a 94 61 65 20 e3 7e a6 41 93 e5 21 f0 1d 03 7f ac 90 43 69 35 8d 8f 4b 3b 85 6a 3c 7d 00 ca 4e 51 be f8 25 9b ba 29 74 56 48 d9 09 dc ff 85 7b 56 3b ef 3d 84 1f b1 ae 1a 52 8a bf 62 29 64 f7 d8 ce 7c 41 44 79 54 33 6f 78 e1 21 d5 b2 47 06 05 91 05 89 e0 4e bc df 84 5b 22 53 a3 5f 1e a8 ae 88 8d b2 9f 47 e4 16 1f b2 73 76 72 d6 a1 c2 81 c6 f8 2e d0 09 3e ad fe de 54 67 b9 86 4a 56 87 83 12 80 a5 44 d8 ef 86 36 6f 4b 0a 9a 54 c0 ca ca 14 6e d6 78 a8 8f 53 99 81 fd cd 99 8d ed 4a a5 55 68 43 bc 78 af 52 24 0c 27 8f 41 de 3a d9 23 c9 c5 dc 58 31 4e a4 6d 66 7a 70 67 f2 b2 ec 5f 50 f4 23 f6 59 f8 8d 3d 8d 47 70 da a9 7d ad 31 ac cb 44 2f 77 e1 99 bf e5 e5 00 d4 cf c4 9c 5e fb 1c b8 cd 34 cd 61 76 a5 e8 e2 29 c9 0b ca 59 3a df 8d 83 4f e9 02 fc bc b7 f3 47 ee 2e f1 1e e7 b0 78 ce 84 05 90 4d ff 10 6d ae 46 ``` AES-256 * Key: `4c 44 4e 38 35 4d 33 48 43 37 33 4d 41 50 44 4e 45 37 54 48 31 33 37 44 4e 41 50 53 6f 73 75 74` * IV: `48254247503946354e39385a53563435` (`H%BGP9F5N98ZSV45` in hex) ``` { "Conversation": [ { "sender": "Lindsey Koh", "message": "don’t worry about me, mom I’ll be home just in time for New Year." }, { "sender": "Koh Eun-gyeung", "message": "Eun-ji ya,,, you always say small accident, but I worry so much 😢", }, { "sender": "Lindsey Koh", "message": "It was just a small accident in the lab. Somebody messed up calibrating the texture analyzer while testing an oleogel synthesis" }, { "sender": "Koh Eun-gyeung", "message": "I dont understand any of that texture analyzer stuff. Just be careful.. Safety first, k? Book your flight early. Dont do last minute. You have to come for Lunar New Year. Family 다 기다리고 있어.", }, { "sender": "Lindsey Koh", "message": "I will, eomma. I will. I’ll be home." }, { "sender": "Koh Eun-gyeung", "message": "eating properly? I hear Minnesota is very cold. Don’t just work all the time, eat something warm,", }, { "sender": "Koh Eun-gyeung", "message": "Send some pictures. I barely remember your face these days. always saying you’re busy,,, 🙄", }, { "sender": "Lindsey Koh", "message": "Ok 👍" }, { "sender": "Koh Eun-gyeung", "message": "그리고… boyfriend는? 이제 serious하게 만날 사람 있어야지. You’re not getting younger, 은지야.", }, { "sender": "Lindsey Koh", "message": "There will be plenty of time to talk at home, mom." }, ``` `4c 44 4e 38 35 4d 33 48 43 37 33 4d 41 50 44 4e 45 37 54 48 31 33 37 44 4e 41 50 53 6f 73 75 74` ==hex->== `LDN85M3HC73MAPDNE7TH137DNAPSosut` ## Youtube: [Anomaly Transfer](https://youtu.be/HsiP2zIL_Wg) Premiered on Valentine's day, 1pm EST. The video title then changed to... `SCP-953 Reveal Trailer`. We're right. This shows the "containment breach" of SCP-953 killing Goode, where Goode voluntarily enters the containment chamber. The end also teases the surface zone. Honestly, I would've preferred this be revealed as a surprise during Act 3, but... # Act 3 Act 3 began when the Youtube video [Site-17 Deepwell - Finale](https://youtu.be/flm8AigqBzc) premiered on February 15, 12pm EST. ## Inbox ``` [2/15/2026, 1:03:45 PM] FROM: s.cromwell@ethics.scp.int It's happening! They accepted the evidence! Head Supervisor Langford forwarded it to Chairman Tejani himself, and it's *official*. Omega-1 is being briefed to arrest Director Thomas Graham. Finally! Operation Black Dove is a GO! [2/15/2026, 1:59:41 PM] FROM: s.cromwell@ethics.scp.int He stopped typing [2/15/2026, 1:59:18 PM] FROM: s.cromwell@ethics.scp.int He's typing! [2/15/2026, 1:58:14 PM] FROM: s.cromwell@ethics.scp.int Holy fuck! This- This is just what we needed! This email shows that Graham WAS directly involved with Elliot Goode. The orders came from him! I’m going to forward all this to Head Supervisor Langford, see what he thinks! [2/15/2026, 1:56:00 PM] FROM: s.cromwell@ethics.scp.int I wish I had a bigger team. ``` ## Youtube: [Site-17 Deepwell - Finale](https://youtu.be/flm8AigqBzc) At 2:36, [**`X117934KF`**](#x117934kf). ## `x117934kf` Image: ![](https://web.archive.org/web/20260307211446if_/https://images2.imgbox.com/eb/d5/2PkyhpIj_o.png) Code: ``` SGVsbG8sIGNhbiB5b3UgcmVhZCBtZT8KCkFoLCBzcGxlbmRpZC4gWW91IGNhbi4KCkhhdmluZyBmdW4sIEkgYXNzdW1lLiBNb3JlIGludm9sdmVkIHRoYW4gdXN1YWwuIFRoYXTigJlzIHJhdGhlciBleGNpdGluZy4KCk9oIGRpZCBJIGludGVycnVwdCBzb21ldGhpbmc/IFNvIHNvcnJ5LCBsb3ZlLgoKWW914oCZcmUgbWFraW5nIGEgcmVhbCBkaWZmZXJlbmNlLiBCdXQgd2UgYWxsIGtub3cgaXTigJlzIGp1c3QgcGxheWluZyBwcmV0ZW5kLCBpc27igJl0IGl0PwoKVGhhdCdzIGFsbCB3ZSd2ZSBkb25lLCBmb3IgYXMgc2hvcnQgSSBjYW4gcmVtZW1iZXIuCgpjcm9td2VsbC8vZW1haWwvL3RvbGFuZ2ZvcmQKCk15IGtleSwgaWYgeW91IGV2ZXIgc2VlIG1lIGFnYWluLgo0YiA0YyA0OCA0ZSA1MyAzOCA2YSA2NiA3NSA3MyAzNyAzMSA0YiA0YyA0NiA1MCAzOCA2ZSA2MyA3NSAzNyAzNCA0OCA2OCA2YiA2NCAzNiAzMCA0MSA2ZCA2YiA1Mwo= ``` ==64->== > Hello, can you read me? > > Ah, splendid. You can. > > Having fun, I assume. More involved than usual. That’s rather exciting. > > Oh did I interrupt something? So sorry, love. > > You’re making a real difference. But we all know it’s just playing pretend, isn’t it? > > That's all we've done, for as short I can remember. > > cromwell//email//tolangford > > My key, if you ever see me again. > 4b 4c 48 4e 53 38 6a 66 75 73 37 31 4b 4c 46 50 38 6e 63 75 37 34 48 68 6b 64 36 30 41 6d 6b 53 Lindsey Koh has finally updated her encryption standard. This is the New Koh's Key and IV: * Key: `4b4c484e53386a66757337314b4c4650386e6375373448686b643630416d6b53` * IV: `48254247503946354e39385a53563435` (from Act 3 Prelude, also used by Koh) [**`cromwell//email//tolangford`**](#cromwellemailtolangford). `4b 4c 48 4e 53 38 6a 66 75 73 37 31 4b 4c 46 50 38 6e 63 75 37 34 48 68 6b 64 36 30 41 6d 6b 53` ==hex->== `KLHNS8jfus71KLFP8ncu74Hhkd60AmkS`. ## `cromwell//email//tolangford` AES-256. * Key: `4b4c484e53386a66757337314b4c4650386e6375373448686b643630416d6b53` * IV: `48254247503946354e39385a53563435` > You're getting a hang of this already. I suppose something as trivial as a AES-256 block chaining will be no issue for you. > > You know, I do feel bad for Simon Cromwell, don't you? He's fighting for that justice of his but everyone is so... by the books. > > We're both sadly powerless to do anything. > > Level-5 access is a big deal, though. You should see what Cromwell found. > > cromwell//findings/grahammeeting [**`cromwell//findings/grahammeeting`**](#cromwellfindingsgrahammeeting). ## `cromwell//findings/grahammeeting` Italicized: [**`Jailbreaker`**](#jailbreaker). ## `jailbreaker` [**`inc-ae32//953-7428`**](#inc-ae32953-7428). ## `inc-ae32//953-7428` AES-256. * Key: `4b4c484e53386a66757337314b4c4650386e6375373448686b643630416d6b53` * IV: `48254247503946354e39385a53563435` [**`inc-ae32//953-93822`**](#inc-ae32953-93822). ## `inc-ae32//953-93822` ==bin->== ==85->== ==85->== > An excerpt from the Draven Inquiry, a report made in the wake of the recent SCP-953 breach by Charles Draven, Operations Analyst, on the circumstances and security failures involved in its re-containment. > > --- > > 59\. The time between losing track of SCP-953 after the death of the response team and the discovery of a lead as to its true whereabouts was exacerbated by a series of attempts by SCP-953 to mislead site security into pursuing it where it was not. > > 61: Corroborating later security footage, and the death of Daniel Bailey which went undetected until far later into SCP-953’s breach, it can be determined that SCP-953 sent this report using his radio after killing him and taking over his identity. It is notable that SCP-953 at this point in the breach is determined to have been in Sector 45BA, on the opposite side of the Humanoid Containment Wing relative to Sector 12HJ. > > 62: Intentionality of this on SCP-953’s part is corroborated by post-breach testimony from a Senior Researcher, who after memory prompting revealed that SCP-953 encountered him and forcibly extracted the layout of the Humanoid Containment Wing from his mind after someone matching the appearance of security officer Daniel Bailey asked him if he knew where was going. > > 63: After the false report, the coherency of security forces in Sector 12HJ rapidly deteriorated. Two minutes after the report, an Officer Whitehead opened fire on another which was turning a blind corner. Despite Whitehead immediately ceasing fire, the shot officer returned fire now believing the false report was true and killed Whitehead. > > 64: This rapidly escalated, as every act of self-defense and friendly fire incident reinforced the false report's validity in the eyes of officers approaching the scene. Only after a thorough sound-off coordinated by the dispatch garrison did the situation get resolved, and by then, SCP-953 had been allowed to continue unabated through the Humanoid Containment Wing. > > 65: Site security’s tracking on SCP-953 was lost by this point for several minutes while it had to use resources and coordination capacity on resolving the incident in Sector 12HJ. No specific leads were found on SCP-953’s location, whereabouts, or recent actions until the body of security officer Daniel Bailey was discovered by civilian staff across the Humanoid Containment Wing. Security officer Jean Powell was sent to investigate. > > --- > > **Powell:** Move! Out of the way! > > [A researcher and a maintenance staffer stand above the corpse of Officer Fredrick Bailey and look at each other before moving away with a sense of urgency. Officer Jean Powell approaches the body. He raises his helmet’s faceshield and taps his earpiece.] > > **Powell:** Post, this is Agent Powell reporting in. > > [Security Chief Brummet stands in the surveillance and dispatch center of the Humanoid Containment Wing’s security garrison among other staff sitting at their posts. A staffer receives the call and asks for the report.] > > **Powell:** I’ve made contact with the reported body, it’s another guard. > > [Brummet’s microphone is patched into the call and she motions to the staff member to change their monitor to the hallway in question.] > > **Brummet:** –eah, that one right there. Right. Agent Powell, we have eyes on it here. Take a look at the body while we reinforce you. > > [Brummet mutes her microphone and gives orders to dispatcher staff to fall in on the area and relevant chokepoints. Officer Powell kneels to examine the corpse and finds there are multiple claw marks on the bodies’ lower back and head. She unmutes.] > > **Brummet:** I’m sending you multiple officers. You need to stop and secure every staff member in that immediate section. No matter how long that body's been there, she’s stuck – she can’t even beat the eye scanners. What’s that guy’s story? > > [The guard flips over the body] > > **Powell:** It’s a… Agent Bailey. His face is clawed up. Bad. I don’t see his helmet anywhere. And his eyes are… missing. > > **Brummet:** Missing? Were they clawed out? > > [Agent Powell examines the late Agent Bailey’s face.] > > **Powell:** ...No ma'am, he doesn’t have marks near his eyes at all. It looks like they were just ripped out. > > --- > > 61 Upon post-facto analysis, Chief Brummet’s concern here was fully warranted, as most of Site-17’s max clearance scanners, designed by a Jerome Howell, were made to see through shapeshifters and reality benders. It was assumed, and later confirmed, that SCP-953 took Agent Bailey’s eyes to gain access to other parts of the facility. > > --- > > [Security Chief Brummet eyes dart around the monitor clearly in frantic thought. She asks with restrained urgency.] > > **Brummet:** Does he have his keycard? > > **Powell:** Ma'am, uh… > > **Brummet:** Does he have his keycard!? > > **Powell:** No! The lanyard is gone, the belt loop where the carabiner was is ripped off. > > [Brummet turns toward a PA button connected to an unseen end] > > **Brummet:** SecHub, this Security Chief Brummet, crash the entire Humanoid Containment Wing! The eye scanners are compromised! I'm sending you the details of an ID to remote deactivate now. Seal the building. Make security stop EVERY person that goes in and out of the Site. > > **Brummet:** She could be anywhere. > > View Next Page: inc-ae32//953-09765 [**`inc-ae32//953-09765`**](#inc-ae32953-09765). ## `inc-ae32//953-09765` [**`SCP-4263`**](#scp-4263). ## `scp-4263` `953-4598`? [**`inc-ae32//953-4598`**](#inc-ae32953-4598). ## `inc-ae32//953-4598` AES-256. * Key: `4b4c484e53386a66757337314b4c4650386e6375373448686b643630416d6b53` * IV: `48254247503946354e39385a53563435` ``` There are far worse people out there. Worse than Graham and Goode, I mean. https://drive.google.com/file/d/1SWugLfc6IWQNOj-5TeF0eSSkyWjsO4sN/view?usp=sharing Well of course there are. Don’t act so surprised. Though, I suppose it depends on what your definition of ‘worse’ is. There used to be a time when we weren’t beholden to fate — a time when *we* retained the birth right to refuse what fate had to offer. Not anymore, though. Not since someone else refused stronger. Someone, whose Vision was so bright, it burned the world. Sometimes you just have to accept it. 6"4AICb?i%+D>\4AKZ8:FWbgEA7]e&FCB&t+D>\;+DGk:ATMg/DKBN$Ch4`7Dfp(C@:OCnDf0V=G@bf+/d_q^Ch7$rALns@@;BEsF*2M7+F.mJ+Cf5!@;[31E$/S$FCfJ8H#IhGF(K0"/d_qbBOr;uBl%?'BlbD;ATMF'G%G2,Bl5&=Dfp(CE+O'2Df0!"+D,P.A7]d(@<<W#@UsUt0/$gFFET;s1c> ``` The link shows McFoy.txt: ==bin->== ==64->== or ==64->== each portion for a conversation. End ==85->== > Abdul. I hope you understand how irresponsible your actions were. > > Please, make sure you clean up after yourself. > > The file is reserved in your personal folder at abdul//cctv/846 [**`abdul//cctv/846`**](#abdulcctv846). ## `abdul//cctv/846` `destination_node + " " + "scipnet.mgs.dat"`. At the top of McFoy.txt earlier is `"destination_node": "DIRECTORAL-CHANNEL-PRIME"`. **`DIRECTORAL-CHANNEL-PRIME scipnet.mgs.dat`**. Puzzle end of Act 3. ## `blackdove//aa/1a` ==hex->== > One day all of this will end. One day the ballad of the Foundation’s end will echo across the Ways to be sung by the Neverwere. > > ‘Till then, all we can ever do is keep on paying attention. > > What is it that they always say? I can’t seem to remember. > > Regardless, this is my stop. > > It was nice meeting a similar mind. > > … > > Oh, me? > > Don’t worry about me; I’m just a Nobody — like you. > > The next step is 2b. `2b` -> [**`blackdove//aa/2b`**](#blackdoveaa2b). ## `blackdove//aa/2b` `3m` -> [**`blackdove//aa/3m`**](#blackdoveaa3m). ## `blackdove//aa/3m` `4t` -> [**`blackdove//aa/4t`**](#blackdoveaa4t). ## `blackdove//aa/4t` `5q` -> [**`blackdove//aa/5q`**](#blackdoveaa5q). ## `blackdove//aa/5q` [**`blackdove//aftermath/notice`**](#blackdoveaftermathnotice). ## `blackdove//aftermath/notice` [**`blackdove//aftermath/notice/attachment`**](#blackdoveaftermathnoticeattachment). ## `blackdove//aftermath/notice/attachment` End of Act 3. [Includes a link to concept art!](https://drive.google.com/drive/u/3/folders/1-Iy1HS8k8OLGTO5z3qnPWxXFYB_4DcHH) The EC reached the end of Act 3 in a bit over 2 hours... but they _solved_ Act 3 in 1.5 hours. This Act was so straightforward that the EC solved passwords without discussion. A few people solved, but most of the EC narrated the lore that came up. Each timestamp with "narrates" marks when they decide on voice actors to narrate shortly after. The EC may unknowingly be a few passwords ahead of each listed timestamp. * `11:52` [Ulgrin begins streaming.](https://youtu.be/tqaG60ASSPU) * **`12:00`** [Site-17 Deepwell - Finale](https://youtu.be/flm8AigqBzc) premieres. * `12:21` EC: **`gemini`**. * `12:23` EC: **`x117934kf`**. * `12:25` EC narrates **`cromwell//email//tolangford`**. * `12:27` EC narrates **`re:langford`**. * `12:28` EC narrates **`cromwell//findings/grahammeeting`**. * `12:33` EC narrates **`jailbreaker`**. * `12:36` EC narrates **`inc-ae32//953-7428`**. * `12:48` EC: **`inc-ae32//953-93822`**. * `12:56` EC narrates **`inc-ae32//953-09765`**. * `1:00` EC narrates **`scp-4263`**. * `1:04` EC narrates **`inc-ae32//953-4598`**. `1:17` EC narrates McFoy.txt. * `1:22` EC first sees **`directoral-channel-prime scipnet.mgs.dat`**. Two passwords left to narrate. * `1:23` EC narrates **`abdul//cctv/846`**. * `1:25` EC narrates **`directoral-channel-prime scipnet.mgs.dat`**. * **`1:27`** Waiting for Cromwell. x3j50 (i.e. Cromwell) decides to "put something in the air fryer" to keep the EC waiting. This is so that the EC can catch other people up to speed and organize their findings. `1:48` [x3j50 has bought a kebab.](https://discord.com/channels/1310057454028984320/1417655826499239936/1472665970714874161) * `1:5-` Inbox: multiple messages. * `2:06` #deepwell reveals **`blackdove//aa/1a`**. EC narrates. * **`2:08`** First record of EC finding the end of Act 3. * `2:10` EC narrates **`blackdove//aa/2b`**. * `2:14` EC narrates **`blackdove//aa/3m`**. * `2:17` EC narrates **`blackdove//aa/4t`**. * `2:23` EC narrates **`blackdove//aa/5q`**. * `2:27` EC narrates **`blackdove//aftermath/notice`**. * **`2:27`** EC considers the ARG finished.