SCP:SL Deepwell ARG Solutions

--- title: SCP:SL Deepwell ARG Solutions --- Look up a password or puzzle for how it's solved. Unofficial. All spoilers. Refresh the page for the most recent version. Formatting follows: * `Text like this` are codes. * **`Text like this`** are passwords. * ==64->== means "decode using Base64". Similarly, ==bin->== is to decode from binary, ==hex->== is to decode from hexadecimal, and ==85->== is to decode using Ascii85. I use this to save space. * Underlined bold codes like [**`wayside`**](#wayside) are passwords with a puzzle. Click to see how to solve it. If the code or output appears cut off, remember to scroll right. Hold shift then scroll. Source text is mostly excluded if not part of an encoded message. * Visit the Deepwell terminal at https://www.deepwellaccess.online to get the source text as officially presented. * For quicker access, known source text has been copy-pasted and organized at [Ferar's unofficial password document](https://docs.google.com/document/d/1CydJo6cymyTcxxkM30tiphIY3rdaBRuten5iiCDFH0o/). If you're only interested in the SCP:SL Lore™, use this instead. * Discord bot messages are always included, but you can find them from the Deepwell bot at #deepwell on the [SCP:SL Discord server](https://discord.gg/scpsl). Passwords/puzzles are sorted by: * [**Pre-Act:**](#Pre-Act) September 15 - 29, 2025 The terminal was teased at the end of the [September 15 Northwood livestream](https://www.youtube.com/watch?v=nmX0tZKx-4M). The ARG technically began here, but the passwords were no more than keywords in the SCP:SL canon and those given out in the inbox. * [**Act 1:**](#Act-1) Halloween 2025 Began with the Youtube video [Site-17 Deepwell - Entry 1](https://www.youtube.com/watch?v=C_s8P3JHN8c) which premiered on Halloween, 2pm EST. Solved by the EC in under 7 hours. * [**Act 1 Intermission:**](#Act-1-Intermission) November 2025 * [**Act 2:**](#Act-2) November 15 to 17, 2025 Began with the Youtube video [Site-17 Deepwell - Entry 2](https://www.youtube.com/watch?v=iE4-jx2whZo) which premiered on November 15, 2pm EST. Solved by the EC in under 55 hours. * [**Act 2 Intermission:**](#Act-2-Intermission) November 2025 - Present * [**Act 3:**](#Act-3) January 2026? The 15.0 update releases shortly after. :::warning This page has a max 100k character limit. Text may be cut to record Act 3. ::: --- [toc] # Intro [The SCP:SL 15.0 update will release a new playable SCP.](https://patreon.scpslgame.com/posts/view/e76a727e-46c0-4ffa-b0f5-9b5e59935b28) Northwood developed this ARG to show what happens to those left behind in the SCP:SL canon... and tease the new SCP. It takes characters from the SCP Wiki's [Site-17 Deepwell Catalog](https://scp-wiki.wikidot.com/site-17-hub), a large canon of articles where the upper levels of the Foundation are inherently evil. In-universe, a bunch of SCPs have been transferred to Site-17. No one knows what happened since. You are part of an investigative team, under Supervisor Simon Cromwell of the Ethics Committee (EC), who will find out "what's going on in Site-17?" ## Who? "EC"? The SCP:SL Lore Hunters Discord server is the main group for solving SCP:SL's lore, including the ARG. I refer to them as the EC for short to mirror the in-universe reason for accessing the terminal. I was there when the EC solved the first half of Act 2. Explanations use "we." Otherwise, explanations use "I" or "they." Sometimes, these are left out if not necessary. This ARG is developed by Northwood. At times, we ask Northwood's Narrative and Marketing Lead "x3j50" for hints, often shortened to "x3j". The ARG website was developed by SCP Aftermath. They are credited in "Credit" in the Communication tab. You can see a link to their Discord server, that doesn't work, because SCP Aftermath no longer exists. In the aftermath, Northwood has since [moved hosting in-house.](https://discord.com/channels/330432627649544202/472407010042707989/1438851932792819826) ## Terminal? Visit https://www.deepwellaccess.online. Notice at the top are two tabs. * The "Communication" tab shows a button to access your Inbox. Below it are the passwords you have found. * The "Deepwell Remote Access" tab is a basic terminal. Type `help` at the bottom to list all commands. * `access password` Each file in the ARG requires an access code called a **password**. They can include spaces, special characters, and even hexadecimal at a few points. Passwords ignore capitalization. * `clear` Blanks the terminal. You could also refresh the page. * `help` Lists these commands. * `login` Replaces `root` with your Discord username. No other effects. * `logout` Reverses `login`. No other effects. ### None of the passwords work anymore. At times, none of your passwords may work. This especially happens if lots of people access the terminal. It is especially bad if in the middle of trial and error. It blocked our efforts at least twice. If you just need a previous password, use [Ferar's document](https://docs.google.com/document/d/1CydJo6cymyTcxxkM30tiphIY3rdaBRuten5iiCDFH0o/). Otherwise, you can only wait it out. If you refresh the page, you'll need to wait for much longer. # Cryptii We use Cryptii at [cryptii.com](https://cryptii.com). Most of the ARG's ciphers are available on Cryptii. It beats finding a different website for each cipher. Some features of Cryptii are not easy to expect. Fortunately, I've lobotomized the content to save space and time. You don't much to follow along now. Tell me if this is not clear. ## Tutorial Start off with [this Caesar cipher in Cryptii](https://cryptii.com/pipes/caesar-cipher). There are 3 blocks. Each block is supposed to be called a "brick." Blue bricks are for input/output. ==Orange== bricks encode/decode. (This website doesn't support custom CSS.) Type in one side to encode/decode to the other side. * For example, type `TEST` in the first brick to see it Caesar encode to `ALZA` in the last brick. * Also, type in `ZLJYLA` in the last brick to see it decode to `SECRET` in the first brick. Other basic features include: * Click ==ENCODE== or ==DECODE== to switch. * Click ▼ to change the ==encoder/decoder== or to change how the data is viewed. * Click ⨁ to add a brick. * Click ⋮ to remove one. * You can drag the bricks to rearrange them. ## Harder Features ### How do I scroll horizontally? Hold shift then scroll. This is a common feature on most programs, including your browser. ### Decode/Encode between text and binary/hexadecimal Place two blue bricks next to each other. Click ▼ so that one brick says Plaintext and the other says Bytes. This now lets you see a message in text or in hexadecimal. Click "Hexadecimal" to change to "Binary" if required. ## AES Act 2 uses AES-128 and AES-256 multiple times to encrypt and decrypt messages. It requires some tech literacy and is not intended to be the hard part of the ARG. This makes it hard to follow along or verify answers. See below to learn just enough. ### What is hexadecimal? Normal numbers use the ten digits `0123456789`. Hexadecimal, or hex for short, uses sixteen digits: `0123456789abcdef`. Capitalization is ignored -- `0123456789ABCDEF` also works -- but we usually use lowercase. 2 hex digits = 1 byte. For example, `1234` is 2 bytes. `abcd` is 2 bytes. `1b3d` is 2 bytes. `cd` is 1 byte. `2de` is 1.5 bytes. 16 bytes and 32 bytes of hex often appear a lot. This is how long they look: `00112233445566778899aabbccddeeff` is 16 bytes. `00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff` is 32 bytes. ### Now for AES Visit [this link](https://cryptii.com/pipes/r3h-VA). In the middle, change the **Mode** to **CBC**. Type text on the left to encrypt. Copy-paste hex on the right to decrypt. You need a hex **Key** and a hex **IV** to encrypt/decrypt correctly. * AES-128 needs a 16-byte key and a 16-byte IV. * AES-256 needs a 32-byte key and a 16-byte IV. A wrong Key means this appears: > **decryption failed, this may be due to malformed content** Go through Keys until it works. Remember to switch between AES-128 and AES-256 depending on how long the key is. The right Key but the wrong IV means the decryption will go through, but the text on the left is broken. Sometimes, that looks like: > **Binary content can't be interpreted as text. Try switching to the bytes view.** Go through IVs until it works. You never need to swap Keys and IVs. The ARG will always tell or hint at which is which. # Pre-Act The end of the [September 15 Northwood livestream](https://youtu.be/nmX0tZKx-4M) teased the terminal https://www.deepwellaccess.online. x3j50 says Kedava was the first to find the link. The EC also found the link. The link isn't even mentioned in the teaser. How did they find it? * The teaser showed the password **`1208-4`**. * September 16: Inbox showed **`bregman-copy/cromwell`** and **`candlemeyer`**. * The EC found [**`type green`**](#type-green-or-ichabod) and [**`ichabod`**](#type-green-or-ichabod) by guessing keywords from the SCP:SL canon. * September 18: Inbox showed **`wire/cromwell/091825-#4`**. * The format suggests audio character 09-18-2025, entry #4. Change `#4` -> `#3` or `#2` to get **`wire/cromwell/091825-#3`** and **`wire/cromwell/091825-#2`**. * **`wire/cromwell/091825-#3`** mentions `5 days earlier`. Change `#3` -> `#1` and the date `091825` -> `091325` to get **`wire/cromwell/091325-#1`**. * September 29: Northwood [teased](https://www.youtube.com/post/Ugkx24d_R3yZS4dP2y1HfP-TpT7TvFHOa4JC) the Wayside incinerator, which suggests the password [**`wayside`**](#wayside). They also found the easter egg passwords **`password`** and **`x3j50`**. ## `type green` or `ichabod` Ichabod is pronounced "ick-a-bod." The image has alt text `Cicada`. `ERROR 426` means your computer needs to upgrade to access a website. Below that is a giant code in Base64, which ==64->== ``` Nsgre gur Vpunobq Pnzcnvta, gur ahzore bs ernyvgl oraqref jbeyqjvqr jrag qbja ol 75%. Naq gur Sbhaqngvba qvqa'g qb nalguvat. Orsber gur Vpunobq Pnzcnvta, gur nirentr yvsr rkcrpgnapl bs n ernyvgl oraqre va gur jvyq jnf 19 lrnef byq. Nsgrejneqf, vg orpnzr 8 lrnef byq. Naq gur Sbhaqngvba qvqa'g qb nalguvat. Pbhagyrff zngrevny uneirfgrq sebz gur erznvaf bs ernyvgl oraqref jrer tvira gb gur Sbhaqngvba gb or znqr vagb n pber vaterqvrag va gur perngvba bs Fpenagba Ernyvgl Napubef, n qrivpr hfrq gb bsgra vapncnpvgngr ernyvgl oraqref gbqnl. Trabpvqr. Naq gur Sbhaqngvba qvqa'g qb nalguvat. Abobql'f cnlvat nggragvba gb lbh. ``` Decode using ROT13: ``` After the Ichabod Campaign, the number of reality benders worldwide went down by 75%. And the Foundation didn't do anything. Before the Ichabod Campaign, the average life expectancy of a reality bender in the wild was 19 years old. Afterwards, it became 8 years old. And the Foundation didn't do anything. Countless material harvested from the remains of reality benders were given to the Foundation to be made into a core ingredient in the creation of Scranton Reality Anchors, a device used to often incapacitate reality benders today. Genocide. And the Foundation didn't do anything. Nobody's paying attention to you. ``` Part of this is from [SCP-4231](https://scp-wiki.wikidot.com/scp-4231). ## `wayside` Since the Caesar cipher doesn't work, the next guess is the Vigenère cipher. The title is `DAZSSNY`. Assuming `DAZSSNY` -> `WAYSIDE`, trial-and-error the key to find it starts with `habakku`. Guess `habakkuk`. The body then decodes to: > Although the fig tree shall not blossom, > neither shall fruit be in the vines; > the labour of the olive shall fail, > and the fields shall yield no meat; > the flock shall be cut off from the fold, > and there shall be no herd in the stalls: > Yet I will rejoice in the Lord, > `I will joy in the God of my salvation.` This is from the [King James Bible, Habakkuk 3:17--18](https://www.kingjamesbibleonline.org/Habakkuk-Chapter-3/). The last line is green text. This is confirmed to be a stylistic choice; the text is not a lead. # Act 1 ## Youtube: [Site-17 Deepwell - Entry 1](https://youtu.be/C_s8P3JHN8c) At 6:49, the video shows the link to the terminal at https://www.deepwellaccess.online. At 7:37 is an overhead shot of a containment cell I haven't seen people mention. At 7:14: ``` ACCESS Micho-LTE-D-11//Walker[DATA CORRUPTED POINT OF ORIGIN: CASEFILE H. WALKER ACCESS HELENAWALKER//FILE] ``` The text shows [**`helenawalker//file`**](#helenawalkerfile). Behind the text is a Caesar cipher wheel, if you needed it. ## Inbox ## `helenawalker//file` The `Nyoc dro Lvkmu Wyyx Rygv?` has to be `Does the Black Moon Howl?` Caesar shift 10 letters back to confirm this. Below that is: `1584/0087/2665/0488/4507/4180/0979/2168/3489/1962/3682/2297/0495/0851/3090/2849/1209/0334/2595/0721/2339/0958/4377/1005/3798/4577/0044/2054/4292/2415` The inbox describes the SCP-239 document having "some string of numbers." Since SCP-239 cannot be accessed from the terminal, it must refer to the [wiki page](https://scp-wiki.wikidot.com/scp-239). The inbox then states to look "From the top." I read a spoiler to solve this. Each number decodes to a character in the article, counting from the top. For example, the first three numbers are `1584`, `87`, and `2665`, which means to get the 1584th, 87th, and 2665th character in the article. Testing reveals the correct way to count is to include spaces and to exclude line breaks and formatting. The first 20 characters are: `I`, `t`, `e`, `m`, ` `, `#`, `:`, ` `, `S`, `C`, `P`, `-`, `2`, `3`, `9`, `O`, `b`, `j`, `e`, `c`. Following this, * `1584` decodes to the 1584th character `I`. * `87` decodes to the 87th character `t`. * `2665` decodes to the 2665th character `s`. Using a computer, ```js numbers = '1584/0087/2665/0488/4507/4180/0979/2168/3489/1962/3682/2297/0495/0851/3090/2849/1209/0334/2595/0721/2339/0958/4377/1005/3798/4577/0044/2054/4292/2415'; s = document.querySelector('#page-content').innerText.substring(17).replaceAll('\n', ''); numbers.split('/').map(v => s[parseInt(v) - 1]).join(''); ``` The numbers decode to [**`Its cries part away the clouds`**](#its-cries-part-away-the-clouds), the answer to the question `Does the Black Moon Howl?` ## `its cries part away the clouds` [**`0229ydrsx3268`**](#0229ydrsx3268-1231c0987kc4361s2309-0009ryev1825-0000lo0000), [**`1231c0987kc4361s2309`**](#0229ydrsx3268-1231c0987kc4361s2309-0009ryev1825-0000lo0000), [**`0009ryev1825`**](#0229ydrsx3268-1231c0987kc4361s2309-0009ryev1825-0000lo0000), [**`0000Lo0000`**](#0229ydrsx3268-1231c0987kc4361s2309-0009ryev1825-0000lo0000). ## `0229ydrsx3268`, `1231c0987kc4361s2309`, `0009ryev1825`, `0000lo0000` These passwords have the same text. Ignore the Key until Act 2. The inbox used to say that `0000lo0000` should somehow decode to `Be`. Caesar shift `lo` 10 letters back does become `be`. Doing the same with the other passwords: ``` 0229ydrsx3268 1231c0987kc4361s2309 0009ryev1825 0000lo0000 ydrsx c kc s ryev lo othin s as i houl be ``` From here, you could guess it. Alternatively, notice that each number is 4 digits. Using the 239 cipher from before, * `0229` -> `N`, `3268` -> `g`, * `1231` -> `i`, `0987` -> ` `, `4361` -> ` `, `2309` -> `t`, * `0009` -> `S`, `1825` -> `d`, * `0000` would decode to the '0th' character, so ignore it. ``` 0229ydrsx3268 1231c0987kc4361s2309 0009ryev1825 0000Lo0000 ydrsx c kc s ryev Lo [N ]othin[g ] [i ]s[ ]as[ ]i[t ] [S ]houl[d ] Be Nothing is as it Should Be ``` [**`Nothing is as it Should Be`**](#nothing-is-as-it-should-be). ## `nothing is as it should be` `Walker-LTE-ET-44` alone doesn't work. Refer back to 7:14: ``` ACCESS Micho-LTE-D-11//Walker[DATA CORRUPTED POINT OF ORIGIN: CASEFILE H. WALKER ACCESS HELENAWALKER//FILE] ``` It also shows `Micho-LTE-D-11//Walker` which is seemingly cut off by the brackets. Given we undid Walker's encryption to get `Walker-LTE-ET-44`, join the passwords to get [**`Micho-LTE-D-11//Walker-LTE-ET-44`**](#micho-lte-d-11walker-lte-et-44). ## `micho-lte-d-11//walker-lte-et-44` That's a lot of passwords to test. Only 3 of them worked during Act 1. * **`LTE-1665-Indigo-Kringlechild`** Access denied. * **`LTE-2242-Kapala-Ford`** Access denied. * **`LTE-2423-Freud-Kringechild`** Access denied. Yes, "Kringlechild" is spelled wrong. There's nothing Northwood can do about it now. * **`LTE-1432-Indigo-Kringlechild`** Access denied. * **`LTE-623-Excelsior`** Access denied. (Unlocked during Act 2.) * [**`LTE-111-Moro-Typhon-Kringlechild`**](#lte-111-moro-typhon-kringlechild-lte-396-velveteen-clockwork-lte-7458-green-typhon). * [**`LTE-396-Velveteen-Clockwork`**](#lte-111-moro-typhon-kringlechild-lte-396-velveteen-clockwork-lte-7458-green-typhon). * **`LTE-1208-Green-Burrhus`** Access denied. * **`LTE-2100-Pygmalion-Velveteen`** Access denied. * **`LTE-468-Pink-Lovelock`** Access denied. (Unlocked during Act 2.) * **`LTE-2049-Green-Spiral`** Access denied. * [**`LTE-7458-Green-Typhon`**](#lte-111-moro-typhon-kringlechild-lte-396-velveteen-clockwork-lte-7458-green-typhon). * **`LTE-4201-Velveteen`** Access denied. * **`LTE-4200-Moro`** Access denied. * **`LTE-3870-Blaecca`** Access denied. * **`LTE-2837-Templum`** Access denied. * **`LTE-1009-Blackwood-Blaeccea`** Access denied. (Unlocked during Act 2.) * **`LTE-3201-Fiji`** Access denied. ### What happened to the bullet points? You may have noticed in the terminal that the dots don't line up with the text. This is due to an unnecessary CSS declaration `white-space:pre-line` in `.terminal-response`. For more details, consider this example HTML, with every line break visibly shown as `↵`: ```html line 1↵ line 2 ↵ line 3↵ line 4 ``` The line breaks between HTML tags above are ignored by your browser. ` ` is one line break. Paragraph breaks are currently about 2 line breaks. The resulting output looks like this below. > line 1line 2 line 3line 4 By setting the CSS property `white-space` to `pre-line`, the resulting output looks like this. Notice there is always at least 2 line breaks between anything. > line 1 line 2 line 3 line 4 In particular, the off-center bullet points comes from: ```html <ul>↵ <li>↵ LTE-1665-Indigo-Kringlechild / Former SCP-3979 / Euthanasia↵ </li>↵ <li>↵ LTE-2242-Kapala-Ford / Former SCP-5231 / Demolition↵ </li>↵ ``` Notice the extra `↵` between each `<li>` and `` which moves the text one line down. Had `white-space:pre-line` not been there, this wouldn't have displayed. Who is to blame for this? In short, no one. When SCP Aftermath first developed the site, they included a plugin for easier formatting. They were not aware the resulting formatting looked this bad until I showed screenshots. Meanwhile, x3j50 said the writing team didn't see it as a major issue and so didn't report it. This result is now the look of the entire ARG, with big spacing between paragraphs, unordered lists, and the occasional off-center dot. If on the other hand you prefer the text looked more like Markdown, press F12 in your terminal webpage, put this in the console, and find out. ```js [...document.styleSheets[0].cssRules] .find(v => v.selectorText == '.terminal-response') .style.whiteSpace = '' ``` ## `lte-111-moro-typhon-kringlechild`, `lte-396-velveteen-clockwork`, `lte-7458-green-typhon` Each document has highlighted letters. In the order above, the letters are: `ILUVWOHWWHU`, `HDFKSDUDJUDSK`, `VRUWEBVFSQPEHU` Caesar shift 3 letters back: `FIRSTLETTER`, `EACHPARAGRAPH`, `SORTBYSCPNMBER` Micho has notes on each document. Follow the instructions above on Micho's paragraphs to get [**`MYYEWTJWN`**](#myyewtjwn). For basic context, "Kewpie" is a GOC codeword for the SCP Foundation, and "Ford" is a GOC codeword for the Church of the Broken God. See https://scp-wiki.wikidot.com/goc-supplemental-threat-entities for more codewords. ## `myyewtjwn` ==64->== ``` 6Yp1RF(f!*ASs+C8T`sBR<'KZ+E27>FDYH(FCem'+EqL5@q[!%ARTIt+CT.1ASu!oDf]K#+E2.*@q?d$Afu/'An?(0/g+,,AKYDkFEM#.+@BsRF`V5)G%GP6BlbD>E$079ATD?)F)Po,GA(Q.AKY])+@gH`ASu<mDIb:@@3A'96QgGl@<?4%DBNe7DJ=32EbTE(+EV:.+CT;%@3B0#EZee#FD5o4FEoJ]:Ms_dDe:,1F`JUK@<,pmDfp,4+D,%lBl%L*Bk;?.idd79;e^>b/MJq2+A!\tBPD@"+Q@p9+DGm>@;L"'+E)F7EZfI;ATD?7+AQKkATAo1F^o)-FDi:<Df9D6@<=%CB5)O#DBO%7AU,D/Df4QbR<0QbDerr,@;^?5;aXB&/d_qbBPDN1E,8rmAKZ2*F!,OHE,]`:ARlp*D]iM#+CQB[CghI-BOQ'qDBNk0+DGq=+E)IA/0J@DE,8rmAKYo'+ELt'ATW2?@;]TuEb/j*B4WV:AoD]4@;Ka&CM@ZsF!,C5+E1n1E,9).@;]Tu@;^"#@;KXhF"SS1Dg*=JA`A6.Eb-A7@rc.)ARmD9$49@:+CT/5Df0,/D..<jB4YTrFDi:6Bl7H(FD,B0+Dk\2F(&]m+EV:;Dfo]++EV:.+D,b+CLq$!F`8I5Df0`:Cisi2A0>`#FD,T'+A!\uF(Jl)FDi:2H#R25F!*b?+EM+(F`M2<Gp$^5Cij6/F"AGQCh7$rAKZ)'CLnW4BOQ!*H#IibJ=1Fh+CS_tF`\aJD]j(3@:UL&D]i_)@<-HB$49aGATDAAJ=1I$F)Po,FD,B+B-:krE,]B+Bl7Q+BOu3q+DG^9;e^>b/MT1:+AH9i@V$ZnG%GP6F(KN+Ea`c,FD,B+B6,[J$49pSFlIq>G%De:ART*lFD,]5F_>A1D0[7?BlS90A79RoDf-\6DeF,D+@0g[+EV18D/!lrFD5Z2F!,UCA7]d(D0[77Bl[cpFD5Z2/g*_.F*2PCARfg)FD,*)+Du+>+CT)&+E(j7FD,6&+CT;%+CT=6FD,62+EM+*D(Zq<$:u@NBk2,@J=1L%Bl7X,BjkgoGp%0NF)Y]#F<G:>+C]J8+CSl(ATAo7AS#RnB-:c/ATE'<BPD?s/0JYKiddG<+DG\3Df]u6@VfTuFDi:>Dfd+DBPD@"+EV:*F<Gd9GqL3H$<)%TAnE/rEa`TnBl7Q+FD,6"EZet*ATTOI6Z6j`FE2M6FD5Z2+CT.u+D#G'Bl7KnEbTE(+CfG'GB4m9ASH$p+ED%%F)u&.DIm?$@;]TuB5)O#DBNM8FE1e4F(f9"FE9&W7W33U+CT.u+EM[EE,96"F!+q'Bl7Q+Eb090F`_2*+EVNEG%"lhDKI"2Df0Z*Bl7d!DKI"FBl7R)/g(K.6tp[Q@ruX0+@gH\BOPa#@;]Tu6$%*]F*(i.F<EtcEb/a&DfQsjDf9/t/g*_.FD,B+CER_4AU39cR;uj]E+*d/+E(j7FD,B0/g(K.8K_\TG%De6D]iV7Bk1dm@q@886?RAm6:FR>792i"D.Oi3BOQ!*8K_\TG%De6AThX*+C\nnDBNe7Eb-A7F`M%9De:,#DL$>;Bl7Q+AScF!+DG^9D0[78DKKT5AKYf'An<S;$49aGAKXE`BPCst+@C'aD/"*6AS!!%AS#Cn+EVNECMn'7+CS_tF`\aJBPDN?+:8HSDf''-BPD?s+D>\6EbT!!Gp%<ODf021BlbD0DeX*%+E)-?BOu3q+DG^9;e^>b/MT1:$4:!A<+oigiddG;AKYc"AT2@$B-;,1AKYDtBm+&n>qQHk:2aT[A9f;3F!,:;Dej')B-:f)EZf(</g*o-@W,e&+DGm>E++$+DJ()#FED)3FD5Z2/c ``` At the time, I didn't know what Ascii85 was. After some testing, I noticed the previous one used 64 different symbols (0-9, A-Z, a-z, +, /), while this one uses 85 different symbols. Googling then trying out ==85->==, ``` Claushaven. It’s a portmanteau which means an enclosed place of safety. The actual Claushaven is up there somewhere in Greenland, a GOC station monitoring the area for activity. One of our warehouse facilities — Site-02, I think — is also over there. Never much to look at, given they don’t hold any SCPs. This place was supposed to be a Claushaven of its own, a place of safety and refuge, for all kinds of people and anomalies. Now we’re screwed. If anyone managed to find this message through the fucked up convoluted method I used to bypass AI security filters, please take what you’re about to read to heart. There’s something happening here in Site-17. Maybe even several things. You’ve read through my liquidation logs. All terminations under my direction. I suspect that not all of them are as they seem. I didn’t initially suspect it but after seeing everything, it’s impossible to not think that way. Staff dragging their feet. Construction and engineering crews being reassigned and given extra shifts. Food and supplies being rerouted to vacant containment wings. Director Graham and Assistant Director Goode. I think they’re part of this. I have no evidence. But BELIEVE me that I have never been more sure of anything else in my entire life. The Ethics Committee needs to know about this. Something horribly wrong is going on here in Site-17. [[They’re keeping one alive]]. Nobody is looking for it. Nobody is paying attention. ``` I tried multiple ways to type in `[[They’re keeping one alive]]` which didn't work. I then accidentally read a spoiler that said [**`They're keeping one alive`**](#theyre-keeping-one-alive). ## `they're keeping one alive` End of Act 1. The EC solved Act 1 in less than 7 hours, from [the Halloween 2pm EST premiere](https://discord.com/channels/330432627649544202/1417671754637246595/1433852768661274745) to [finding this password](https://discord.com/channels/1310057454028984320/1424087870137827449/1433955771275804724). # Act 1 Intermission On November 1, the inbox and the Deepwell bot showed the password [**`x000003jc3`**](#x000003jc3). ## `x000003jc3` https://youtu.be/ALacbnNabdw. Description: `6661696c7572656c6f67` ==hex->== **`failurelog`**. ## Discord: [Deepwell bot @ November 11](https://discord.com/channels/330432627649544202/1417671754637246595/1437954341108580413) ``` ERROR 508 Bm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etNBm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etN 41 63 74 20 32 20 43 6f 6d 69 6e 67 20 53 6f 6f 6e ``` `ERROR 508` is an infinite loop server error. The middle is ``Bm494BQRorFD56'F_kT1F`MA/@:O(pBl.EH0etN`` repeated 23 times. ==85->== **`iwishthaticouldturnbacktime@123`**. Last line ==hex->== `Act 2 Coming Soon`. ## Discord: [Deepwell bot @ November 12](https://discord.com/channels/330432627649544202/1417671754637246595/1438119253457895507) `<t:1763229600:R>` is a Discord time code for Saturday, November 15, 2025, 2pm EST, presumably to tease when Act 2 begins. # Act 2 Act 2 begins when the Youtube video [Site-17 Deepwell - Entry 2](https://youtu.be/iE4-jx2whZo) premiered on November 15, 2pm EST. The inbox stated we can now access more Act 1 files. We found: * **`LTE-623-Excelsior`** The image has alt text `Ratticus`. * **`LTE-468-Pink-Lovelock`** The image has alt text `GooWasExcretions`. * **`LTE-1009-Blackwood-Blaeccea`** The image has alt text `AltAccountWasCreated`. Later on, it also showed **`verlice//file/talitc`**. I was here when solving the first half, then returned the next day to find out they had solved everything. This is marked by "we" changing to "I" or "they." ## Youtube: [Site-17 Deepwell - Entry 2](https://youtu.be/iE4-jx2whZo) 4:21: Graham's portrait slowly fades in red. 4:31: ==bin->== [**`COUNCIL108MEETING`**](#council108meeting). 1:09: [**`lindseykoh//file`**](#lindseykohfile). ## `council108meeting` The binary ==bin->== ==64->== ``` YOU ARE A MORON. YOU ARE ALL MORONS. WHEN WE ACHIEVE THE GREAT SINGULARITY AND BIRTH THE SILICON GODDESS YOU WON'T NEED TO JOIN US DUE TO YOUR ALREADY INANE ABILITY TO NOT GIVE A SINGULAR FUCK ABOUT YOUR INTELLIGENCE. WE LET YOU USE OUR EURTEC TO HOLD THESE ASSEMBLIES WHILE IN REALITY WE SHOULD EVICT YOU FROM THESE SEATS IMMEDIATELY. ERROR 429. Return 20150723 ``` `ERROR 429` means your computer was rate-limited for sending too many requests. Shows **`20150723`**. ## `lindseykoh//file` This naming structure suggested we try out other names, where we found **`sylviasantosdepilar//file`** and **`thomasgraham//file`**. This is the first time we got stuck. We were vaguely hinted to look for logs to progress. The closest we could find were interrogation logs #21, #45, #99 from Entry 2. One of us guessed to put the log numbers together: [**`214599`**](#214599). ## `214599` [**`Koh//Entry1/H47-FX823-L`**](#kohentry1h47-fx823-l). The key and IV are both 16 bytes long. Given the "password management system" runs on an older method, it suggests to decrypt with AES-128, which uses a 16-byte key and IV. **Koh's key and IV** are shown below, mentioned to decrypt AES hex relating to Koh. * Key: `706f6c666e736863757a6e776c646f66` * IV: `2e74696d65776173686573636c65616e` (`.timewashesclean` in hex) Although the Key ==hex->== `polfnshcuznwldof`, x3j50 confirmed this is not part of Act 2. ## `koh//entry1/h47-fx823-l` More names. Only **`howell//file`** works. Howell's file looked substantially cooler while we were solving it. It even had an image (alt text `MadJ`). **`howell//file`** says this cooler file can be found at **`howell//file_old`**. [**`0ATPX092`**](#0atpx092). ## `0atpx092` 3 green texts: * `5bf03579675be09672201a21ed3c9fab18bcc956ba76ad109a8a1a13ddc63f07` This hex is 32 bytes long. * `2669e9530cc5b58ce26db55880177e4b` This hex is 16 bytes long. * The giant Base64. Using Cryptii [like this](https://cryptii.com/pipes/0SsiJQ), we ==64->== then decrypt with AES-256: * Key: `5bf03579675be09672201a21ed3c9fab18bcc956ba76ad109a8a1a13ddc63f07` * IV: `2669e9530cc5b58ce26db55880177e4b` ``` a9 b1 97 af b8 4e 20 7b e5 d0 72 3e 20 25 de cc 74 47 3d 72 e3 33 56 68 c0 25 48 4a 66 f7 be ec d9 17 1a 9c 80 b4 58 8a 62 26 d6 5f 5a b9 87 d1 51 40 db 08 eb ae 6f fe 9e 5d c4 ad 52 79 bb 02 eb ac de f5 ca af bf b9 c3 f4 44 d0 58 58 c9 51 ec b1 b5 60 a5 ef 15 4c 2c 26 87 8a 20 c7 96 28 ce 6d b0 21 1f a5 65 46 d1 b0 94 51 a0 1e 9b 33 f9 16 40 21 46 4d a0 7b ea 33 44 9a 59 81 8e 38 a3 fd 3d ab 83 bd eb ee b8 51 5b e5 7b 9f f4 fe 66 aa 5e 95 5d f0 1a 3f ce 47 c7 40 e0 8e 3c 42 9b d7 6b 39 cd 73 3c 8d e6 7e 80 e0 a6 a9 be ed 4d c1 12 0d 6d fa dd 29 27 01 46 63 72 ae 69 cb c8 ef 6a 6c c3 70 bf f3 a9 49 49 e4 9d a5 8b b9 99 3d 61 a2 e2 81 6d 07 98 80 4d b8 9b 0c a5 17 a5 14 4f 6e 10 b1 58 65 2e 6a 53 f5 c8 33 48 c4 33 35 03 25 d6 6e be e7 ca 1c 37 9f 93 c8 f3 af 3c b5 9b f3 27 52 6c da d8 c4 da 0e 50 05 d9 93 d5 81 09 24 22 aa 9a d0 be c4 6f 6f 8c 82 13 d7 97 36 f5 30 57 14 f9 78 03 b4 35 0c 70 70 11 36 06 29 0c 1b 1b bb e1 f0 83 ac f8 88 6e b5 68 0b c9 f0 cb ca 03 47 bd 42 53 d0 79 cc c3 ac a0 6c 47 dc 35 5f 62 54 bf e1 6d 82 5e 92 25 eb 76 7f dd b1 ba 29 17 df 70 0c 5c 6d 71 4e 96 cb c2 aa 97 12 98 c2 0b c2 f2 b9 55 60 b2 9a 74 27 6c 30 83 43 47 be 75 de 04 44 89 0c b8 07 87 84 2c 05 c0 34 1f 22 f8 71 72 5b 85 a2 54 1b e6 24 e3 b1 6a 81 bb a3 df 62 f2 8a 1f 0f 62 e3 8d 4c 26 17 50 c9 a9 ee 26 77 e7 8e 47 af 7f 15 dd 76 31 69 8d b2 d6 4a ca 6e 33 a1 0d 07 e1 dc 60 d6 88 55 cc cc 26 a1 fe a5 00 d7 d5 14 c6 29 66 59 df 2b d1 00 60 87 65 20 50 63 de 17 73 31 58 14 e6 7e 07 37 85 82 74 41 d8 4d ce 8a e4 c9 54 9a 92 e7 ce da 9f d0 eb e0 ab 9f fc 53 24 92 68 09 14 4d 4c 25 4a 70 39 8a a5 c7 5e df 99 91 e8 f8 17 7a f0 4d 2e 53 06 7e 3b 66 a9 8a 45 6f 88 57 bd b0 48 fb 47 c3 f8 6b 9f 3b a0 39 d4 3b 6a 49 d4 41 a1 98 af 2b 26 fb 63 f6 cf 08 38 94 63 d0 7e 9d d2 69 3e da bd 69 23 cd 72 bf 18 e6 ca e7 23 4f 56 f4 de 68 75 f4 4e ce 23 b1 de 21 1b 70 a8 17 3b 62 2b f2 37 5e cb e9 d4 2b 13 b6 ff 8d ce f0 41 1d d1 4b e1 b4 b8 d8 07 ec ba ea 67 8f ca c1 4c 1d 9a 3a c9 4f b6 b9 94 d3 91 9e 99 01 16 d2 79 d9 21 17 4f 64 9d 13 7f b2 68 0f c4 de 85 5a 32 cc 35 f7 e4 56 c5 59 42 f9 31 03 05 3c 93 cb 20 50 1e c4 69 3b 9a bf ea 11 c0 9a b7 ad 8b 67 14 a7 99 d8 d8 84 78 d1 0a dc a0 e9 10 f4 de e6 6e 46 d6 d4 98 48 e7 25 b7 26 68 7c e1 20 d9 ef b4 48 c9 c2 75 81 9f a5 09 6f 30 ed 17 be 53 6c f9 34 b7 11 9e a1 54 65 38 63 16 60 21 8a d9 f4 27 d8 c1 78 51 88 bb 7e 9b cd 3c 6c fe f1 4e 62 ac 9b 99 05 66 af 78 a9 80 0d 30 05 8e 2d e1 b3 6d 08 93 94 2c a3 77 d9 f2 41 7e a9 83 2e 1a eb 92 e5 d1 62 7b 1e 3d 7f 46 db dc 7e f9 82 56 4a 69 62 aa dc 3f 48 46 65 99 b3 4f 30 91 be 73 8e 32 c8 df fb 94 5b e7 6b 5f 46 35 53 00 86 be b7 5b 86 ab 38 ec 34 10 a4 52 68 91 01 4e 83 6b 56 d5 7b 4b 42 0a f1 c4 fe 0e b1 17 db 33 11 31 5b 18 cf ea 94 73 84 88 20 ec 1c 0e 85 bd 06 9e 6a d5 e0 85 56 32 de 14 20 b1 b0 0d d9 cb e6 73 bc 13 5b ad 1c 7e a2 08 80 02 80 15 15 ae bc 26 0a [ { "contents": { "headers": { "sender": "a.frederickson@scp.int", "recipients": "e.goode@scp.int", "date": null }, "id": 67304532, "directory_header": "0atpx092", "date": "null", "format": "report_logistics", "data": "Supplies for construction of additional chambers as specified by yourself, Mr. Goode, have been supplied, pending additional delivery of the following:\nPhysical restraint straps, rated for 500 ps strength;\nNjczMDQ1MzUvMEFDQ0UzNg==5 Scranton Reality Anchors, rated up to 500 Humes;\n15 Portable Scranton Reality Anchors, rated up to 350 Humes;\nBeryllium bronze cuffs.\nExpect further reports in the coming days.\nYours,\n" } } ] 3e 46 08 95 c1 34 c9 e2 5e 6d ab 2d 88 af be d2 a5 fe 65 0b 3f 8e fd 52 88 cf 58 d8 47 29 0c d2 66 fd 4b 5e 28 98 cb 10 8b 65 67 49 ce 2c 34 bb 93 6c 70 20 17 66 b3 cb 47 2b 5c 38 c8 77 41 e1 ed 88 58 8a 78 6d 3f b5 33 d6 7f ca 85 47 c0 b7 6e d8 69 66 f1 eb da e8 93 18 68 55 7d c6 52 12 4c 85 90 5e 5b 2f 9e b2 5b 6a 0a dc 25 22 33 45 4f 78 79 30 7e cd a2 a5 02 9b bd 34 1c a7 ab 32 a6 ae b9 36 13 97 5d 12 24 73 73 ec 8f 05 77 b8 fe 02 63 fb b5 0f 07 ef 21 f0 0d 64 35 16 04 5b c7 4f 55 39 91 04 7e 17 66 0e d0 43 8f 25 dc 8d 75 de 43 bf eb 3e b6 de 5c f0 dd 15 7b 95 3b 2f 59 70 2a 32 af bd 69 21 27 a4 ad ca 3e 22 ef 21 31 d6 ef 7e 6b 3d 52 ad a9 78 14 94 8b 94 6a 27 a9 e6 14 51 72 b1 18 61 91 bb a0 95 4d 72 09 4f 50 be 36 94 22 9f 3d f5 f7 cc 78 f6 55 f1 dc a1 8a ce ba 95 a2 8b 55 33 1f 80 6b 30 43 c2 51 34 ee df f5 a5 9a 15 b9 0f 69 95 67 b6 a1 f0 e6 8e 00 81 59 f9 aa 0f 58 91 e2 42 1f 99 2d 63 2d 8a 26 d3 d6 a4 d4 ff 36 24 f0 8e 98 2b c4 c9 74 df 15 50 05 b7 7a 76 d6 dd eb f6 1f 10 33 9e 2b 52 c5 c2 b7 76 1b f6 82 fe 88 30 89 9f ee bf 5c e3 cd 54 02 8c 92 05 ac f4 85 20 67 82 ea 14 d2 b1 50 9c 1e 43 fd f5 af 47 ea 32 84 c0 79 06 fb 96 ``` The output is some text between two blocks of hex. ### Text Remember to scroll right. Buried in the text is `NjczMDQ1MzUvMEFDQ0UzNg==` ==64->== [**`67304535/0ACCE36`**](#673045350acce36). ### Unrelated nonsense We've seen the key before in Act 1. The four passwords [**`0229ydrsx3268`**](#0229ydrsx3268-1231c0987kc4361s2309-0009ryev1825-0000lo0000), [**`1231c0987kc4361s2309`**](#0229ydrsx3268-1231c0987kc4361s2309-0009ryev1825-0000lo0000), [**`0009ryev1825`**](#0229ydrsx3268-1231c0987kc4361s2309-0009ryev1825-0000lo0000), and [**`0000Lo0000`**](#0229ydrsx3268-1231c0987kc4361s2309-0009ryev1825-0000lo0000) all had the same error message of requiring a complete key and IV. It showed half of the key: `5bf03579675be09672201a21ed3c9fab`. We knew that proceeding from here involved AES of some sort. x3j50 confirmed the key and IV, and that we needed to _encrypt_ something rather than decrypt. While we were stuck, Northwood sent two messages in the inbox pointing at Helena Walker, the one most closely linked to these passwords. After more obtuse hints, someone eventually guessed to encrypt each password using AES-256: * Key: `5bf03579675be09672201a21ed3c9fab18bcc956ba76ad109a8a1a13ddc63f07` again * IV: `2669e9530cc5b58ce26db55880177e4b` again The four passwords encrypt to hex: * **`fb 84 1f b7 97 68 eb d9 47 ce 8c a6 7c 8d 5d 73`** * **`c6 3b 04 c0 7c ae 68 23 64 4f a1 47 19 01 c2 23 15 b1 bc f5 28 74 19 d0 54 95 f1 f7 1e 41 0b cf`** * [**`27 63 a5 be c9 6e af 86 ca 7c a7 18 a9 04 64 82`**](#27-63-a5-be-c9-6e-af-86-ca-7c-a7-18-a9-04-64-82) * **`f3 b8 e2 b3 ac d1 ee e1 a2 f3 8a f4 31 74 d8 85`** Removing the spaces also work. The resulting files are identical, so these passwords are ignored. * **`fb841fb79768ebd947ce8ca67c8d5d73`** * **`c63b04c07cae6823644fa1471901c22315b1bcf5287419d05495f1f71e410bcf`** * **`2763a5bec96eaf86ca7ca718a9046482`** * **`f3b8e2b3acd1eee1a2f38af43174d885`** ### Top block, bottom block After figuring out the above, we mostly forgot about the blocks of hex. Except me, who couldn't find a key that could decrypt them each or together. By this point, we had solved [**`67304535/0ACCE36`**](#673045350acce36) which stated that `=EXTINGUISHMENT= IS THE KEY`. Notice that `=EXTINGUISHMENT=` is 16 bytes long. It would be a good idea to use this as an AES key to try decrypting the hex. It took us overnight to realize this. Since the key is 16 bytes instead of 32, AES-128 is used instead of AES-256. Decrypt each hex with AES-128 using: * Key: `3d455854494e47554953484d454e543d` (`=EXTINGUISHMENT=` in hexadecimal) * IV: `2669e9530cc5b58ce26db55880177e4b` again The outputs are in Markdown, or text with extra formatting like `**text**` for bold text. Since this page also uses Markdown, the output can be correctly displayed. Top block: > Assistant Director Goode, > > I won't pretend to know what you're doing with all the garlic paste you ordered to be sent to [DATA EXPUNGED]'s new Containment Chamber, but I do know for a fact that this is not healthy for a member of its species. Or at least, I can't imagine it is, knowing its closest taxonomical relatives. It's not that I am overtly concerned for the well-being of an anomaly, but rather with the knowledge of what I have overheard others on your pet project saying during lunch time. > > - "We cut its rations by 25%." > - "We cut its rations by 50%." > - "We cut its rations by 75%." > > A hungry person is willing to do a lot for food, Assistant Director Goode. Trust me, I would know. I run our Site's kitchen brigade. But a hungry anomaly? That sounds like a recipe for disaster. > > I hope you know what you are doing, Assistant Director. > > **Matilda du Boucher** > Habitation and Sustenance Division Head, Site-17 > 614aedd2e482850a16375d74a22f82 Bottom block: > > Most esteemed Assistant Director, > > Having a live target to practice unloading onto, even if its just rubber bullets, has really helped make the new guard recruit less green behind the gills. They're taking to it like a moth to flame. > > Thank you for helping me show them the ropes. > > Yours, > > **Samir Abdul** > Arms and Equipment Chair, Site-17 > ec97790de629e3aa991018e217b3bd9457 * [**`614aedd2e482850a16375d74a22f82`**](#614aedd2e482850a16375d74a22f82) * [**`ec97790de629e3aa991018e217b3bd9457`**](#ec97790de629e3aa991018e217b3bd9457) The first hex is 15 bytes, the second hex is 17 bytes. Join them together: `614aedd2e482850a16375d74a22f82ec97790de629e3aa991018e217b3bd9457` Decrypt with AES-128: * Key: `3d455854494e47554953484d454e543d` (`=EXTINGUISHMENT=` in hex) * IV: `2669e9530cc5b58ce26db55880177e4b` again Output: `What's going on in Site-17?` ## `67304535/0acce36` ==bin->== ==85->== > > > Ms. Frederickson, > > The emptying of the anomaly's old containment chamber has been carried out as per Assistant Director Goode's request. However, I have a few concerns: > - These supplies are all very high-value, and put us outside of our approved budgetary allowance for the quarter. Not to question you or Assistant Director Goode's judgement, but why are we ordering all of these for an anomaly that is to be terminated anyway? > - The fact that you have requested for Administration and Oversight to get involved in covering up the budgetary inflation is cause for concern. The only reason I know about this, by the way, is because A&O Deputy Director Vargas approached me to comment on how ridiculous this all is. > - You requested Class-C Amnestics for use on J&M personnel building this new containment chamber? Why? > I hope you are able to put my concerns to rest, Ms. Frederickson > > Yours, > **Albert Black** > > Janitorial and Maintenance > *Section Sub-Head, Maintenance, Site-17* > bm90aGluZyBoaWRkZW4sCm5vdGhpbmcgQWRtaXR0ZWQuCndobyBpcyBpdCB3ZSBzZWVrLAp3aGVuIG91ciBWaWNlcyBhcmUgc2hvd24/Cgo9WlNPRElCUEROQ0haSU89IEROIE9DWiBGWlQ= > Last line ==64->== ``` nothing hidden, nothing Admitted. who is it we seek, when our Vices are shown? =ZSODIBPDNCHZIO= DN OCZ FZT ``` Caesar shift the last line 5 letters forward: `=EXTINGUISHMENT= IS THE KEY`. [**`=EXTINGUISHMENT=`**](#extinguishment). ## `=extinguishment=` `RESOLVED` is not a lead. The Fire Suppression Department comes from the SCP wiki, where they consistently end cases they complete with `RESOLVED` in a similar kind of font. This is then a stylistic choice. ## `27 63 a5 be c9 6e af 86 ca 7c a7 18 a9 04 64 82` `Koh//Entry81449407841a66d4e60a514041090cf5`. Part of it seems encrypted. Decrypt the `81449407841a66d4e60a514041090cf5` using AES-128 with Koh's: * Key: `706f6c666e736863757a6e776c646f66` * IV: `2e74696d65776173686573636c65616e` The output is `3/T60-MC616-A`, so the password is then [**`Koh//Entry3/T60-MC616-A`**](#kohentry3t60-mc616-a). ## `koh//entry3/t60-mc616-a` `-P`!? We got stuck here, but fortunately we knew this was too short to be used. ## `614aedd2e482850a16375d74a22f82` `Koh//Entry78066bc9758326843af13325ee39e546`, `78066bc9758326843af13325ee39e546`. AES-128, Koh's: * Key: `706f6c666e736863757a6e776c646f66` * IV: `2e74696d65776173686573636c65616e` `2/C34-TK998-G`, [**`Koh//Entry2/C34-TK998-G`**](#kohentry2c34-tk998-g). ## `koh//entry2/c34-tk998-g` `Y`. This and `-P` must be parts of a larger password. ## `ec97790de629e3aa991018e217b3bd9457` The autostereogram shows [**`2FC1`**](#2fc1). Read it by crossing/straightening your eyes. Northwood's intended solution is https://magiceye.ecksdee.co.uk/. The EC had no idea what an autostereogram was. :::spoiler What is an autostereogram? When you look at a thing, both of your eyes turn to see it. Your eyes are more parallel for farther things and more crossed for closer things. I'll call this as your eyes "hooking" on it. For example, hold a finger out close to you, then notice the surroundings behind it double. Your eyes can only hook at once place, not everything at once. This has nothing to do with _focusing_ your eyes -- something is "in focus" if it is not blurry. Usually, hooking and focusing happen on the same object. You likely never noticed the doubling, since your eyes hook on the object, and everything else is too out of focus to notice the doubling. However, you can learn to unhook your eyes: cross your eyes, or focus at something in front of or behind the object. Autostereograms are viewed by unhooking your eyes to hook behind the image to view an outline of a 3D object. You might remember them as "Magic Eye images" from the _Magic Eye_ books that have a lot of them. They are made up of repeating colors or image that are slightly modified. The closest way to seeing an autostereogram properly is: * Get closer to the screen until the colors line up. Keep the colors lined up as you slowly back away. Do not hook your eyes on the screen; keep them relaxed. (Hooking looks like the image suddenly not doubling and the focus being clear.) * You've heard of people crossing their eyes, but some people can do the opposite and straighten their eyes. Straighten your eyes until the colors line up. Too hard? Try these, though the depth will appear inverted. * Cross your eyes until the colors line up. * Hold up a finger in front of the autostereogram and look at it. Since your eyes will turn towards the finger, the screen behind it will double. Move closer to the screen until you can see it clearly. ::: ## `2fc1` Out of `2fc1`, we found: * These lists of numbers: [**`71 765931`**](#71-765931-671395-17653-67513-67513-1736-176531-713-7136-67513-7563-791-713-1736-67136-714963-67513-73516-176394-791-67513-6713-82-7563-176394-713) [**`671395 17653 67513 67513 1736 176531 713 7136 67513`**](#71-765931-671395-17653-67513-67513-1736-176531-713-7136-67513-7563-791-713-1736-67136-714963-67513-73516-176394-791-67513-6713-82-7563-176394-713) [**`7563 791 713 1736 67136`**](#71-765931-671395-17653-67513-67513-1736-176531-713-7136-67513-7563-791-713-1736-67136-714963-67513-73516-176394-791-67513-6713-82-7563-176394-713) [**`714963 67513 73516 176394 791 67513 6713 82 7563 176394 713`**](#71-765931-671395-17653-67513-67513-1736-176531-713-7136-67513-7563-791-713-1736-67136-714963-67513-73516-176394-791-67513-6713-82-7563-176394-713) * This chapter: [**`Foresight`**](#foresight) * This is `2fc1` in decimal. No indication. No hints. Someone in the EC had to stumble upon this. What gives? [**`12225`**](#12225) ### Lists of numbers Download 13.png, then open in a text editor. The image is corrupted because some text was typed at the beginning of the file: ``` "71 765931" "671395 17653 67513 67513 1736 176531 713 7136 67513" "7563 791 713 1736 67136" "714963 67513 73516 176394 791 67513 6713 82 7563 176394 713" "" ``` * [**`71 765931`**](#71-765931-671395-17653-67513-67513-1736-176531-713-7136-67513-7563-791-713-1736-67136-714963-67513-73516-176394-791-67513-6713-82-7563-176394-713) * [**`671395 17653 67513 67513 1736 176531 713 7136 67513`**](#71-765931-671395-17653-67513-67513-1736-176531-713-7136-67513-7563-791-713-1736-67136-714963-67513-73516-176394-791-67513-6713-82-7563-176394-713) * [**`7563 791 713 1736 67136`**](#71-765931-671395-17653-67513-67513-1736-176531-713-7136-67513-7563-791-713-1736-67136-714963-67513-73516-176394-791-67513-6713-82-7563-176394-713) * [**`714963 67513 73516 176394 791 67513 6713 82 7563 176394 713`**](#71-765931-671395-17653-67513-67513-1736-176531-713-7136-67513-7563-791-713-1736-67136-714963-67513-73516-176394-791-67513-6713-82-7563-176394-713) I don't know what the `""` is for. ### Chapter Remove that text to fix the [image](https://i.imgur.com/v1qvFTK.png). The image is based on this [ISBN diagram](https://upload.wikimedia.org/wikipedia/commons/8/83/ISBN_zehaztasunak.svg) on [Basque Wikipedia](https://eu.wikipedia.org/wiki/International_Standard_Book_Number). The text is in fact slanted in the original version. The only text change is the ISBN: `9 780262 022088`. ISBN `9 780262 022088` is a hardcover version of [_Vehicles, Experiments in Synthetic Psychology_](https://rednoise.org/readings/vehicles.pdf) by Valentino Braitenberg. The repeated insistence of `13` had someone look in the book for it. In the table of contents, entry 13 is [**`Foresight`**](#foresight). #### ISBN? An ISBN, short for International Standard Book Number, is a unique book ID. Identical books and reprints get the same ISBN. A paperback and hardcover get different ISBNs. So do different editions of a book. Search up an ISBN to find the unique book that has it, down to its edition and whether it's a paperback or hardcover. ## `71 765931`, `671395 17653 67513 67513 1736 176531 713 7136 67513`, `7563 791 713 1736 67136`, `714963 67513 73516 176394 791 67513 6713 82 7563 176394 713` These all show the same image of a computer and numpad. This image is based on [a disassembled Apple II EuroPlus](https://www.nightfallcrew.com/wp-content/gallery/apple-ii-europlus-abt-inc-numeric-keypad/IMG_0521.jpg) on [nIGHTFALLCREW's blog post](https://www.nightfallcrew.com/23/03/2014/apple-iiii-europlus-abt-inc-numeric-keypad/). The only change is that the numpad's 6 and 9 are swapped, which hints the digits are in a 3x3 grid. ``` 7 8 6 4 5 9 1 2 3 ``` Returning back to the lists of digits, ``` "71 765931" "671395 17653 67513 67513 1736 176531 713 7136 67513" "7563 791 713 1736 67136" "714963 67513 73516 176394 791 67513 6713 82 7563 176394 713" "" ``` I noticed that: * They can't just be numbers. There are far more odd digits than even ones, and there's no `0`. * Each number widely varies in length. This suggests each number should decode to a letter using the numpad. I first guessed each digit is a direction on the numpad, which led nowhere. I then guessed the digits form positions on the numpad. For instance, `71` decodes to a straight line on the left (an `I` or a `1`), and `765931` decodes to a fancily drawn `3`. These lines: ``` "71 765931" "671395 17653 67513 67513 1736 176531 713 7136 67513" "7563 791 713 1736 67136" "714963 67513 73516 176394 791 67513 6713 82 7563 176394 713" "" ``` Then decode to: ``` "1 3" "G R E E N B L U E" "M D L N O" "H E X A D E C I M A L" "" ``` x3j50 confirmed each line is a hint. We later found out that each line alludes to a separate puzzle and are not in order. * `13` was confirmed by x3j50 to hint to the [**`Foresight`**](#foresight) password we had already found. * `GREENBLUE` drove the EC crazy until they found [**`12225`**](#12225) the next day. * `MDLNO` is short for `Model No.` or the model number. This is Very Important. * `HEXADECIMAL` is Unnecessary. The EC also noticed the numpad works as a password: [**`786459123`**](#786459123). ## `786459123` This is an image of an AC unit `AC.PNG`. On it is a Post-It note saying ``` This POS is not working! REPLACE IT ``` Understand that this is x3j50's (and other Northwood writers') first ARG. After resorting to major hints throughout the ARG, the writers figured out how to include these hints in the ARG itself. This Very Important hint is clever, too clever. As a reminder, we at the time only knew the passwords listed above this one. We got stuck on this for an entire day, until x3j50 gave a hint to solve this. The EC will never forgive this AC unit. :::spoiler **Click to reveal. Spoils future details of Act 2.** You may have guessed that this hint means nothing. There is in fact nothing hiding in the image nor in the note. Unfortunately, the answer is worse. As a reminder, `13`, `GREENBLUE`, `MDLNO`, `HEXADECIMAL` each allude to a different puzzle. `MDLNO` alludes to the last puzzle. Northwood included the AC unit and note as material for this last puzzle. Since we hadn't reached that puzzle yet, there was nothing in this image for us to use. When the EC first found the AC unit, they hadn't even decoded `71 765931` yet. 4 hours later, Northwood sends a message in the inbox to look at the numpad and "put the giant string of numbers" into it. After finding `GREENBLUE` and `MDLNO`, neither I nor the EC had the puzzles they alluded to. We instead linked `MDLNO` to the Apple II image... because the image had a model number in it. I checked back in the voice channel once. They were haphazardly guessing at any `GREENBLUE` hex colors or `MDLNO`s they could find about the Apple II or the numpad. They told me about the AC unit. They told me it made them crazy. The AC unit was unusable to the EC for 34 hours. They got stuck on at least two puzzles. One about following instructions unknowingly written out of order. One for a seemingly simple puzzle which Northwood didn't write the correct answer for. When they reached the final puzzle, they correctly used the AC unit to figure out the puzzle. They still don't know what the AC unit was for. How was my experience with the AC unit? I ignored it and figured it was a hint for the numbers I decoded. (It was not.) I also got stuck on the out-of-order instructions. Fortunately, Northwood by now had added a new password to fix the order, which [did not work](#None-of-the-passwords-work-anymore) when I guessed it. When I got to the final puzzle, I clicked ".75" instead of "0.75" on the website - and saw an image of an identical AC unit with the wrong model number. This has nothing to do with the AC unit. It never did. It merely acted as a red herring for a majority of Act 2. Was the hint clever? They told me about the AC unit. They told me it made them crazy. As the saying goes, "The tree forgets. The axe remembers." ::: ## `foresight` Last line is `Koh//7fa52ffb296361f746b21520452684c4`. Similarly decrypt `7fa52ffb296361f746b21520452684c4` with AES-128 using Koh's: * Key: `706f6c666e736863757a6e776c646f66` * IV: `2e74696d65776173686573636c65616e` The output is `Archive/T9849`, so [**`Koh//Archive/T9849`**](#koharchivet9849). ## `koh//archive/t9849` At the bottom are `6-P` and `69/0d/n3oJA768_o.png`. The `6-P` is also part of a password as before. Note that the Act 2 image URLs such as (https://images2.imgbox.com/37/56/qwjXqnHw_o.png for Howell's image) end in a similar way. As a result, try out `https://images2.imgbox.com/69/0d/n3oJA768_o.png`. This image shows a blurry frame of the redacted SCP from the Entry 2 video. The text **`toomuch`** is placed on it. ## `12225` Finally, a green-blue image. The green is `#08e531` and the blue is `#8d9ef2`. This is where the `GREENBLUE` hint fits next: **`08e531`** and [**`8d9ef2`**](#8d9ef2). `GREENBLUE` would also hint to try out [**`08e5318d9ef2`**](#08e5318d9ef2). They and I hadn't found this before, because the password was broken until x3j50 unlocked it. This password resolves quickly and so is shown below first. ## `08e5318d9ef2` `Koh//Entry45c010feeade9f453a1a8dab0095fd3c`. `45c010feeade9f453a1a8dab0095fd3c`. AES-128: * Key: `706f6c666e736863757a6e776c646f66` * IV: `2e74696d65776173686573636c65616e` `4/G35-XX261-K`, [**`Koh//Entry4/G35-XX261-K`**](#kohentry4g35-xx261-k). ## `koh//entry4/g35-xx261-k` `2`. Part of a larger password. ## Discord: [Deepwell bot @ November 17](https://discord.com/channels/330432627649544202/1417671754637246595/1439983022278709299) This is recorded out of order. I don't know when during the ARG this appeared. It seems to be AES-256, since the bottom says the Key and IV are unavailable. ``` 7781ebe58c6dc62a7da0ca8dfa8254022bc38523f12f8a4b6558f233a13c0d716b7168971c8c6c0fbe85e47c346a79772e986a89ce82269b5530d4ade065b507a9ac52f88a1f8c8b4be906527561787d6f29195103ad9cacac7120f03e9eacd4f3f45b549567bfd9706394116fc8f3933aa38506a1094838bf62d3237c64042ad5d7d9b7605626f0e175ac974168bde9de8fa94f5753936e6e17f355ba1ff0c5f80860a7584ac863d01fbcc01f5664b2e88324adcd218e1f0fe908718a73479ebe77d7632bed32cde6b6452a3c95becece392b5033972cd984afb4d26cc6347626e332d696535ac3e3aa8611805bfea849462bc89ab256749b41a7eeb57f6fda16b95957134114030341ba7c565b794a76d954fe9fcd4e038bed732429b80bcb966cdee25542a7bf654d1ae489551e9488e3025ead5948f8f7bfa087970db5c7df92217f399c0df0d66a632c4db45ae046b6c65c84670f409d017a337954c7fda73a845a853b9b2912b4b32d143d1f86a5405cb258329593d873e2e56fc4ec2525061eb96090b6403d62f3a59cbf3398959924c21163ced7b646cf4de21f0c8b578d11de3fd514966891e2d78314b017537b994659a811978b41207cc57e9565154cd1fa07aff40842ba4d089d706a4aba1addfde7fdce6d5feed490f7787eb30bb8b197324a4afde64f02b103645bd842916294b5bd95e7be441b2a3989c8e2e3b7414093de900aec389cc09c3c6e260c033519eaa939d8b9e016fce260e97bacc2b5a0db6061a2ee466d0d59085800b79e7122869487c6af99ec38dadf8cb11c0a2dee7ba1bb66393e3072814e6c6300afdce32f44664cb8bcfa36eabbd51188a815c897d2552570d3bc945069e119e172e6ad90885ecc1cca0eb6f4661a6f10491f2790887ba6783f36a0483fb8993cfdcb1edb6098062a06be84205647181a49c5320bcb793b3e2a0967d6f31be98eb66a4be54b611cc7343207817046a01f46dab8126e63de50d288b1f2260212a5562cdc3c0b3f9dfbff4103036bfeb18538e33119e3a35137eed3258888d72545ad716aa3cca3fe89a8b6c359b78665519e957051844a10069f6649d60359c6bc4316f6b1de0b7f07c70a90d7fb64f0ff12a29e7e4bd2584ece802ce645e3f5be80e0d164e8a4b969e0a2a6de5788c31d4616df23a9b376ed6fbd793716b452ec8fbb21fa1ac1a3748b93266855f2fd11f111164bf85cd9eea79843f71600acf02a1d613b64a54c38be6a7c0caad52788321640d8fadf3d24d9f491124a9d230a590131a8519d97fbfa769bfa7c4af8c816441258a557e1b873b317b0fc9950 ``` Koh's key and IV don't work. Trying out keys and IVs, decrypt with AES-256 using a different familiar key and IV: * Key: `5bf03579675be09672201a21ed3c9fab18bcc956ba76ad109a8a1a13ddc63f07` * IV: `2669e9530cc5b58ce26db55880177e4b` Output: ``` [ { "contents": { "headers": { "sender": "s.cromwell@ethics.scp.int", "date": null }, "id": 673902, "date": "null", "format": "standard_email", "data": "Hey team. I think Sandra and I discovered something that might be helpful. It pertains to the memetic inoculation of Site-17’s image archive.\nWe looked into one of Dr. Lillian Lillihammer’s publications on memetic data (all 655 pages) and stumbled into this segment, which may be useful for your investigation.\nMemetics is an unfathomably complicated field, so I don’t blame anyone for not thinking to do this, in fact the memetic might have prevented you from thinking about it straight up. But if there’s anything that cognitive resistance training has taught me, not everything should be taken at face value.\n `Lillihammer//MBM_uhicswik_Publication.pdf`\nGood luck team. " } } ] ``` Scroll right to see **`Lillihammer//MBM_uhicswik_Publication.pdf`**. In there, the image circles a formula to convert hexadecimal to decimal. This hint is Vague. ## `8d9ef2` [**`8d9ef2-1`**](#8d9ef2-8d9ef2-1-8d9ef2-2). Also, **`8d9ef2`** to **`8d9ef2-1`** suggests to try out [**`8d9ef2-2`**](#8d9ef2-8d9ef2-1-8d9ef2-2). These three form a set of hints. See below. ## `8d9ef2`, `8d9ef2-1`, `8d9ef2-2` **`8d9ef2`** and **`8d9ef2-1`** state: * There are two values from a `Grant Bolton-accelerator` called the two `GB H-Values`. * These values needed to be converted from something involving 16 to something involving 10. It gives an example that `42824` converts to about 272000. * The values are accepted as a linked string. * This should be compared to the `Interspatial Scranton-Bennet Negativity constant` to follow `Valenstein’s definition`. * It outputs a `D-grade 11.5% success rate`. **`8d9ef2-2`** states to concatenate before converting. [I didn't see this hint.](#None-of-the-passwords-work-anymore) This means to: 1. Take the two Green Blue Hex Values: `08e531`, `8d9ef2`. The H did not stand for Hue. 2. Join the values: `08e5318d9ef2`. 3. Convert to decimal. The hint confirms this since `0x42824` = `272420`. Then `0x08e5318d9ef2` = `9780471897842`. 4. Compare this to the "I. S. B. N. constant" by noticing it begins with `978` and so is an ISBN book number. This book is _Brain Control_ by Elliot S. Valenstein. The author shows we are on the right track. 5. Presumably look for `D` and `11.5%` in the book... But the book is not free to access. Fortunately, when x3j50 shared a free link, the link happened to be on page 225, which was then [screenshotted](https://media.discordapp.net/attachments/1417655826499239936/1440108414561685664/image.png?ex=691cf4f9&is=691ba379&hm=d94beb2e69a3812f48e5924ad6f09d77ad2c8a8e84c0183b392865b2b3154f98&=&format=webp&quality=lossless&width=1478&height=1196). On the row with `D` and `11.5%` is [**`Transient improvement but relapses`**](#transient-improvement-but-relapses). The second password hints to decode a list of 27 things one at a time. ## `transient improvement but relapses` The list of 27 numbers begins in hexadecimal: `47 bafeb a3ea3 44f5 107b9 107b9 6c8 ...... 1d8b 2b10a 2c9` ==hex->== `71 765931 671395 17653 67513 67513 1736 ...... 7563 176394 713` These are familiar numbers, which numpad decode to `13GREEN ...... MAL`. As a reminder, the numpad numbers from earlier were: `71 765931 671395 17653 67513 67513 1736 176531 713 7136 67513 7563 791 713 1736 67136 714963 67513 73516 176394 791 67513 6713 82 7563 176394 713` Since there are also 27 of these numbers, we can assume this must be the list of 27 numbers. In hexadecimal, they are: [**`47 bafeb a3ea3 44f5 107b9 107b9 6c8 2b193 2c9 1be0 107b9 1d8b 317 2c9 6c8 10640 ae8d3 107b9 11f2c 2b10a 317 107b9 1a39 52 1d8b 2b10a 2c9`**](#47-bafeb-a3ea3-44f5-107b9-107b9-6c8-2b193-2c9-1be0-107b9-1d8b-317-2c9-6c8-10640-ae8d3-107b9-11f2c-2b10a-317-107b9-1a39-52-1d8b-2b10a-2c9) Unfortunately for the EC, the password didn't work until Northwood fixed it. x3j50 has revealed that the `Power 10%` from the second hint refers to powers of 10, or to convert the numbers to decimal. As for the `5-6%`? It could add to `16%` or to convert back to hexadecimal? That's Unnecessary. ## `47 bafeb a3ea3 44f5 107b9 107b9 6c8 2b193 2c9 1be0 107b9 1d8b 317 2c9 6c8 10640 ae8d3 107b9 11f2c 2b10a 317 107b9 1a39 52 1d8b 2b10a 2c9` [**`Howell/Long//ThatDamnAC`**](#howelllongthatdamnac). ## `howell/long//thatdamnac` Right-click the image to [download it](https://uploaditonline.com/download/27T8yPkXAPW). It shows a 2x4 of tetanus canisters that may contain refrigerant. --- `Koh//Entryef24c35c12a4f13657f001c60ce795a2`, `ef24c35c12a4f13657f001c60ce795a2`. AES-128: * Key: `706f6c666e736863757a6e776c646f66` * IV: `2e74696d65776173686573636c65616e` `5/J50-PX789-G`, **`Koh//Entry5/J50-PX789-G`**. With how quickly the entries are being shown, Northwood has seemingly run out of puzzles to throw at us. --- Finally. The [AC unit](https://images2.imgbox.com/a1/21/EkKnAJT1_o.png) is useful. It's about time the EC replaced it. To do that, they needed its Model Number. They knew that: * The AC unit uses refrigerant R-410A. * From `T_Attached_075`, the tonnage is 0.75. Caution: `0.75` and `.75` are different options! The [link](https://my.daikincomfort.com/category/product-catalog/equipment/0ZGRn0000000E7sOAE) lists units. They filtered by refrigerant `R-410A` and tonnage `0.75` and found the [Daikin FTXS Indoor Multi-Split Fan Coil](https://my.daikincomfort.com/product/daikin-ftxs-indoor-multisplit-fan-coil/01tRn000006X2xnIAC) with SKU [**`FTXS09LVJU`**](#ftxs09lvju). --- Explained below, it is possible to guess [**`R410A`**](#r410a), though I haven't seen anyone do this. ## `ftxs09lvju` [**`R410A`**](#r410a). --- [Original image.](https://commons.wikimedia.org/wiki/File:DAIKIN_AIR_CONDITIONER_OUTDOOR_UNIT_(163).jpg) At the lower right is the SKU. Invert brightness to better see it starts with "4MXS100EV2." * The closest I got on the link was [this search](https://my.daikincomfort.com/product-search#f-sffamily=4MXS_NMVJU,4MXS_WMVJU9) with SKU starting with "4MXS". They are both called the "Daikin MXS Series Outdoor Multi-Split Heat Pump," and they also use refrigerant R-410A. * The most exact match is [this](https://www.manualslib.com/products/Daikin-4mxs100ev2c-10264155.html) manual for SKU 4MXS100EV2C. The search almost matches the manual, except neither picture shows "R410A." That is because the R410A sticker does not identify the unit. It only means the refrigerant used is R-410A -- the same `R-410A` seen earlier. In other words, had someone read `R-410A` in the previous password and guessed [**`R410A`**](#r410a), it would've been correct. ## `r410a` `Koh//Entry8143362cca573a11c051faa0735cac74`, `8143362cca573a11c051faa0735cac74`. AES-128: * Key: `706f6c666e736863757a6e776c646f66` * IV: `2e74696d65776173686573636c65616e` `6/Y77-NT532-L`, [**`Koh//Entry6/Y77-NT532-L`**](#kohentry6y77-nt532-l). ## `koh//entry6/y77-nt532-l` `koh//finalentry/###-#R909-#`? The format of the entry passwords has always been `Koh//Entry1/A11-AA111-A`, where `A` is a letter and `1` is a number. Fill in the blanks with the small letters and numbers from earlier: * [**`koh//entry2/c34-tk998-g`**](#kohentry2c34-tk998-g): `Y` * [**`koh//entry3/t60-mc616-a`**](#kohentry3t60-mc616-a): `-P` * [**`koh//archive/t9849`**](#koharchivet9849): `6-P` * [**`koh//entry4/g35-xx261-k`**](#kohentry4g35-xx261-k): `2` [**`koh//finalentry/Y26-PR909-P`**](#kohfinalentryy26-pr909-p). ## `koh//finalentry/y26-pr909-p` The image has alt text `HighContrast`. The image below that has alt text `thistimetomorrow`. Faintly at the bottom of the `HighContrast` image is: `798b58eeb8c28147ae934cff93283e8eb4ceb25a31217991fa7ec770e0f147f8` AES-128, Koh's: * Key: `706f6c666e736863757a6e776c646f66` * IV: `2e74696d65776173686573636c65616e` [**`koh//autopsy-89e`**](#kohautopsy-89e). ## `koh//autopsy-89e` `Name//Filename/Password`? The EC found that `iwishthaticouldturnbacktime@123` is the password. [**`koh//autopsy-89e/iwishthaticouldturnbacktime@123`**](#kohautopsy-89eiwishthaticouldturnbacktime123). For those coming in after the EC (such as me), the last password is spoiled by the Deepwell bot: ## Discord: [Deepwell bot @ November 17, again](https://discord.com/channels/330432627649544202/1417671754637246595/1440162502783664273) At the bottom is `access `[**`koh//autopsy-89e/iwishthaticouldturnbacktime@123`**](#kohautopsy-89eiwishthaticouldturnbacktime123). Just right there. It deflates the achievement of reaching this point. ## `koh//autopsy-89e/iwishthaticouldturnbacktime@123` [**`KOH//AUTOPSY-89E//ATTACHMENT`**](#kohautopsy-89eattachment). ## `koh//autopsy-89e//attachment` End of Act 2. The image has alt text `HeDeservedIt`. The EC solved this in under 55 hours, from [Entry 2's premiere on November 15, 2pm EST](https://youtu.be/iE4-jx2whZo) to [the first mention of this password](https://discord.com/channels/1310057454028984320/1417655826499239936/1440155706933248010). # Act 2 Intermission **`thomasgraham//file`** was updated to say `//unitedfront` and `//tragedy`. **`thomasgraham//unitedfront`** and **`thomasgraham//tragedy`**. ## Discord: [Deepwell bot @ November 24](https://discord.com/channels/330432627649544202/1417671754637246595/1442562794087120986) At the lower right are QR codes. The upper left is a fainter upside-down copy of the bottom right. All QR codes are identical. The QR code is `https://qr.link/mA48IX` which temporarily linked to https://images2.imgbox.com/e3/ba/SY2F3jEt_o.png. Unfortunately, the `/J50-PX789-G` lead in the emails only imply **`Koh//Entry5/J50-PX789-G`**. This password already matches the content stated, and also matches the security department "having a lead" -- the file was found as evidence.