Chapter 4 Icepick ARG

Central Domain

Gallery

Maze

The Chapter 4 Icepick ARG (otherwise referred to as Bruno White's Central Domain) is an alternate reality game held by Mob Entertainment to tease their fourth chapter to the Poppy Playtime franchise.

Click here to view the ARG website!

Command List

Press the Expand button if you want to view the following information.

start icepick.bat -- (Scraping Program)
c:\domain\network\globals.authenticator -- (Terminal)
cd c:/domain/documents -- (Terminal)

• wget ef_ygp -- (Get "ef_ygp")

cd /c:/domain/documents/effects/YGP -- (Terminal)

• wget photoscan_01 -- (Get "photoscan_01" file)
• wget photoscan_02 -- (Get "photoscan_02" file)
• wget photoscan_03 -- (Get "photoscan_03" file)
• wget photoscan_04 -- (Get "photoscan_04" file)
• wget photoscan_05 -- (Get "photoscan_05" file)
• wget photoscan_06 -- (Get "photoscan_06" file)

cd c:/domain/applications -- (Terminal)

• start PCSS.exe -- (Go to "Playtime Co. Virtual Security System")

Command "recover" - Password "1166"-- (Enter command anywhere in the terminal)

• Do the process 1 time -- (Get "archived_5b00" file)
• Do the process 3 times -- (Get "pr_1166" file)
• Do the process 5 times -- (Get "10-16-94-02" file)

Command "recover" - Password "sawyerevidence.zip"-- (Enter command anywhere in the terminal)

• Do the process 1 time -- (Get "findings" 1 file)
• Do the process 2 times -- (Get "findings" 2 file)
• Do the process 3 times -- (Get "findings" 3 file)
• Do the process 4 times -- (Get "findings" 4 file)
• Do the process 5 times -- (Get "findings" 5 file)
• Do the process 6 times -- (Get "findings" 6 file)

start subsyslogin -- (Terminal) bruno.white -- (Page 01 Log-In)

• OneBadDay -- (Page 01 Message)

History

Prelude

On July 25, 2024, Mob Entertainment released the first video of The Story So Far series, a set of videos that recounted the events that occurred in Chapters 1 to 3. This video recapped the events of Chapter 1: "A Tight Squeeze". Halfway through the video, the footage briefly glitched and displayed a message to the audience: "IV ARG. Let the game begin." This marked the official confirmation that the development of the upcoming Chapter 4 ARG had begun. After the message and before the glitch ended, two frames appeared with a Base32 encoded message. The message said:
"J5XCAZTFNR2GKZBAMZSWK5BAMFXGIIDXNF2GQIDCMF2GKZBAMJZGKYLUNAFAUU3MMVSXAIDEOJQXO4ZAMV3GK4RANZSWC4Q=".
Once deciphered, the following phrase was revealed: "On felted feet and with bated breath, sleep draws ever near".

Poppy Playtime - The Story So Far - Chapter 1

The first frame revealing the Roman numeral IV.

The second frame revealing the letter A.

The third frame revealing the letter R.

The fourth frame revealing the letter G.

The fifth frame revealing the message "Let the game begin."

The sixth frame revealing the Base32 code. Note that the code is cut at the right-hand side of the image.

Shows the cut parts of the Base32 code.'

On August 26, 2024, the second video of the trilogy was published, which recounted the events of Chapter 2: "Fly in a Web". At the beginning of the video, a frame was briefly shown that had text in hexadecimal code, which said: "45 6C 65 76 65 6E 20 57 6F 72 64 73 20 47 6F 6F 64 20 4C 75 63 6B". When deciphered, this revealed the phrase: "Eleven Words Good Luck". This phrase implied that during the video, there were eleven hidden words that viewers had to find. Subsequently, several phrases in Caesar cipher were discovered throughout the video. Once deciphered, the following words were revealed:

• "gs tuz" → "am not" (6 letter shift)
• "rcvju" → "paths" (2 letter shift)
• "wxuqlqj" → "turning" (3 letter shift)
• "wn lmibp" → "of death" (8 letter shift)
• "gzy n" → "but i" (5 letter shift)
• "Pwfs" → "Over" (1 letter shift)
• "hmyhpk" → "afraid" (7 letter shift)
• "gpiev" → "clear" (4 letter shift)

When arranging the deciphered words using as the order number the number of letters in which you had to scroll, the following phrase was formed: "Over paths turning clear, but I am not afraid of death".

Poppy Playtime - The Story So Far - Chapter 2

The hexadecimal code shown in the first frame of the video.

The first Caesar code shown in the fifth frame of the video.

The second Caesar code displayed on the TV in Elliot Ludwig's Office.

The third Caesar code scratched into the red part of the top-right wall.

The fourth Caesar code displayed on a Musical Memory TV.

The fifth Caesar code faintly engraved on the bottom of the middle-left blue stair.

The sixth Caesar code engraved into the gray brick left to the yellow brick at the bottom.

The seventh Caesar code painted onto the left-hand wall.

The eighth Caesar code shown at the top-left of the black screen.

On September 16, 2024, at 1:00 PM EST, the third and final video of the trilogy was published, recapping the events of Chapter 3: "Deep Sleep". Towards the end of the video, two frames appeared, each displaying a binary code.

The first binary sequence read:
"1111111011101111101111111100000101110010000100
00011011101010110011101011101101110101101
01111010111011011101000000101001011101100000101
001100000100000111111110101010101011111110
000000001001011100000000110011100001001
100010111101101000111011111000111001001001100011
00100101010011100100101100011100011000
1001111101010000110001111111110011000101100
0100000001111110100101110101100001100011100100
0000100110111010111101000011111111100
0000001000101110001011011111110000111101010
10100100000101011001010001010110111010110011001
11110111101110100100011100110101110
111010001001101111011101000001010101001010
1001101111111011011111001110111"

The second binary sequence read:
"0011001000110101011110000011001000110101"

Decrypting the second code using the ASCII system revealed the phrase: "25x25". This clue suggested that an element should be structured on a 25x25 grid. By interpreting each "0" as a white pixel and each "1" as a black pixel, and organizing them into the specified grid, a QR code emerged. Scanning the QR code displayed an upside-down phrase, which, when reoriented, read: "For we have already met."

By combining the phrases discovered across all three chapters, the following poem emerged:

"On felted feet and with bated breath,
sleep draws ever near.
Over paths turning clear,
but I am not afraid of death.
For we have already met."

Poppy Playtime - The Story So Far - Chapter 3

The first binary code shown on the security monitor.

The second binary code shown on the security monitor.

The QR code formed from the first binary code.

September 16th

Enigmatic Contact Reestablished

Roughly four hours after the final video was uploaded, the message "test" was posted on the official Poppy Playtime Discord server. The messenger was the account "Playtime Co.", which had laid dormant since they revealed Joel Sinclair's memo about the accident of Theodore Grambell in Leith Pierre's Computer Search. They asked for confirmation that the channel was secure. When users affirmed their question, the informant asked them to prove it by reciting the TSSF poem. They led with the first line: "On felted feet and with bated breath". Once players had typed in the last line, "For we have already met," the informant responded, stating "Indeed we have." (Further inquiries were made regarding the informant's identity, though this bore no fruit, with them only repeating that they had already met.) After a brief greeting, they requested a favor, sending an image of a document containing ciphers and a small drawing of a square spiral. The informant stated that more instructions would arrive, though they'd be invisible to the eyes. Once said instructions arrived, they requested users to "run icepick.bat on c:/domain/network/globals.authenticator".

"Test"

"Is this a secure board?"

The informant's request for proof.

"Indeed we have."

The informant asking users for a favor.

The informant's cipher document.

The informant's code prompt, only used once the time is right.

October 4th

Warrenbach Construction Pamphlet: Central

On October 4, members of the Mob Entertainment Partners in Crime program received a pamphlet advertising the company Warrenbach Construction, who had worked with Eddie M.N. Ritterman to construct a secret lab back in Chapter 2: "Fly in a Web". The advertisement revealed the company was family-owned and had been founded in 1930, the same year Elliot Ludwig founded Playtime Co. Unfortunately, there were seemingly no clues related to the ARG. However, players recalled the informant's last message, which stated that future instructions would be invisible to the eye. Realizing they were referring to invisible ink, fans immediately used a black light on the paper. (Content creator and member BarneyGoose was the first to post his findings.) This revealed that seven letters were highlighted:

C in "Construction".
E in "We".
N in "Owned".
T in "Operated".
R in "Warrenbach".
A in "And".
L in "Cleanly".

These letters spelled the word "central". During this time, fans were ultimately forced to wait until the next discovery, as further instructions were required.

The front side of the Warrenbach Construction Pamphlet.

The back side of the pamphlet.

BarneyGoose's advertisement, with the invisible highlights spelling "Central", as revealed by the black light. (Note: due to the image's angle, only the highlighted letters "C", "n", "t", "r", "a", and "l" are clearly visible.)

Fans speculated that Warrenbach Construction also created the prison area in Chapter 4.

October 8th

Uncovering Domain

On October 8, content creator Sheeprampage revealed that not all pamphlets contained the same hidden message. In his advertisement, six different letters were highlighted when he used a black light:

D in "Dirtiest".
O in "Worry".
M in "Family".
A in "Contact".
I in "Quickly".
N in "Cleanly".

These letters spelled the word "domain".

Sheeprampage's advertisement, with the invisible highlights spelling "Domain", as revealed by the black light.

October 9th

Uncovering Access

On October 9, content creator Tericho posted their letter online, which he had recently received. After shining a black light on the paper, he uncovered six letters that were highlighted:

A in "All".
C in "Warrenbach".
C in "Construction".
E in "Like".
S in "Small".
S in "Since".

These letters spelled the word "access". Fans (at the time) believed that these words would reveal a website URL once fully completed.

Tericho's advertisement, with a black light revealing the letters "A" "c" "c" are highlighted.

Ditto, but "e" is highlighted.

Ditto, but "s" & "s" are highlighted.

October 10th

Uncovering Net

On October 10, the next and final word was revealed in the Warrenbach Construction Pamphlet. After shining a black light on the paper, three highlighted letters were uncovered:

N in "Don't".
E in "Operated".
T in "Construction".

These letters spelled the word "net".

Scrap Command

With this final word, users realized that the four words given were a website URL. Combining the words in subsequent order revealed the website "centraldomainaccess.net". This led people to a gray computer monitor that allowed users to input commands while technical audio was looped repeatedly in the background. Recalling the advice of the informant, users used the command "start icepick.bat". After they entered the code, the computer initialized a scraping program, asking users to input the intended target to scrap.

Interactive computer.

The scraping program run after inputting "start icepick.bat".

Terminal

After using the command "c:\domain\network\globals.authenticator" in the Scrap Program, players were granted access to a window named Terminal. (Behind the window was a 1980s-themed background and the Command Prompt icon from the previous ARG.) Having completed the informant's first set of instructions, users experimented with the former's command list, inputting the codes into the terminal. Through this method, they found (at the time) several prompts that elicited a response from the Terminal:

• ls = "c:"
• hostname = "CENTRAL DOMAIN"
• date = "2002-##-##" (The month(s), day(s), hour(s), minute(s), and second(s) are displayed in real time.)
• start = "ERROR: Command not recognized: undefined/(word after "start" comand)"
• wget = "File not found: undefined/(word after "wget" comand)"
• pwd = Shows the directory where the user is.
• help = "If you are experiencing technical difficulties, server issues, or need to reset your permissions, please contact support@centraldomainaccess.net"
• clear = Clears the terminal, leaving it blank.
• cd c: = Changed directory to "/c:".
• (other commands) = "Command not found: (entered word)"

After changing the directory to "/c:":

• ls = "domain"
• cd domain = Changed directory to "/c:/domain".

After changing the directory to "/c:/domain":

• ls = "network, documents, applications, desktop"
• cd network = Changed directory to "/c:/domain/network".
• cd documents = "ERROR: INSUFFICIENT PERMISSIONS"
• cd applications = "ERROR: INSUFFICIENT PERMISSIONS"
• cd desktop = "ERROR: INSUFFICIENT PERMISSIONS"

After changing the directory to "/c:/domain/network":

• ls = "globals.authenticator, guardrail, subsyslogin"

The next breakthrough, however, came from a computer prompt not listed in the document. When fans inputted "help", the Terminal replied with the message, "If you are experiencing technical difficulties, server issues, or need to reset your permissions, please contact support@centraldomainaccess.net". Players realized the contact was for an email account and reached out to them. Upon doing so, they received an automated response from Playtime IT. The email read, "Hello! We've processed your request for help, and our I.T. department will reach out to you as soon as they are able! As always, we appreciate your continued work on behalf of Playtime Co. and our much beloved products! With Appreciation, Playtime".

The terminal window.

ls response.

hostname response.

date response.

Response to cd c:, cd domain, and ls subsequently.

cd c:/domain/network response.

ls response after changing the directory.

help response.

The automated response when trying to contact the support email.

October 12th

Documents Directory

On October 12, Playtime IT reset access permissions for the "documents", "applications", and "desktop" directories in Terminal. With permissions enabled, users tried different keys to continue digging into the "documents" directory.

• cd documents = Changed directory to "/c:/domain/documents".

After changing the directory to "documents":

• ls = "effects, ef_ygp"
• cd effects = Changed directory to "/c:/domain/documents/effects".
• wget ef_ygp = Downloading "ef_ygp".

After changing the directory to "/c:/domain/documents/effects":

• ls = "YGP"
• cd YGP = Changed directory to "/c:/domain/documents/effects/YGP".

After changing the directory to "/c:/domain/documents/effects/YGP":

• ls = "photoscan_01, photoscan_02, photoscan_03, photoscan_04, photoscan_05, photoscan_06"
• wget photoscan_01 = Downloading "photoscan_01".
• wget photoscan_02 = Downloading "photoscan_02".
• wget photoscan_03 = Downloading "photoscan_03".
• wget photoscan_04 = Downloading "photoscan_04".
• wget photoscan_05 = Downloading "photoscan_05".
• wget photoscan_06 = Downloading "photoscan_06".

After running the "wget ef_ygp" command, users uncovered an image showing a form letter created by Elliot Ludwig. The letter was sent to a Young Geniuses Program (YGP) candidate, confirming their acceptance into the program and requesting them to be on standby for further instructions.

When accessing the "effects" directory, the Terminal revealed "YGP". Users navigated to it and found six files (photoscan_01 - photoscan_06). Using the "wget" command, they downloaded all six images.

The first image, obtained via "wget photoscan_01", featured a tattered memo for an old Playtime Co. initiative called the Young Geniuses Program (YGP), designed by Elliot Ludwig. Its purpose was to seek out the strongest and most intelligent young minds to help shape the future and "tackle the universe's most unanswerable questions."

The second image, retrieved via "wget photoscan_02", depicted a list of individuals with their skills recorded. This list was procured by Gerad Lockehart, a private investigator associated with Playtime Co., and was given to Leith Pierre, who used it to identify the best candidate to lead the Special Projects department. Dr. Harley Sawyer, listed as an ABNS-certified neurosurgeon with several years of practical experience, had caught Pierre's attention, as his name was circled.

Playtime IT's email.

First step.

Second step.

Third step.

Fourth step.

Fifth step.

Sixth step.

wget photoscan_0# response.

Photoscan 1.

Photoscan 2.

Photoscan 3.

Photoscan 4.

Photoscan 5.

Photoscan 6.

wget ef_ygp response.

The acceptance letter created by Elliot Ludwig.

Fans (at the time) speculated that the Young Geniuses Program marked the beginning of Playtime Co.'s experiments, specifically the ones that predated the Bigger Bodies Initiative. Additionally, they believed its purpose was to gather minds capable of creating and improving upon these experiments.

Applications Directory

After reloading the website, users tried different passwords to continue searching the "applications" directory.

• cd applications = Changed directory to "/c:/domain/applications".

After changing the directory to "/c:/domain/applications":

• ls = "PCSS.exe"
• start PCSS.exe = Starting "PCSS.exe".

Opening the Playtime Co. Virtual Security System (PCSS) revealed three camera feeds, though only the audio connection was online, resulting in static on the video feed. The CCTV Network icon appeared below the Command Prompt icon, and the Terminal window minimized. The audio recorded disturbing crackles and screeches from the three camera feeds:

• What is heard on ECB_03 is mainly static, but interspersed are loud low screeches and growls. At one point, an unusual sound plays, sounding akin to a startup sound. The growling resumes before a high pitched squeak is heard and the audio devolves back to static and ends.
• The audio on L_04 also consists of mainly static with a sound similar to a printer running briefly at the start. In the distance, something metallic can be heard falling. Towards the end of the audio, something crunches its way closer to the camera's mic, stopping for a short while before walking away and the audio ends.
• C_01's audio, again full of static, at first reveals something being put down roughly, then some banging going on in the background. Static plays before the banging resumes, now more rhythmic, before a loud crunch puts a stop to it. Then the random banging resumes and then fades before the audio ends.

First step.

Second step.

Third step.

The PCSS window.

ECB_03.

L_04.

C_01.

October 14th

Photoscan 3 Decoded

On October 14, users uncovered an intriguing find regarding the Poppy eye close-up image (labeled photoscan_03 in the Terminal). When running the glitched portion of the image through a spectrogram, fans found an audio file of a phone bell ringing, which sounded similar to the Telephone noise heard in Chapter 3: "Deep Sleep" whenever Ollie called The Player.

October 15th

Photoscans 5 & 6 Decoded

On October 15, users solved the photoscan 5 image. By converting the corrupted image into an audio file, then converting back into text form, they uncovered a scrambled list of words:

• Enemy
• Heat
• Email
• Recent Series
• Me
• Eyes
• Pay
• 98
• Attention
• Liars

Arranging the words in the correct pattern (and adding context where necessary) revealed the message: "Recent series of emails: 98 liars. Enemy eyes on me. Pay attention to the heat".

It was also possible to decode the Photoscan 6 image by modifying the hexadecimal code of the photo file. The image revealed a figure resembling an elongated dinosaur-like creature, characterized by a mouth that mimicked the appearance of piano keys, multicolored horns, claws, spines, and a piano-like pattern running along its body and tail. Following this discovery, a user who referred to the figure as "Pianosaurus" on the official Poppy Playtime Discord server was banned by the moderators, as they deemed it a reference to a leaked article. Because of this, users (at the time) began referring to the creature as "Pianosaurus". Although several inquiries about the creature were submitted on the official Poppy Playtime Discord server, no responses were provided during that period.

Photoscan 6 reveal.

Discord comment error.

October 16th

PCSS Window

On October 16, players uncovered new findings in the three camera feeds from the PCSS window. By running the audio from the feeds through a spectrogram, they revealed three sets of digits.

• 38.449138, -90.349696 (ECB_03)
• 34.172343, -118.319609 (L_04)
• 43.86889, -70.2442 (C_01)

Fans immediately recognized these numbers as latitude and longitude coordinates, which meant they would have to travel to these locations, as the next clue would be found at the correct coordinates. (The developers would confirm this to be the case.)

After plugging the coordinates into Google Maps, having converted them from decimals to degrees, fans walked away with three locations:

• 38°26'56.9"N, 90°20'58.9"W → Arnold, Missouri
• 34°10'20.4"N, 118°19'10.6"W → Burbank, California
• 43°40'08.0"N, 70°14'39.9"W → Portland, Maine

ECB_03's spectrogram.

L_04's spectrogram.

C_01's spectrogram.

Geocache Clue

Content creator Sheeprampage traveled to the spectrogram coordinates revealed in ECB_03, next to Arnold City Park, Missouri. and came across a metal lunchbox covered with Smiling Critters stickers. Upon opening the box, he discovered a single Huggy Wuggy plush, sewed up and bound in multicolored strands of yarn. Hidden inside the plush were two crinkled documents, which were new Game Station Test Subject Assessment Forms, addressing an orphan by the name of Quinn Navidson. The orphan was assigned the toy, "Yarnaby", and his two attempts were monitored by proctors Matteo Lata & Harley Sawyer, respectively.

The document written by Matteo Lata says that for Musical Memory, he scored a 3 out of 5 for performance as he made "several mistakes, but finished with roughly par time". For Wack-a-Wuggy, he scored a 2 as "his awareness and response time left a lot to be desired" & "frequently missed the target". And for Statues, he scored a 3 as he "completed the obstacle course within expected time, but lost once and was instructed to restart".

In the document written by Harley Sawyer, it states that Quinn scored a 1 for Musical Memory, because he was "unresponsive to the trial" and had "no apparent comprehension of the rules or goals". He was also "unable to complete the game and no attempt seemed to be made". For Wack-a-Wuggy, he scored a 4, as he "was able to outperform the previous runthrough, despite not being able to properly handle a GrabPack". However, he apparently "bit the heads off several of the stuffed toys used for the game". For Statues, Quinn scored a staggering 5, as he "completed the obstacle in under 20 seconds", but "ran back into the course when handlers attempted to remove him from the room" and "hid in the foam pit and could not be located for 15 minutes".

On the document, there was also a post-it note stuck to it, reading: "Can't find 1166's damn files. IT needs to get more organized. We need some sort of recovery command."

First box found by Sheeprampage.

Huggy Wuggy toy bound in yarn.

Huggy toy squished inside box.

Contents of the box.

Recover window.

A subject assessment form of Quinn Navidson's first performance.

Quinn's second assessment form along with the "recover" post-it note.

Recover Window

Thanks to the aforementioned post-it note, users were made aware of a "recover" command for the terminal. Entering it would redirect one to a download locked with a keyword. The keyword was found to be "1166", Yarnaby's supposed experiment number. When unlocked, the website would download a .zip file, named "bbi_1166 .zip", leading to a file folder, called "bbi_1166", containing a image file, named "archive_5b00", an image of a paper transcript dialogue between Dr. Sawyer & Quinn Navidson. This document was originally sent by the developers on their Discord server, until it replaced "pr_1166.png".

This dialogue most probably took place before the Game Station test marked by Harley Sawyer, as he references that he will mark Quinn's next test and that he didn't score much high performance marks on his previous one, marked by Matteo Lata, only scoring 8/15.

Originally, a different document about a "Prisoner Profile" with a censored photo on it would download from the "recover" command "bbi_1166 .zip" file, which had a file folder, named "bbi_1166", containing a .png file, named "pr_1166.png".

A dialogue transcript between Harley Sawyer & Quinn Navidson.

A "Prisoner Profile" document regarding Experiment 1166, Yarnaby.

A "Weekly Check-Up" document regarding Experiment 1166, Yarnaby.

October 28th

Sawyer Evidence

On October 28, the "1166" keyword was rendered ineffective for the recovery screen. (Thankfully, players could access that content again by typing "recover bbi" into the Terminal.) Meanwhile, the informant resurfaced on the official Poppy Playtime Discord server, under the guise of their "Playtime Co." account. They informed users about a hidden message newly implemented into the website, hinting that they were "making noise". Interpreting the informant as referring to audio, the users checked the PCSS window and discovered that the original audio signals from all three cameras had returned, replacing the previous audio signals. However, camera C_01 had subtle alterations in its audio signal compared to its original version. Said changes were a series of taps heard throughout the feed, which fans recognized as a tap code:

.. . .. .... ... ... . .... / .... ... . . ..... .. ..... .... . ..... .... .. / . ..... ..... . .. .... . .... . ..... ... ... . ... . ..... / ..... ... / ..... ..... .. .... ... .....

Decrypting it gave the message "find sawyerevidence.zip". Inputting "sawyerevidence.zip" as a keyword for the Recover window, followed by "find sawyerevidence.zip" as a prompt, presented users with a ZIP file named "sawyerevidence.zip". Repeating the command prompt at least five times revealed five additional ZIP files. Each ZIP file held a single document labeled "findings", which contained photos of small, ripped pieces of different documents. Said fragments had been mixed, separated, and rotated in a similar fashion to a jigsaw puzzle.

Sawyer findings (1).

Sawyer findings (2).

Sawyer findings (3).

Sawyer findings (4).

Sawyer findings (5).

Sawyer findings (6).

Soon after, fans rotated, separated, aligned, and assorted the fragments by relevance, assembling six different documents:

• The first document was of a written incident report by Brendan, a young Playtime Co. employee who worked in the Tourist department. Said report concerned a tour group under his watch, implying that they were grievously injured and/or killed during an unspecified date in 1993. Brendan, still traumatized by what transpired, was unsure of what caused the incident and begged his superiors not to hold him accountable.
• The second document was of a letter from Leith Pierre to Harley Sawyer, detailing the first interaction between the two men. In the letter, Leith reveals his knowledge about Harley's neurosurgeon experience and former involvement in the late Elliot Ludwig's Young Geniuses Program. He invites the doctor to meet him outside Playtime on January 15, 1990 and states that he has a job opening that would greatly benefit from Sawyer's skill set - presumably referring to Special Projects and the early experiments.
• The third, fourth, and fifth documents were of experiment results written by Harley Sawyer on behalf of Special Projects. Said notes concerned Experiments 1015, 1026 and 1160, respectively. While 1015 and 1026 perished - due to the department's (at the time) inexperience with "neuronal reactivation" - and ultimately deemed failures, 1160 was their first success. Harley remarked that 1160 provided much promise to their work and would be the first of their "bigger bodies". (The last statement finally confirmed that Boxy Boo was Experiment 1160.)
• The final document was of a informal note written by an employee working in the cafeteria. The employee requests in their letter that their coworker bring them a sandwich for lunch, while also warning them about Harley Sawyer's food preferences.

Brendan's incident report.

Leith Pierre hiring Harley Sawyer.

Experiment #1015 testing note.

Experiment #1026 testing note.

Experiment #1160 testing note.

Sandwich note.

Edited version of Incident Report: Brendan, by MascotMania21.

Ditto, but edited version.

Ditto, but edited version.

Ditto, but edited version.

Ditto, but edited version.

Ditto, but edited version.

Eye Message

Following the release of Yarnaby's debut trailer, Mob Entertainment released a post containing a single eye emoji, seemingly referencing the ominous eye seen in the aforementioned trailer. (Interestingly, the computer that the eye appeared on was the exact same model as the Icepick ARG's.)

November 7th

Subsyslogin Command

On November 7, Mob Entertainment posted a message on the social network X, teasing players with a suggestion to wishlist Chapter 4 on Steam under the following phrase:

"you should totally Wishlist Poppy Playtime Chapter 4 on Steam
or so I heard 👁️".

Upon visiting the Steam page, fans discovered a command in the page description of the "Features" section that said: "start subsyslogin". By entering this command in the "/c:/domain/network" directory, a new request appeared:

"SUBSYSTEM LOGIN INTERFACE
Enter username:"

When trying to carry out the procedure, with the PCSS window open, a message appeared that said: "ERROR: Please try the 'start subsyslogin' command on a different page other than the PCSS camera pages."

Steam Page's new command prompt.

"start subsyslogin" response in the main terminal.

"start subsyslogin" response in PCSS window.

Compromised

A few minutes later, Mob Entertainment responded to the previous message, indicating that an unknown communicator had infiltrated the official Poppy Playtime Discord server:

"wait... there's a mysterious communicator in the official discord 👁️".

At the same time, the informant reached out to users and warned them that their position could be compromised. When users asked who was behind this intrusion, the tipster responded by saying that they had "drawn the system's attention" but were not sure how much he knew. It was revealed that a third party had taken control of the company's IT support email. The tipster advised players to take advantage of this situation, as the system had not yet fully understood what was happening or who was responsible.

The informant's warning.

Compromiser revealed.

Unclear extent of their knowledge.

IT support email seized.

New opportunity.

Logging In and Page01

Now that they knew the email support was under new management, the players contacted the account once again. Although they received a large number of responses based on their questions, none of them had a username that was useful. Some of the developers within the official Poppy Playtime Discord server (at the time) began modifying their profiles. These changes included using the Zalgo font, replacing their names with color blocks, adding eye emojis, and replacing their profile banners with backgrounds of different colors. Eventually, all of their profiles, images, and banners changed to the color "white," and fans soon realized that this last feature was referencing Playtime Co. scientist, Dr. Bruno White. (Plus, one developer's username changed to "admin", revealing that White was the computer's owner.)

Further investigations into the third party (who is currently speculated to be Dr. Harley Sawyer) revealed the username that had to be entered in the terminal is: "bruno.white". By entering this username, the terminal led the players to a new window titled "Page01", which had a similar design to the Recover window. To continue, users were asked to enter a password.

Returning to the third party, users asked him if he knew White's password, to which he denied. He assumed it would be a sarcastic jab at the first person, given their bitter relationship with the late doctor. Furthermore, the contact hinted that Dr. White's password would not be creative, as he often simply repeated his words while they spent time together. Since Sawyer's temperament on trivial matters had been mentioned earlier in two separate documents (Sandwich Note and Photoscan 4), fans thought the password would be in one of them. In Photoscan 4, they noticed a phrase that was repeated twice and underlined with red ink: "one bad day." By entering this phrase as "OneBadDay" as the password for "Page01", it unlocked and revealed a black background with a cryptic red message.

"He asked if I still dream.
Why? This changes nothing.
A broken leash. Caskets.
I do.
What became of her?
Theater incident
still
It’s strange, the things that linger."

Recipient's opinion about 1166.

A list containing most of the email responses.

The color block change utilized by one of the developers.

Page01 window.

Contact's best guess for password.

Follow-up to password email.

Page01 message.

November 8th

Incident Folder

On November 8, players discovered that the phrase "Theater incident" in Page 1's message was hyperlinked. Clicking the hyperlink downloaded a ZIP file named "incident". Inside the ZIP file was a file folder. And inside that folder were five images and a document.

• The first image, named "El ygp 021", shows a document related to the Young Geniuses Program. The author, most likely Elliot Ludwig, records his observations of a young Harley Sawyer and praises his mental brilliance, believing he will "lead science into the future".
• The second image, named "Theatre 01", shows a slightly burnt and bloody Huggy Wuggy toy, with his eyes removed and his left leg and right hand partially burned off.
• The third image, named "Theatre 02", shows one of the Theater's projectors, broken and burnt.
• The fourth image, named "Theatre 03", shows a burnt Candy Cat toy.
• The fifth image, named "Theatre 04", shows an object burned beyond recognition.
• The document, named "warning", shows a torn, fragmented page of a biology textbook. A message is written on the fragments, with the writer (presumably Harley Sawyer) voicing their fury about being betrayed by Elliot Ludwig. Additionally, a silhouette is seen in the center of the document, with fans pointing out that it resembles a jester.

"el ygp 021" (YGP Sawyer Observation).

"theatre 01".

"theatre 02".

"theatre 03".

"theatre 04".

"warning" and jester silhouette.

Warning: Betrayed.

Fans (at the time) speculated that the Theater images were connected to Brendan's incident report. Others had thought it was related to Boxy Boo killing Rowan Stoll.

November 15th

Informant Lost

On November 15, the informant resurfaced on the official Poppy Playtime Discord server. They informed users that they had left new instructions for users, repeating their previous clue about "making noise". However, their profile image suddenly changed to the ominous system eye, revealing it had finally found and overtaken the informant's account. Having discovered who had been accessing the Central Domain, the system warned users to "stay out", as this would be their only warning.

The informant's latest instructions.

Reason for silence.

Making noise once more.

The eye overtakes the informant's account.

Identities discovered.

"Stay Out."

Maze: Document

Following this warning, players found the login page had disappeared completely, with Page 1 becoming the main page. Several words were hyperlinked, and clicking the hyperlinks would lead to different pages, essentially a maze of sorts. Players who clicked on the word "dream" and then "it" on the next page found an intriguing discovery: the third page's word "find" had a blue hyperlink. Clicking the link took users to a message with a phrase written below it: "sx009". Adding the text at the end of the website link led to another message; this time, two words had blue hyperlinks, "A good trick. Sometimes where we keep something is more important than the thing we keep. innovation is Key."

After interacting with the words "where", "you're", "order" and "holes" in sequential order, fans found another phrase: "fm3400". Inputting the text into the website link led to a page containing one hyperlinked word: "No". Instead of leading to another page, a document (named "673413ff760b14ddc45aeac4_Letter") was downloaded when users interacted with the hyperlink. This letter was written by Elliot Ludwig and addressed to Harley Sawyer, who the former had remorsefully removed from his Young Geniuses Program. Ludwig cited Sawyer's "lack of humility" and ambitious obsession with results - solely for science's sake than humanity's - as the primary reasons for his removal.

"clarity" branch. (After clicking "dream".)

"edsn" branch. (After clicking "it".)

"hide" branch. (After clicking "find".)

"sx009" branch. (After replacing "hide" with "sx009" in website link.)

"563vge" branch. (After clicking "where".)

"idea" branch. (After clicking "you're".)

"b01973" branch. (After clicking "holes".)

"fm3400" branch. (After replacing "b01973" with "fm3400" in website link.)

"673413ff760b14ddc45aeac4_Letter.png" (YGP Sawyer Removal).

Maze: Phone Number

After uncovering the document, players began highlighting the different pages, looking for hidden letters, numbers, or phrases that could lead to more findings. Through this process, fans uncovered ten different numbers: (*Note: The "kja" and "jdja" branches' numbers were already revealed.)

"kja" branch → 8
"rwk" branch → 0
"qauaj" branch → 6
"rcpaa" branch → 0
"tksp" branch → 3
"adbcr" branch → 5
"tdua" branch → 6
"raj" branch → 7
"jdja" branch → 9
"qdx" branch → 4

After uncovering this series of numbers, fans were initially unsure what order they had to put them in. Fortunately, one of the developers posted a clue on the official Poppy Playtime server, stating a specific cipher was involved. With this clue in mind, players realized that the URLs of the branches with the numbers ended in strange and incomprehensible words. (The maze's other URLs ended with words like "eye" or "clarity".) Upon closer inspection, users deduced that the words were created under a Keyed Caesar Cipher, which would require a specific keyword to decode. Since the message "Innovation is Key" had been repeated numerous times in the maze, fans suspected this was their answer. Inputting "innovation" as the kwyword revealed ten comprehensible words:

"kja" → "one"
"rwk" → "two"
"rcpaa" → "three"
"tksp" → "four"
"tdua" → "five"
"qdx" → "six"
"qauaj" → "seven"
"adbcr" → "eight"
"jdja" → "nine"
"raj" → "ten"

With the order revealed, fans put the numbers together - corresponding to the numbers revealed in the branches - and realized that they formed a phone number: (800) 364-6597. Calling this number played a recording of a meeting between Leith Pierre, Stella Greyber and Eddie M.N. Ritterman. During this meeting, they discuss a catastrophic and soon-to-be highly confidential event that occurred within the premises of Playtime Co. (Said event is heavily implied to be the Theatre Incident.) The phone call ends with Gerad Lockehart interrupting the higher-ups' meeting, revealing the perpretator responsible for the tragedy was Harley Sawyer.

"kja" branch. (Note "8".)

"rwk" branch. (Note "0".)

"qauaj" branch. (Note "6".)

"rcpaa" branch. (Note "0".)

"tksp" branch. (Note "3".)

"adbcr" branch. (Note "5".)

"tdua" branch. (Note "6".)

"raj" branch. (Note "7".)

"jdja" branch. (Note "9".)

"qdx" branch. (Note "4".)

November 19th

Connection Terminated

On November 19, the website was updated again. However, this time the page name was called "terminalend" thus meaning that the ARG has concluded, claiming all media previously revealed to be lost media.

Two Google Drive links could be seen in the page.

• The first one led to an image which was corrupted. However, when adjusting the image's quality, a new character could be seen along with a secret message saying "YOU WERE WARNED". The text "WITH REGARDS - SAWYER" was also hidden in the text of the file.
• The second one led to the aforementioned recording, but with better sound quality. There was, however, data added to the end of the sound file after the final pronouncement. A spectrogram of the data displays what appears to be some Greek text translating to "the baptism of fire".

Nov 19th Sound File Data Spectrogram

Navigation