Sombra ARG – Simple, Full Summary! (Overwatch New Character Teasers)

Hey and welcome. I’m Hammeh and in this video we are simplifying the search for Sombra. In this video I’m going to be going over everything that’s happened so far in the Sombra ARG or Alternate Reality Game that Blizzard has been playing with the community towards the potential announcement of something to do with Sombra. I’ll try to make the Sombra search as simple as possible, summarize all the steps so far and what’s happened, how things have been solved in a pretty simple way. Kind of some thoughts as to where it could all go from the current countdown. Now I’m not cryptographer, super-mega spy, or programming genius, so I’ve tried to explain the things involved as I understand them from a layman’s perspective. If you’re talented in one of these fields and spot any mistakes in my understanding, please let me know in the comments below. Okay. Let’s go. Firstly let’s summarize the history of Sombra before the ARG. Now Sombra goes back even to October the 15th, 2015, when Ellohime in a stream before the actual open beta for Overwatch announced, showed the folder and had a little bit of a chat about heroes.

Now he also showed a bunch of screens in Dorado, Dorado being very closely linked with Sombra. We can see the folder on the desk that is still there to this day with the name of Sombra along side the name of Soldier: 76. And we can also see the screens around the plant showing the Sombra protocol, which is why the plant is apparently maybe shut down at this point in time. Ever since even pre-beta, Sombra has been teased. Now the next step of this is on May 9th when the voice line, “Where’s Sombra when you need her?” was data mined and found out by me.

Hi mum! After that a teaser for Anna was released in Temple of Anubis a little bit later, and a few people, including myself, thought that it might point to Sombra. Ah oops! As smaller clues gradually became available on Ana Amari being a hero this Anubis image became ever more likely to be nothing Sombra related, and was eventually shown to be her shrike skin in a bit of a nod to Destiny me thinks. Now confusion still exists in the Overwatch community to this day on this, long story short, Ana and Sombra as far as we know, are not related in any way shape or form. And they’re different entities or individuals. If some Sombra is a person, of course. Fast forward to July 12th, 2016 and Ana’s origin video is released along with a bunch of teaser assets. Now by pausing this video, at the one minute 16 and two minute 11 time marks, a whole bunch of hexidecimal numbers were discovered.

Here are the ones for 1:16. Taking this hex and converting it to ASCII, the most common format for text files on computers and the internet, gave this string of characters. Now some clever people who are into this kind of thing, there are a few different Sombra hunting groups, and I’ll detail them at the end, used something called a xor cipher with a constant of 23. And this translated it into Spanish. So before I go through the Spanish, here’s a quick explanation of a xor cipher. It’s a simple classical cryptographic cipher, the kind of thing that people who are into code and problem solving may know well about. It’s an additive cipher, and what this means is that you can a string of text, and you can encrypt it, making it harder to read. The xor function is applied to every character with a particular key, and that key affects how the text is jumbled up effectively.

If you do know the key, then you can apply the xor function to the text just to decrypt it. It’s like having a key to a lock that will undo all the jumbling up that’s been done. So that’s the xor cipher. Anyway, the result is with 23 as the constant, there’s speculation probably that Sombra’s going to be the 23rd, so 23 is a reoccurring number in the Sombra hunt. The Spanish translates to, “She who has the information has the power.” Repeating this process for the other cipher in the video gave the same Spanish string but with just a couple of different letters at the end. The first string had Somb at the end and the second had Ra at the end. So Somb plus Ra equals Sombra. There’s a bit of maths that hey, even I can understand. After this jumping forward to July the 19th of this year the Ana Dev update video was released. Now, in this video some bar codes were found, if you took these bar codes, turned the bar codes that were there into binary, so ones and zeroes effectively, this was taken by someone clever and turned into pixels.

So, taking the bar codes, changing them into binary, ones and zeroes, changing them into pixels, made a QR code. Now, everyone can scan a QR code. When this code was scanned, it gave the message of this in Spanish which translates to, “Was that easy? “Well, now that I have your attention, “Allow me to make things much more difficult.” Sombra playing games with us there. Skip forward to August the 2nd, and the next step of this game continues. The summer games were announced and in the summer games video if you watch very, very carefully in this image of Tracer jumping through you can see in her blinking trail another cipher is actually visible, in terms of a code. So this is in base 64. Base 64, very long story short, is another form of binary ones and zeroes to text encoding.

It’s a way of translating or interpreting binary into text. Now using a clever tool that some clever people from the Game Detectives Wiki community caught on to, a bunch of people who love solving various kinds of puzzles, particularly in games, created this output. Now, this is encrypted. The salted header at the start of this particular string, that little bit salted there, means that the rest of text is apparently actually encoded into open SSL. So this is a cipher that requires both the key and a known cipher. So the salted bit is a clue that two different things were needed to actually solve this. Now the salt is added to encrypted data to ensure uniqueness. People actually managed to find the salt, so all they need was the password and the method of cipher. The community managed to narrow down the cipher that was actually needed by having a look at a hex dump of the actual string. The encypted message was three bytes short of a full normal chunk of data.

This is a good indicator that the cipher was a string cipher and narrowed the list of ciphers down a whole bunch. Now right now this particular line of inquiry is still unsolved, it’s speculated that Blizzard actually jumped past this by giving hints in a different direction. However, this is a mystery that could still be out there. Now obviously at the same time as this there is actually a whole bunch of stuff in the North American of the summer games video. These references are actually not visible in other versions of the trailer. They all indicate to directions, and are tied with particular heroes. Remember this compass rose idea is going to be very important in a few of the things that we discuss, is a brilliant summary from the Game Detectives Wiki showing the actual compass rose of all of the different heroes and images. We’re now up to about the 4th or the 6th of August in our timeline, and it’s at this point that the ARG hunt has starting going slightly off the rails. In trying to solve the Tracer code a lot of people were looking for other clues.

And in Dorado when some people looked up to the sky at the various text string, there’s also something that looked like artifacting in kind of a circular way. Now I think it’s probably because people have been looking at bar codes and similar such things, they thought a similar pattern in this sky texture. Now this is where people went off the rails. They really went into trying to solve this sky code as it became known as. It was tried to make into a code, various people ran programs, they tried to convert into different text formats. Someone people even tried making it into a song. Everything got so off the grid, by the 9th of August, there was a Dorado data mosh. Now on the Overwatch media page a new photo of the attacking spawn in Dorado was added. And you can see the lines in comparing this data moshed version to the original version. There’s definitely some differences, indicating that it concealed some kind of hidden message. Now data moshing is the act hiding information inside a media file by editing its source code, and of course some times this will have visual or auditory effects, showing changes to the actual file.

So the corruption here that we can see actually has a meaning. After comparing the original image against the different image with different checking tools, it was found that certain English and Spanish characters had been replaced with exclamation marks, producing a Spanish sentence out of these replaced characters. Now when translated into English it says, “Why are you looking at the sky? “The answer isn’t over your heads, it’s behind you. “Sometimes, you need to analyze your previous achievements.” So, that’s Sombra and Blizzard with a fairly big clue saying, “Stop looking at the sky code. “Guys you’re wasting your time.” But the previous achievements part lead people to have a look elsewhere. Guess sky song’s not gonna be getting to number one. Jumping onto the 12th of August, and people actually noticed in the new display on the Blizzard website in people’s profile pages that there was an interesting achievement. Now if you inspect element on this achievement, you can just right click and do it in your browser, there’s actually a commented line in the HTML code there in Spanish.

Again, translating the Spanish we see, “Damn, not bad. However, I’m getting bored. “Let’s try something new in the same direction.” And then what appears to be just a string of code, text, and characters. So this section of code was run by someone smart through a Vigenère cipher. This is classic cryptography again. A sixteenth century French diplomat Blaise de Vigenère encoded messages with a passphrase and the letters of the phrase determined how each letter was encrypted. Smart people put two and two together and this is where the compass rose comes into effect. The passphrase for this was actually using the heroes in order of their positions on the compass rose. The phrase, “Tracer Torbjorn Winston Symmetra D.Va Mercy Bastion Genji McCree,” when used as a key actually gave this URL, once it was tidied up, and spaces and various characters were removed. Akamaihd is a known media hosting company and a lot of big companies use Akamaihd to host website images, videos, and that kind of thing.

This is very clearly a link to the Blizzard media server. Going there people found a Volskaya Industries image, and again this was data moshed compared to the original. The same techniques and programs were used to compare the original to the new Volskaya image, and the differences resulted in the following output. Now there were a few different things going on here. Long story short, there were a lot of strings in the source code for this that appeared to be ASCII art, so by guessing, people managed to find out that if a new line was added every 59th character then a skull emerged.

Along with some text here this is the skull that you’ve seen a bunch of in people’s thumbnails in things recently, and the translation of the Spanish is, “It seems you like these little games… “Why don’t we play a real one?” At this point this was all a bit of a dead end. And no progress was made until earlier this week.

Couple of days ago a Discord user within the Game Detectives community called Majesty apparently was tipped off to a topic on the Blizzard boards. Now posted by Skycoder, a little bit of nit taking By Blizzard and Sombra there, I think about the sky code false trail, the name of the topic had translated from binary says 23. Again this 23 number may be Sombra’s the 23rd hero, it’s a number that’s recurred over and over in this ARG. The time posted on the forum was 23 hours and started counting down. I remember this countdown. Again we’ll come back to it in a little bit.

If you stay on this page for any particular period of time, the link’s in my description below this video, it soon begins to glitch and distort, it turns a hue of purple, and then opens up a text box with a whole bunch of code just like this. So, people cracked out the base 64 again, and surprise or surprises, this turns it into another ASCII skull. People then obviously set to work comparing these two skulls. Both skulls were stripped of spaces and the characters, new characters were put into single lines of text with no spaces. After taking away bytes from both skulls this text string was identified. Again for the third time this ARG, classic cryptology came into play. This is solvable with something known as a Caeser Cipher. It’s a substitution cipher, very, very simply each letter in the text that you want to change or encode or muddle up, is replaced by another one in the alphabet by a fixed amount of positions. So, let’s say for example I used the letter A with a factor of two, C is two down the alphabet from A, every A would be a C, every B would be a D, and so on and so forth.

Unsurprisingly related to Julius Caesar who apparently used it in his private correspondence. The number 23 has been used a lot, unsurprisingly when these were shifted by 23 as the actual cipher number, we got some more Spanish, “I promised you a game… “I believe you Game Detectives,” calling out the Game Detectives community, “would call it a trailhead?” Not to be downhearted but a trailhead is obviously the point where a trail begins, so another puzzle to sort out. Now these ending characters, with a .HTML on it, again very much look like the end of a particular URL. So people took this back to the Blizzard media server that was used before, unsurprisingly they managed to get another image. Just of interest, “usa ambas calaveras,” translates to, “use both skulls.” So, blizzard getting very, very specific in terms of their clues.

Trying to make sure that people don’t get too far off track again I think. By using this, we got a really interesting video which I’m going to show you here. Now I’ll call you a few things out about this, if you actually look at the metadata with the video, then it has some more Spanish saying, “You seem to be very interested in these heroes, “maybe you’re interested to know some more details “that I found out about them.” And that very much relates to the video. You see, Janina Kowalska, which is apparently a kind of Jane Doe or a common name in Polish.

Judging by the images of this skull, it’s very likely to be Ana Amari. You can see the eye and skull wounds there caused by her confrontation with Widowmaker. Equally if you look in the top right, the 50 to 60 years old age piece probably works out. It’s meant to be, I think, a medical record of Ana Amari being taken into hospital after the injuries she sustained on what was her final finale Overwatch mission. Now the next clue is actually a bit in this video and if you take a look at the bottom right you can see this heartbeat pinging away. Now, there are apparently a corresponding amount of lines in the bottom right, the letters of the alphabet. People just put a letter of the alphabet to each marker underneath and they watched this little clip to see where the heartbeat was actually pinging, and that gave Moment in Crime as a word answer.

Now A Moment in Crime is the name of a Crime Stoppers style show which released actually ages before Overwatch. It’s a short video, talking about the Junkers being on their crime spree across the world. Junkrat and Roadhog going a little bit crazy. However, was registered as a website, people went to visit this site and found a bunch of stuff that was effectively talking about an automated email response, as if the website had been hacked. A couple of users, Majesty and Kraus, sent a mail to [email protected] and got an automatic response, which I’m showing here. Which seems to be hacked by Sombra in version 1.7. We can also see a table of codes, or what look like timestamps here, as well as an additional secondary string underneath. Taking these timestamps as AA:BB:CC, where AA is the skull number, BB is the row, and CC is the column, it actually produces a 5v5 grid. Now this particular grid actually hints towards a particular kind of again, classic cryptography.

It’s a very classic cipher, it’s called a Bifid cipher, this was invented in 1901 by Félix Delastelle, and it combines a couple of different things. The transposing, the moving of figures like the Caeser Cipher, with a regular pattern, also an encoding square created by the ancient Greek historian Polybius. Now what this encoding square does, that we’ve been given, actually allows you to take letters of the alphabet and break it down into more basic components. So it’s another additional layer of making it complicated. When you put the two together, you get this particular string. When you get that out of leetspeak it effectively just says, “Sombra, information is power, Sombra.” There we go, a bit of a dead end again. Meanwhile, the countdown on the forum post reached zero, and when it reached zero the Moment in Crime page was updated saying, “Establishing connection. “The Sombra Protocol version has started” and, “Transmitting information into active omnics.” It was only at 2%.

A comment was added also at this time in the source code of the page saying, “Well done, you have my password. “Hacking this television program was meaningless. “Wait for what is coming.” That at the moment brings us up to August 26th and the present day of this ARG. I’m finally going to have a little think about where we’re at right now and what might come next. The Moment in Crime page that I’ve linked is still counting up, just very, very slowly.

It is not counting up at a uniform rate corresponding with time passing in real life. It’s still on 5% at the moment and it may not move for a while for however long. We cannot tell when it’s going to reach 100%. What will happen when it actually ends? Well it’s pretty likely by this stage that Sombra is the new hero. The number of references to 23 in ARG makes it quite solid that she could be hero 23.

As for her abilities well her hacking interests are strongly confirmed from this ARG. We already know from Ana’s Old Soldiers comic that she’s working with Reaper and by association on the radar of Talon if not working for or with them directly. Beyond that anything we think is pure speculation. Now there are some data mined lines that people have grabbed not too long ago that show that Blizzard has recorded sound lines for heroes around detecting stealth. – [McCree] Now I can’t see you, but I know you’re there. – [Mei] Something is not feeling right. – [Tracer] Hey, where are you hiding? – [Hammeh] Perhaps Sombra could grant temporary stealth for other heroes or herself. But we’ll just have to see. Finally for those hoping for the countdown to finish quickly and Sombra reveals soon, personally I’m not too convinced on that.

Here are a few reasons why. In interviews with EuroGamer just after release Jeff Kaplan said that releasing Mei, D.Va and Genji all at the same time was way too disruptive for the game during beta, and that heroes would be released one at a time for a while until the game stabilizes. Let’s have a quick think about, since release, when we’ve had content launched and released. From the launch in May we’ve had Ana in July, so that was roughly two months after launch. After that in August we had the Summer Games, which was mini event that the team must have also been working on. We now know that we’re going to receive Ocean World, the new map based on Germany in September, and of course we’ve also seen on the PTR a whole bunch of emotes, balance changes, and more. So this is two months from the Ana release in July, there are monthly content releases going at the moment, What could fall in October? If it’s not Sombra, what could it be? I think we already know this from a few data lines that have been dropped, and even the Mercy and Torbjorn image that we saw in Recall.

I’m pretty sure that our October release of content is going to be a Halloween themed event. There are skins that could come out, there’s already Genji’s line that people have picked out in-game that talks about his Halloween costume being a cyborg ninja. – [Genji] My Halloween costume? Cyborg ninja. – [Hammeh] It feels very strongly that Halloween will be in October, and it doesn’t mean that two pieces of content can’t be released in the same month, it’s quite likely that Blizzard seems to have a monthly sprint cycle or similar. For this reason I don’t think that we’re going to get more than one content dropping a month and October feels like it’s going to be Halloween.

So what does that lead us to? Well, November is BlizzCon, big announcements are always made at BlizzCon, And again, D.Va, Genji, and Mei were all announced at BlizzCon last year. My money would be on the fact that we’re a Sombra announce at BlizzCon this year. As a result I don’t think that there’s going to be anything massive in terms of development in October for sure. I don’t think that we’re going to see an announcement in September or October, but who knows? I could be absolutely wrong. Here’s hoping, eh? I’d love to see a hero a lot earlier. Phew, that’s a summary of the Sombra search so far, I’m pretty running out of guesses at this point. If you liked this video, please do check out some of my other game theory and actual canon Overwatch lore videos, voice lines, interactions, a whole bunch more.

I Overwatch lore, story, and anything to do with it. Please check it out in the channel. Please like, subscribe, and comment as well, and tell me what you think about Sombra in the comments below. Cheers for tuning, I hope to see you soon, I’ve been Hammeh as always, take it easy.

As found on Youtube

Find More Guides @