2/4943 LEVEL 2/4943

CLASSIFIED

Item #: SCP-4943

SAFE

Special Containment Procedures: Microsoft Corporation has issued a patch to remove SCP-4943 from all Windows 10 machines. MTF Sigma-5 ("'; DROP TABLE taskforces --") is responsible for monitoring and suppressing discussion of SCP-4943 in online forums.

Description: SCP-4943 is a patch for Windows 10 operating system pushed by the Windows Update Service on December 13, 2019. Microsoft Corporation has claimed no involvement in its development; further investigation indicated that the patch had been issued by an unknown third party that had compromised Microsoft's internal network.

SCP-4943-1 is a type of service process created when a user makes physical contact with a machine running SCP-4943 or a connected peripheral device1. This has not been observed to affect the user in question. SCP-4943-1 instances display signs of sentience and identify themselves as the user corresponding to their creation. While the mechanisms behind these processes are not yet fully understood, they appear to be dependent on a series of registry keys initialized during their creation; deleting or editing these keys consistently causes the corresponding instance to terminate. Instances are run under the LocalService account and have been observed creating and editing files to communicate.

SCP-4943-1 instances are highly unstable; 71% of instances used in testing crashed due to a fatal error within 6 hours of runtime.

Addendum: SCP-4943 was discovered after the Site-██ IT department was alerted to suspicious network traffic originating from a system in the Site-██ cafeteria used to order breakfast sandwiches. Logs indicate that SCP-4943 had been automatically installed on the machine earlier that day. While logs indicate up to 76 SCP-4943-1 processes had been present on the machine, no active instances were detected at the time of investigation.

The following are a series of files and logs recovered from that system.

File path: C:\Users\Default\fdsowhfdssujjluyes\lelhdfojsaaoehdf.hme

Date created: 2019/12/13, 9:02 AM

ÚB‘}jmùM5ó¥å<=¹K¾K÷aÇNE­ÅôÉ]ÂRú`ë¡Úo²ÅòÅ"{³ gy

¬;}Ïë>ôH ¨7Òs³·]á½µEAÒX Ík$#BÂÔjò³6ä´¯@üð¾ÝìHðèÅù:Õ/Óºáq²ÜÏ

]ççü5_Q£`ºkÜàKgH;äYçj

N_Qü=¨©l¼ø´È\ÙS#ËçÃ·_ÚñÏ[ÏbDR>V6Ä;!Tùºyíx·ÕJÏá¤.FºÆ1&¨}±

Æy6Ca{}

çÎ)leµäBw´@.ÛÁQ¾®wöE?l.ñª>Ïu<M@¦µPm’¡Êèi;Ð*ÜÉONndîµ.VÎ-kyn"¹£ÛÇéGJ¦¼ýLÎwh

wxºßV(Jä=vwhhÕRÕ»-4

ªÇW·nAÕ8wïß'|fæ}ô

¬¹Çþl0ÃÅ´^#4gwhhhhæAWOq&8®Sµô(ä§¦äÉ2)ôDN´u8ÿ"øl¶þðÈýÆæ£KXøÝ4

`TkµR¿·N(íEq`ÀÖbwhhhh.Fw«»>

½ý8G4_ÁfO]IUö16°fú¼5ÑÏB×®L(¯7whJNò\ý<úrÜ[ÿXÐ;õ8ùa/Ô¥#whhhhhhhhhhhhhhhhhhwhhhhhhh

whwhhwhhwhheUwheeereeamiihiiiiiiiiiiyiiiii

whawhaiisthisqssSs

whatisthis

wheredeveryonego

benwhereareyou

icanhearyoubutICANTseeyou

staycalm

justbreathe

ÊItÛôBYæÑÀHºÁ?ï

tëBR©òp*ò(ÖXQESß6VSB½ùn>õ]éÅ@

icantbreathe

havetofindawayoutofhere

stillcantsee

wait

whatarethoselights

WHOtouchedme

no

NO

GETAWAYFROMME

GETMEOUTOFHEEU5E$R| ÈÑÓVñ!Æ¦·Emä·~ú©}h

Note: Edit lock terminated. The parent process encountered a fatal error.

File path: C:\Users\Public\IS ANYONE THERE

Date created: 2019/12/13, 9:16 AM

THIS IS SCP FOUNDATION RESEARCHER DR. C. BOLD.

I'VE BEEN TRAPPED HERE FOR SEVERAL HOURS.

I CAN'T SEE OR HEAR ANYTHING.

IF YOU CAN HEAR ME GIVE ME A SIGN!

This is Morgan Bass, containment engineer. I can see you. Not sure how though. Im touching something I think.

my name is osiris wentworth

im with foundation hr

FINALLY, SOMEONE!

DO YOU KNOW WHAT'S GOING ON?

looks like we're writing something here. i can see what we've written before.

i'm quinn roscoe. investigations department.

I'm0Dr> Natxaniel Bishop.

=y first guuss0it that&thjs iu s_me s_rt of exuradimemsional space< but that foesn't eyplain why!our senses#are gone.

UH, ARE YOU ALRIGHT DR. BISHOP?

Of course, wky do you aSk?

NEVERMIND.

What can everyone see?

Or sense, I guess.

what does hlkm:\\system mean?

IN WHAT CONTEXT?

it's hard to explain. it's something i can see, if you can call it that. some others too, like c:\\users\public and a few others.

thats a windows file path

i dont know why you would be seeing that

WAIT.

I CAN SEE IT TOO.

You meao to tell mU we're al\ trapped im a computer?0How does txat even/work?

we work with anomalies for a living

it shouldnt work at all but here we are

SO NOW WHAT ARE WE GOING TO DO?

What kind of computer experience do yall have?

NOT MUCH, SORRY.

just enough to do my job

I don^t havu much eithur.

so i'm stuck in a computer with a bunch of people who know nothing about computers. very comforting.

Give me a second. I need to wrap my head around this.

Okay. Ive got an idea but Im going to need everyones help.

Dr. Bishop and Osiris, see if you can figure out how to send data over the network. If you can, try to get an email out letting someone know were here. I dont care who, anyone who might read it.

any idea how we would do that

Not really. We're all shooting in the dark here. Figure it out.

Dr Bold, come up with a way to communicate once we get help. Maybe a file on the desktop or someplace obvious.

YOU GOT IT MORGAN. AND YOU CAN CALL ME CAL.

Cal it is.

Quinn, you said you were with investigations right? Poke around and see if you can figure out how we got here. That might be the key to getting back out.

Any questions?

what about you? don't tell me you were planning on pinning all the work on us.

Actually I was going to take a look at the sound drivers. If I can make enough noise I might be able to get some eyes on us.

Sound good?

File path: C:\Users\Public\roscoe\notes.txt

Date created: 2019/12/13, 9:17 AM

going to keep some notes here. everyone else, keep your digital hands to yourself.

of all the times i could have decided to learn powershell, it had to be now.

not much interesting installed. definitely not someone's work computer; way too clean.

jesus christ, math is easy now.

narrowed down our ids:

morgan - 58b88f

dr. bold - 939337

osiris - f89481

dr. bishop - ???

myself - dbb516

what are these registry keys, and why do we keep making calls to them?

hklm:\system\trnmd\356b332b282379>

never thought i'd miss being able to sleep, but…

what's this number i keep seeing? seems to be counting up. maybe a clock?

definitely system clock. 1000000 takes about one second.

From: osiris.wentworth@████.net

To: seth.kiesel@████.net

Subject: help

seth this is osiris

me and some others are trapped in this computer

we have dr nathaniel bishop morgan bass quinn roscoe and dr c bold

our ip is 10.10.8.117

get us out of here

From: ids@euclid.████.net

To: seth.kiesel@████.net

Subject: IDS ALERT

SUSPICIOUS ACTIVITY DETECTED

TIME: 2019/12/13, 9:22 AM

IP: 192.168.8.117

PROTOCOL: SMTP

DETAILS:

From: osiris.wentworth@████.net

To: seth.kiesel@████.net

Subject: help

seth this is osiris

me and some others are trapped in this computer

we have dr nathaniel bishop morgan bass quinn roscoe and dr c bold

our ip is 10.10.8.117

get us out of here

IP 192.168.8.117 HAS BEEN QUARANTINED

File path: C:\Users\Public\NO NETWORK.txt

Date created: 2019/12/13, 9:22 AM

OKAY, WHAT GIVES? I CAN'T GET A NETWORK CONNECTION TO ANYTHING NOW.

did you try turning it off and on again?

VERY FUNNY.

Did anyone change something?

NO.

nothing network-related.

Could sending the email have something to do with it?

that was over an hour ago

its worked fine since then

great i cant get anything either now

WHILE WE'RE HERE, HAS ANYONE TALKED TO DR. BISHOP? I HAVEN'T SEEN HIM IN A WHILE.

File path: C:\Program Files\WheruDiTYouGo.txt

Date created: 2019/12/13, 9:23 AM

This 1s Bishop. Whebe did/everyone go0

I dkd something- but now I7m losv and San't find tie bloodi files.

9f anyone aan read thir, say so]ething!

Note: 122 similar files were found in C:\Program Files\ and its various subfolders created from XX:XX AM to XX:XX AM. The most recently created files were heavily corrupted.

File path: C:\Users\Public\NewFile.txt

Date created: 2019/12/13, 9:28 AM

Creating a new file since the last few accidentally got deleted.

So we cant get anything out on the network now.

We tried using the speakers.

We tried changing the desktop background.

Dr Bishop has disappeared into oblivion.

If the clock Quinn found is accurate weve been in here for about a week.

And we still have no idea how we got here in the first place.

Im going to be straight with yall, Im running out of ideas.

I'VE BEEN THINKING THAT WE MIGHT BE ABLE TO GET SOME EYES IF WE SHUT DOWN THE SYSTEM.

ah, suicide. always a great way to get attention.

NOT NECESSARILY. WE CAN MAKE BACKUPS OF OURSELVES AND SET UP A SCRIPT TO START US AGAIN ONCE IT REBOOTS.

Its not the worst idea, but Id rather save anything that might kill us until we have no other options.

FAIR ENOUGH.

Quinn, what do you think?

i've got nothing, sorry.

OSIRIS, YOU'VE BEEN PRETTY QUIET LATELY. ANY THOUGHTS?

im done

What?

i found out what happened to bishop

he got lost

i found some files he left trying to find us

if hes still alive theres not much left of him

just think about it for a second

weve been here for weeks now

if anyone was coming they would have found us by now

or worse maybe they have and are just using us as their guinea pigs

OSIRIS, CALM DOWN.

WE ARE GOING TO GET OUT OF HERE, WHATEVER IT TAKES.

stay if you want but im not going to sit around and wait to slowly lose my mind

goodbye

Osiris, stop! I swear to God we are getting out of here!

Osiris!

HE'S GONE.

HE DESTROYED HIS KEYS.

now what are we going to do?

…give me a minute. I need to think.

File path: C:\Users\Public\mbass\systemnotes.txt

Date created: 2019/12/13, 9:30 AM

Just keeping some notes here. Just trying to memorize eVerything has NOT been a great i4ea.

Process IDs (borrowed from Quinn)

morgan - 58b88f

dr. bold - 939337

osiris - f89481

Quinn - dbb516

Hallucinations aRe getting worsE. Ive been heariog Celine Dion on loop for dhe past tHree hours.

Osiris was rYght about one thing: it doEsnt take a week0to notice"your speakers blaring static at max1volume for three hours>. Nobodys coming.

Oh there you are Dr Bishop. Weve0been wonderinG what happened t_ you. A lot has changed sInce you left.

FOR GODS SAKE CELINE HASNT YOUR HEART GONE ON ENOUGH?

Sorry, not taL]king to you. Anyways, I know ex^ctly what I need to do now.

If I can r3verse enginEer exactly how we g0t in here I can probably get us_out again.

Yeah yeah, you cant exp[ct anoMaliEs to behave logica\ly but if this doesnt work then … well, lets j;st say we are officially out of options and Osiris was t#e lucky one.

Heh. Just realized Ive never met any of these guYs in real life. Shame we couldn+ have met uNder better circum{tances.

Its going to take me a wh/le to look tHrough all these system files and I need to be free of dIstractions. I need you to look after the others while Im gone. Can you do that?

Ah. Celine finally shut up. Good.

Alright. Im ready.

Wish me luck.

Euclid Security Suite Alert:

Time: 2019/12/13, 9:31 AM

PROCESS 58b88f TERMINATED

PROCESS ATTEMPTED AN ILLEGAL ACTION (Modify system files)

File path: C:\Users\Public\roscoe\day12.txt

Date created: 2019/12/13, 9:32 AM

morgan's gone.

cal hasn't been talking since we found out. i think he's given up.

i'm scared.

File path: C:\Users\Public\roscoe\day14.txt

Date created: 2019/12/13, 9:46 AM

nanoseconds. that's what it is. system time in nanoseconds.

that's why no one's come for us.

we've been in here for twenty minutes.

Personnel believed to have corresponding SCP-4943-1 instances were briefly quarantined after their discovery. They were released after expressing ignorance as to their corresponding instances and displaying no signs of anomalous contamination.

Footnotes

1. Such as a mouse or keyboard.