2/4943 LEVEL 2/4943
CLASSIFIED

Item #: SCP-4943

SAFE

Special Containment Procedures: Microsoft Corporation has issued a patch to remove SCP-4943 from all Windows 10 machines. MTF Sigma-5 ("'; DROP TABLE taskforces --") is responsible for monitoring and suppressing discussion of SCP-4943 in online forums.
Description: SCP-4943 is a patch for Windows 10 operating system pushed by the Windows Update Service on December 13, 2019. Microsoft Corporation has claimed no involvement in its development; further investigation indicated that the patch had been issued by an unknown third party that had compromised Microsoft's internal network.
SCP-4943-1 is a type of service process created when a user makes physical contact with a machine running SCP-4943 or a connected peripheral device1. This has not been observed to affect the user in question. SCP-4943-1 instances display signs of sentience and identify themselves as the user corresponding to their creation. While the mechanisms behind these processes are not yet fully understood, they appear to be dependent on a series of registry keys initialized during their creation; deleting or editing these keys consistently causes the corresponding instance to terminate. Instances are run under the LocalService account and have been observed creating and editing files to communicate.
SCP-4943-1 instances are highly unstable; 71% of instances used in testing crashed due to a fatal error within 6 hours of runtime.
Addendum: SCP-4943 was discovered after the Site-██ IT department was alerted to suspicious network traffic originating from a system in the Site-██ cafeteria used to order breakfast sandwiches. Logs indicate that SCP-4943 had been automatically installed on the machine earlier that day. While logs indicate up to 76 SCP-4943-1 processes had been present on the machine, no active instances were detected at the time of investigation.
The following are a series of files and logs recovered from that system.

File path: C:\Users\Default\fdsowhfdssujjluyes\lelhdfojsaaoehdf.hme
Date created: 2019/12/13, 9:02 AM

ÚB‘}jmùM5ó¥å<=¹K¾K÷aÇNE­ÅôÉ]ÂRú`ë¡Úo²ÅòÅ"{³ gy
¬;}Ïë>ôH ¨7Òs³·]á½µEAÒX Ík$#BÂÔjò³6ä´¯@üð¾ÝìHðèÅù:Õ/Óºáq²ÜÏ
]ççü5_Q£`ºkÜàKgH;äYçj
N_Qü=¨©l¼ø´È\ÙS#ËçÃ·_ÚñÏ[ÏbDR>V6Ä;!Tùºyíx·ÕJÏá¤.FºÆ1&¨}±
Æy6Ca{}
çÎ)leµäBw´@.ÛÁQ¾®wöE?l.ñª>Ïu<M@¦µPm'¡Êèi;Ð*ÜÉONndîµ.VÎ-kyn"¹£ÛÇéGJ¦¼ýLÎwh
wxºßV(Jä=vwhhÕRÕ»-4
ªÇW·nAÕ8wïß'|fæ}ô
¬¹Çþl0ÃÅ´^#4gwhhhhæAWOq&8®Sµô(ä§¦äÉ2)ôDN´u8ÿ"øl¶þðÈýÆæ£KXøÝ4
`TkµR¿·N(íEq`ÀÖbwhhhh.Fw«»>
½ý8G4_ÁfO]IUö16°fú¼5ÑÏB×®L(¯7whJNò\ý<úrÜ[ÿXÐ;õ8ùa/Ô¥#whhhhhhhhhhhhhhhhhhwhhhhhhh
whwhhwhhwhheUwheeereeamiihiiiiiiiiiiyiiiii
whawhaiisthisqssSs
whatisthis
wheredeveryonego
benwhereareyou
icanhearyoubutICANTseeyou
staycalm
justbreathe
ÊItÛôBYæÑÀHºÁ?ï
tëBR©òp*ò(ÖXQESß6VSB½ùn>õ]éÅ@
icantbreathe
havetofindawayoutofhere
stillcantsee
wait
whatarethoselights
WHOtouchedme
no
NO
GETAWAYFROMME
GETMEOUTOFHEEU5E$R| ÈÑÓVñ!Æ¦·Emä·~ú©}h

Note: Edit lock terminated. The parent process encountered a fatal error.

File path: C:\Users\Public\IS ANYONE THERE
Date created: 2019/12/13, 9:16 AM

THIS IS SCP FOUNDATION RESEARCHER DR. C. BOLD.
I'VE BEEN TRAPPED HERE FOR SEVERAL HOURS.
I CAN'T SEE OR HEAR ANYTHING.
IF YOU CAN HEAR ME GIVE ME A SIGN!
This is Morgan Bass, containment engineer. I can see you. Not sure how though. Im touching something I think.
my name is osiris wentworth
im with foundation hr
FINALLY, SOMEONE!
DO YOU KNOW WHAT'S GOING ON?
looks like we're writing something here. i can see what we've written before.
i'm quinn roscoe. investigations department.
I'm0Dr> Natxaniel Bishop.
=y first guuss0it that&thjs iu s_me s_rt of exuradimemsional space< but that foesn't eyplain why!our senses#are gone.

UH, ARE YOU ALRIGHT DR. BISHOP?
Of course, wky do you aSk?
NEVERMIND.
What can everyone see?
Or sense, I guess.
what does hlkm:\\system mean?
IN WHAT CONTEXT?
it's hard to explain. it's something i can see, if you can call it that. some others too, like c:\\users\public and a few others.
thats a windows file path
i dont know why you would be seeing that
WAIT.
I CAN SEE IT TOO.
You meao to tell mU we're al\ trapped im a computer?0How does txat even/work?
we work with anomalies for a living
it shouldnt work at all but here we are
SO NOW WHAT ARE WE GOING TO DO?
What kind of computer experience do yall have?
NOT MUCH, SORRY.
just enough to do my job
I don^t havu much eithur.
so i'm stuck in a computer with a bunch of people who know nothing about computers. very comforting.
Give me a second. I need to wrap my head around this.
Okay. Ive got an idea but Im going to need everyones help.
Dr. Bishop and Osiris, see if you can figure out how to send data over the network. If you can, try to get an email out letting someone know were here. I dont care who, anyone who might read it.
any idea how we would do that
Not really. We're all shooting in the dark here. Figure it out.
Dr Bold, come up with a way to communicate once we get help. Maybe a file on the desktop or someplace obvious.
YOU GOT IT MORGAN. AND YOU CAN CALL ME CAL.
Cal it is.
Quinn, you said you were with investigations right? Poke around and see if you can figure out how we got here. That might be the key to getting back out.
Any questions?
what about you? don't tell me you were planning on pinning all the work on us.
Actually I was going to take a look at the sound drivers. If I can make enough noise I might be able to get some eyes on us.
Sound good?

File path: C:\Users\Public\roscoe\notes.txt
Date created: 2019/12/13, 9:17 AM

going to keep some notes here. everyone else, keep your digital hands to yourself.
of all the times i could have decided to learn powershell, it had to be now.
not much interesting installed. definitely not someone's work computer; way too clean.
jesus christ, math is easy now.
narrowed down our ids:
morgan - 58b88f
dr. bold - 939337
osiris - f89481
dr. bishop - ???
myself - dbb516
what are these registry keys, and why do we keep making calls to them?
hklm:\system\trnmd\356b332b282379>
never thought i'd miss being able to sleep, but…
what's this number i keep seeing? seems to be counting up. maybe a clock?
definitely system clock. 1000000 takes about one second.

From: osiris.wentworth@████.net
To: seth.kiesel@████.net
Subject: help

seth this is osiris
me and some others are trapped in this computer
we have dr nathaniel bishop morgan bass quinn roscoe and dr c bold
our ip is 10.10.8.117
get us out of here

From: ids@euclid.████.net
To: seth.kiesel@████.net
Subject: IDS ALERT

SUSPICIOUS ACTIVITY DETECTED
TIME: 2019/12/13, 9:22 AM
IP: 192.168.8.117
PROTOCOL: SMTP
DETAILS:

From: osiris.wentworth@████.net
To: seth.kiesel@████.net
Subject: help

seth this is osiris
me and some others are trapped in this computer
we have dr nathaniel bishop morgan bass quinn roscoe and dr c bold
our ip is 10.10.8.117
get us out of here

IP 192.168.8.117 HAS BEEN QUARANTINED

File path: C:\Users\Public\NO NETWORK.txt
Date created: 2019/12/13, 9:22 AM

OKAY, WHAT GIVES? I CAN'T GET A NETWORK CONNECTION TO ANYTHING NOW.
did you try turning it off and on again?
VERY FUNNY.
Did anyone change something?
NO.
nothing network-related.
Could sending the email have something to do with it?
that was over an hour ago
its worked fine since then
great i cant get anything either now
WHILE WE'RE HERE, HAS ANYONE TALKED TO DR. BISHOP? I HAVEN'T SEEN HIM IN A WHILE.

File path: C:\Program Files\WheruDiTYouGo.txt
Date created: 2019/12/13, 9:23 AM

This 1s Bishop. Whebe did/everyone go0
I dkd something- but now I7m losv and San't find tie bloodi files.
9f anyone aan read thir, say so]ething!

Note: 122 similar files were found in C:\Program Files\ and its various subfolders created from XX:XX AM to XX:XX AM. The most recently created files were heavily corrupted.

File path: C:\Users\Public\NewFile.txt
Date created: 2019/12/13, 9:28 AM

Creating a new file since the last few accidentally got deleted.
So we cant get anything out on the network now.
We tried using the speakers.
We tried changing the desktop background.
Dr Bishop has disappeared into oblivion.
If the clock Quinn found is accurate weve been in here for about a week.
And we still have no idea how we got here in the first place.
Im going to be straight with yall, Im running out of ideas.
I'VE BEEN THINKING THAT WE MIGHT BE ABLE TO GET SOME EYES IF WE SHUT DOWN THE SYSTEM.
ah, suicide. always a great way to get attention.
NOT NECESSARILY. WE CAN MAKE BACKUPS OF OURSELVES AND SET UP A SCRIPT TO START US AGAIN ONCE IT REBOOTS.
Its not the worst idea, but Id rather save anything that might kill us until we have no other options.
FAIR ENOUGH.
Quinn, what do you think?
i've got nothing, sorry.
OSIRIS, YOU'VE BEEN PRETTY QUIET LATELY. ANY THOUGHTS?
im done
What?
i found out what happened to bishop
he got lost
i found some files he left trying to find us
if hes still alive theres not much left of him
just think about it for a second
weve been here for weeks now
if anyone was coming they would have found us by now
or worse maybe they have and are just using us as their guinea pigs
OSIRIS, CALM DOWN.
WE ARE GOING TO GET OUT OF HERE, WHATEVER IT TAKES.
stay if you want but im not going to sit around and wait to slowly lose my mind
goodbye
Osiris, stop! I swear to God we are getting out of here!
Osiris!
HE'S GONE.
HE DESTROYED HIS KEYS.
now what are we going to do?
…give me a minute. I need to think.

File path: C:\Users\Public\mbass\systemnotes.txt
Date created: 2019/12/13, 9:30 AM

Just keeping some notes here. Just trying to memorize eVerything has NOT been a great i4ea.
Process IDs (borrowed from Quinn)
morgan - 58b88f
dr. bold - 939337
osiris - f89481
Quinn - dbb516
Hallucinations aRe getting worsE. Ive been heariog Celine Dion on loop for dhe past tHree hours.
Osiris was rYght about one thing: it doEsnt take a week0to notice"your speakers blaring static at max1volume for three hours>. Nobodys coming.
Oh there you are Dr Bishop. Weve0been wonderinG what happened t_ you. A lot has changed sInce you left.
FOR GODS SAKE CELINE HASNT YOUR HEART GONE ON ENOUGH?
Sorry, not taL]king to you. Anyways, I know ex^ctly what I need to do now.
If I can r3verse enginEer exactly how we g0t in here I can probably get us_out again.
Yeah yeah, you cant exp[ct anoMaliEs to behave logica\ly but if this doesnt work then … well, lets j;st say we are officially out of options and Osiris was t#e lucky one.
Heh. Just realized Ive never met any of these guYs in real life. Shame we couldn+ have met uNder better circum{tances.
Its going to take me a wh/le to look tHrough all these system files and I need to be free of dIstractions. I need you to look after the others while Im gone. Can you do that?
Ah. Celine finally shut up. Good.
Alright. Im ready.
Wish me luck.

Euclid Security Suite Alert:
Time: 2019/12/13, 9:31 AM

PROCESS 58b88f TERMINATED
PROCESS ATTEMPTED AN ILLEGAL ACTION (Modify system files)

File path: C:\Users\Public\roscoe\day12.txt
Date created: 2019/12/13, 9:32 AM

morgan's gone.
cal hasn't been talking since we found out. i think he's given up.
i'm scared.

File path: C:\Users\Public\roscoe\day14.txt
Date created: 2019/12/13, 9:46 AM

nanoseconds. that's what it is. system time in nanoseconds.
that's why no one's come for us.
we've been in here for twenty minutes.

Personnel believed to have corresponding SCP-4943-1 instances were briefly quarantined after their discovery. They were released after expressing ignorance as to their corresponding instances and displaying no signs of anomalous contamination.

Footnotes
1. Such as a mouse or keyboard.

« SCP-4942 | SCP-4943 | SCP-4944 »