Satendra-SR · Sep 30, 2026 · Sep 30, 2026
diff --git a/README.md b/README.md
@@ -13,5 +13,5 @@ Individual projects opt into recipes by copying or referencing them.
 | Claude Agents | [claude/agents/implementation-planner/]
 | Claude Agents | [claude/agents/quality-analyst/](https://github.com/ColoredCow/engineering-recipes/blob/main/claude/agents/quality-analyst) | Claude Code agent that generates requirement-driven test plans covering manual, functional, performance, security, accessibility, usability, and reliability test cases. Supports selective generation via `--type` flag. |(claude/agents/implementation-planner/) | Claude Code agent that creates 4-hour task breakdown implementation plans from feature requirements and posts them to GitHub issues |
 | Claude Agents | [claude/agents/](claude/agents/) | Claude Code agents for requirement refinement, implementation planning, and plan execution |
-| Security | [malware-scan/](malware-scan/) | Static scanner, reusable CI workflow and local sweep for hidden-payload malware in repos (never executes scanned code) |
+| Security | [malware-scan/](malware-scan/) | Static scanner, reusable CI workflow and local sweep for hidden-payload malware in repos, plus a whole-system Windows laptop check for non-technical users (never executes scanned code) |
 | Claude Skills | [claude/skills/](claude/skills/) | Companion skills that guarantee correct agent invocation and show live task progress in the terminal |
diff --git a/malware-scan/README.md b/malware-scan/README.md
@@ -13,6 +13,7 @@ objects without checking anything out.
 | [`scan_all.sh`](scan_all.sh) | Local sweep: finds every project on a machine and scans each one. |
 | [`workflow.yml`](workflow.yml) | Caller template for projects (copy into `.github/workflows/`). |
 | [`pre-commit`](pre-commit) | Optional local git hook. |
+| [`windows/`](windows/) | Whole-system, read-only check for one Windows laptop, for non-technical users. |
 | [`../.github/workflows/malware-scan.yml`](../.github/workflows/malware-scan.yml) | Reusable workflow the template calls. |
 | [`../claude/skills/cc-malware-scan/`](../claude/skills/cc-malware-scan/) | Claude Code skill wrapping the local sweep. |
 
@@ -112,6 +113,16 @@ The hook uses the scanner installed on **your machine** (`$MALWARE_SCANNER`, the
 `~/.engineering-recipes`), never a copy from the repo. It is a convenience layer only: `--no-verify`
 skips it.
 
+## 4. Windows machine check (non-technical users)
+
+When the machine to check runs Windows, or belongs to someone who can't run Python and bash (a
+designer, a content editor, a project manager), send them the [`windows/`](windows/) check instead of the
+local sweep. It reads every file on every drive, checks running processes, network connections,
+persistence, every git branch and Defender history, and writes a plain-text report for you to read.
+They download a ZIP, paste one line into PowerShell, and send back the report.
+[`windows/README.md`](windows/README.md) has the step-by-step messages to send them, what they
+will see, and how to read the report.
+
 ## If a scan flags something
 
 - **Don't** run `npm install`, `dev`, `build` or tests in that project, or open it in VS Code.

diff --git a/malware-scan/windows/ColoredCow-Laptop-Check.data.txt b/malware-scan/windows/ColoredCow-Laptop-Check.data.txt
@@ -0,0 +1,268 @@
+{
+ "about": "Indicator data for ColoredCow-Laptop-Check.ps1. Kept out of the script so antivirus script scanning does not mistake the scanner for the malware.",
+ "strong": [
+  {
+   "id": "S01",
+   "s": "rmcej%otb%"
+  },
+  {
+   "id": "S02",
+   "s": "Cot%3t=shtP"
+  },
+  {
+   "id": "S03",
+   "s": "_$_1e42"
+  },
+  {
+   "id": "S04",
+   "s": "function MDy"
+  },
+  {
+   "id": "S05",
+   "s": "global['!']"
+  },
+  {
+   "id": "S06",
+   "s": "global['_V']"
+  },
+  {
+   "id": "S07",
+   "s": "global[\"_V\"]"
+  },
+  {
+   "id": "S08",
+   "s": "2[gWfGj;<:-93Z^C"
+  },
+  {
+   "id": "S09",
+   "s": "m6:tTh^D)cBz?NM]"
+  },
+  {
+   "id": "S10",
+   "s": "TMfKQEd7TJJa5xNZJZ2Lep838vrzrs7mAP"
+  },
+  {
+   "id": "S11",
+   "s": "TXfxHUet9pJVU1BgVkBAbrES4YUc1nGzcG"
+  },
+  {
+   "id": "S12",
+   "s": "0xbe037400670fbf1c32364f762975908dc43eeb38759263e7dfcdabc76380811e"
+  },
+  {
+   "id": "S13",
+   "s": "0x3f0e5781d0855fb460661ac63257376db1941b2bb522499e4757ecb3ebd5dce3"
+  },
+  {
+   "id": "S14",
+   "s": "e9b53a7c-2342-4b15-b02d-bd8b8f6a03f9"
+  },
+  {
+   "id": "S15",
+   "s": "default-configuration.vercel.app"
+  },
+  {
+   "id": "S16",
+   "s": "vscode-settings-bootstrap.vercel.app"
+  },
+  {
+   "id": "S17",
+   "s": "vscode-settings-config.vercel.app"
+  },
+  {
+   "id": "S18",
+   "s": "vscode-bootstrapper.vercel.app"
+  },
+  {
+   "id": "S19",
+   "s": "vscode-load-config.vercel.app"
+  },
+  {
+   "id": "S20",
+   "s": "260120.vercel.app"
+  },
+  {
+   "id": "S21",
+   "s": "global['_V']='8-"
+  },
+  {
+   "id": "S22",
+   "s": "global[\"_V\"]=\"8-"
+  },
+  {
+   "id": "S23",
+   "s": "Lordplay/system-releases"
+  },
+  {
+   "id": "S24",
+   "s": "jpeek998/system-releases"
+  },
+  {
+   "id": "S25",
+   "s": "copilot-ai.whisdev.org"
+  },
+  {
+   "id": "S26",
+   "s": "-1448-du'"
+  },
+  {
+   "id": "S27",
+   "s": "-1489-du'"
+  }
+ ],
+ "badPackages": [
+  "tailwindcss-style-animate",
+  "tailwind-mainanimation",
+  "tailwind-autoanimation",
+  "tailwindcss-typography-style",
+  "tailwindcss-style-modify",
+  "polymarket-validator",
+  "changelog-logger-utilities",
+  "js-logger-pack",
+  "ts-logger-pack",
+  "terminal-logger-utils",
+  "pretty-logger-utils",
+  "pinno-loggers",
+  "node-env-resolve"
+ ],
+ "network": [
+  "default-configuration.vercel.app",
+  "vscode-settings-bootstrap.vercel.app",
+  "vscode-settings-config.vercel.app",
+  "vscode-bootstrapper.vercel.app",
+  "vscode-load-config.vercel.app",
+  "260120.vercel.app",
+  "api.trongrid.io",
+  "fullnode.mainnet.aptoslabs.com",
+  "whisdev.org",
+  "166.88.54.158",
+  "198.105.127.210",
+  "23.27.202.27",
+  "154.91.0.103",
+  "136.0.9.8",
+  "166.88.4.2",
+  "23.27.120.142",
+  "202.155.8.173",
+  "166.88.134.82",
+  "188.43.33.249",
+  "23.27.13.43",
+  "195.201.194.107"
+ ],
+ "implantNames": [
+  "MicrosoftSystem64",
+  "MicrosoftSystem64.exe",
+  "MicrosoftSystem64-win.exe",
+  "com.launchkeeper.MicrosoftSystem64"
+ ],
+ "hashes": {
+  "f2c754a7f7b56e0e2a6dd429f06c42a1860c52c37b25d0a8e91c67d1239fa577": "MicrosoftSystem64 Windows",
+  "457a3323fe0cfa82d6e102074c6f07a399f55c7e0ce2d3b40643d9cfde0cf220": "MicrosoftSystem64 macOS x64",
+  "2fec04f2985510654d9656d57f6817de1ca0d6ae49e7085b1e33abb38f89cc55": "MicrosoftSystem64 macOS arm64",
+  "b505f1d1ca3dca8cb7e2b2dd99991b5a929ec9387f3de31ad36549823af07dfd": "MicrosoftSystem64 Linux",
+  "b2954c945b51dbd6fa88ac72338b7fbf76dec7d9909ceada9d36b21330842c97": "MicrosoftSystem64 Linux 1.0.8",
+  "33401580619ae79bf3f87aab16208f169a44a038f18671b1def7836fb2682c9a": "print.cjs dropper"
+ },
+ "seaFuse": "NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2:1",
+ "binNeedles": [
+  "vercel.app",
+  "trongrid",
+  "aptoslabs",
+  "whisdev",
+  "system-releases",
+  "-du'",
+  "_$_",
+  "NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2:1",
+  "tailwindcss-style-animate",
+  "tailwind-mainanimation",
+  "tailwind-autoanimation",
+  "tailwindcss-typography-style",
+  "tailwindcss-style-modify",
+  "js-logger-pack",
+  "ts-logger-pack",
+  "MicrosoftSystem64",
+  "rmcej%otb%",
+  "Cot%3t=shtP",
+  "global['",
+  "global[\"",
+  "global.o=",
+  "global.i=",
+  "TMfKQEd7TJJa5x",
+  "TXfxHUet9pJVU1",
+  "0xbe037400670f",
+  "0x3f0e5781d085",
+  "e9b53a7c-2342",
+  "function MDy",
+  "2[gWfGj;<:-93Z^C",
+  "m6:tTh^D)cBz?NM]",
+  "temp_auto_push"
+ ],
+ "high": [
+  {
+   "id": "GLOBAL_MARKER",
+   "pre": "global",
+   "d": "campaign marker (global.o='...-du' style)",
+   "re": "global\\s*(\\.\\s*o|\\[\\s*['\"](!|_V|o|r)['\"]\\s*\\])\\s*=\\s*['\"]|global\\s*\\.\\s*i\\s*=\\s*['\"](\\d+-\\d+(-\\d+)?-du|A8-)"
+  },
+  {
+   "id": "GLOBAL_REQUIRE",
+   "pre": "global",
+   "d": "require() exported onto the global object",
+   "re": "global\\s*(\\[[^=;]{1,60}\\]|\\.\\w+)\\s*=\\s*require\\b(?!\\s*\\()"
+  },
+  {
+   "id": "OBFUSCATOR_ID",
+   "pre": "_$_",
+   "d": "obfuscator identifier (_$_ + 4 hex)",
+   "re": "_\\$_[0-9a-fA-F]{4}\\b"
+  },
+  {
+   "id": "HIDDEN_AFTER_PAD",
+   "pre": "<pad>",
+   "d": "code hidden after a long run of spaces (pushed off-screen)",
+   "re": "\\S[ \\t]{150,}(global\\s*[\\[.]|require\\s*\\(|\\beval\\s*\\(|Function\\s*\\(|fromCharCode|child_process|_\\$_[0-9a-fA-F]{4}|\\batob\\s*\\(|Buffer\\.from)"
+  }
+ ],
+ "medium": [
+  {
+   "id": "CHAR127_DECODER",
+   "pre": "fromCharCode",
+   "d": "string decoder using char 127",
+   "re": "fromCharCode\\(\\s*127\\s*\\)"
+  },
+  {
+   "id": "B64_EXEC",
+   "pre": "base64",
+   "d": "base64 payload being executed",
+   "re": "Buffer\\.from\\([^)]{0,300}['\\\"]base64['\\\"]\\)[\\s\\S]{0,300}\\b(eval|Function|exec|spawn)\\b"
+  }
+ ],
+ "rx": {
+  "marker": "global\\s*\\.\\s*[oi]\\s*=\\s*['\\\"]([^'\\\"]{1,20})['\\\"]",
+  "persist": "(curl|wget|powershell|pwsh|node|mshta|certutil|bitsadmin|wscript|cscript|rundll32|regsvr32).*(http|-enc|iex|\\.js\\b|\\.vbs\\b|javascript:)",
+  "netCmd": "(curl|wget|iwr|irm|Invoke-WebRequest|Invoke-RestMethod|base64|node\\s+-e|https?://|powershell|mshta)",
+  "tasksDl": "(curl|wget|iwr|irm|Invoke-WebRequest).{0,300}(\\||iex|bash|sh\\b|cmd)",
+  "install": "\\\"(preinstall|install|postinstall|prepare)\\\"\\s*:\\s*\\\"[^\\\"]*(curl|wget|node\\s+-e|base64|powershell|https?://)",
+  "profile": "(iex|Invoke-Expression).*(http|DownloadString)",
+  "history": "(iwr|irm|Invoke-WebRequest|Invoke-RestMethod|curl|wget|DownloadString).*(\\||iex|Invoke-Expression)|-enc(odedcommand)?\\s",
+  "service": "(powershell|cmd\\.exe /c|node\\.exe|mshta|wscript|cscript)",
+  "inline": "\\s-(e|c|p)\\s|--eval",
+  "dns": "\\.vercel\\.app$|trongrid|aptoslabs|bsc-dataseed|huggingface|whisdev"
+ },
+ "gitEre": [
+  "global[[:space:]]*\\.[[:space:]]*[oi][[:space:]]*=[[:space:]]*['\\\"]",
+  "global[[:space:]]*\\[[[:space:]]*['\\\"](!|_V|o|r)['\\\"][[:space:]]*\\][[:space:]]*=",
+  "_\\$_[0-9a-fA-F]{4}"
+ ],
+ "credPaths": [
+  ".ssh",
+  ".aws\\credentials",
+  ".docker\\config.json",
+  ".kube\\config",
+  "_netrc",
+  ".netrc",
+  ".git-credentials",
+  ".config\\gh\\hosts.yml",
+  "AppData\\Roaming\\GitHub CLI\\hosts.yml",
+  "AppData\\Roaming\\GitHub Desktop"
+ ]
+}