CountLoader host-profiling: wallet folder checks + AV enumeration from same process

Duo Tech@duotech

•updated Aug 6, 2026•3•0•0

Detects a process performing cryptocurrency wallet/messenger folder discovery (Ledger Live, Atomic, Exodus, Guarda, KeepKey, BitBox02, Signal) combined with antivirus product enumeration (via rootSecurityCenter2, AntiVirusProduct, or WMI SELECT displayName queries) within the same host/process/time window, consistent with CountLoader host-profiling behavior.