Suspicious Access to Cryptocurrency Wallet Files

sequence by process.entity_id with maxspan=30s
[file where event.type == "access" and process.pid != 4 and
   file.path :
      ("*\\ElectronCash\\wallets*",
       "*\\Electrum-LTC\\wallets*",
       "*\\Electrum\\wallets*",
       "*\\Ethereum\\keystore*",
       "*\\Exodus\\exodus.wallet*",
       "*\\Bitcoin\\wallets*",
       "*\\Coinomi\\wallets*",
       "*\\Appdata\\Roaming\\Raven\\*wallet*",
       "*\\DaedalusMainnet\\wallets*",
       "*\\Blockstream\\Green\\wallets*",
       "*\\MultiDoge\\multidoge.wallet*",
       "*\\WalletWasabi\\Client\\Wallets*",
       "*\\com.liberty.jaxx\\IndexedDB\\file__0.indexeddb.leveldb",
       "*\\Appdata\\Roaming\\atomic\\LocalStorage\\leveldb*",
       "*AppData\\Roaming\\Guarda\\LocalStorage\\leveldb*",
       "*fhbohimaelbohpjbbldcngcnapndodjp*",
       "*aeachknmefphepccionboohckonoeemg*",
       "*hnfanknocfeofbddgcijnmhnfnkdnaad*",
       "*hifafgmccdpekplomjjkcfgodnhcellj*",
       "*nkbihfbeogaeaoehlefnkodbefgpgknn*",
       "*ejbalbakoplchlghecdalmeeeajnimhm*",
       "*bfnaelmomeimhlpmgjnjophhpkkoljpa*",
       "*fnjhmkhhmkbjkkabndcnnogagogbneec*",
       "ibnejdfjmmkpcnlpebklmnkoeoihofec*",
       "*klfhbdnlcfcaccoakhceodhldjojboga*",
       "*aanjhgiamnacdfnlfnmgehjikagdbafd*",
       "*bblmcdckkhkhfhhpfcchlpalebmonecp*",
       "*hpglfhgfnhbgpjdenjgmdgoeiappafln*",
       "*afbcbjpbpfadlkmhmclhkeeodmamcflc*",
       "*kncchdigobghenbbaddojjnnaogfppfj*") and
    not process.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe", "?:\\Windows\\explorer.exe") and
    not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
    not (process.executable : "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe" and
         process.code_signature.subject_name : "Microsoft *" and process.code_signature.trusted == true) and
    not (process.code_signature.subject_name in ("Exodus Movement Inc", "Exodus Movement, Inc.") and process.code_signature.trusted == true and
         file.path : "?:\\Users\\*\\Exodus\\exodus.wallet*")
    ] as event0
[file where event.type == "access" and process.pid != 4 and
   file.path :
      ("*\\ElectronCash\\wallets*",
       "*\\Electrum-LTC\\wallets*",
       "*\\Electrum\\wallets*",
       "*\\Ethereum\\keystore*",
       "*\\Exodus\\exodus.wallet*",
       "*\\Bitcoin\\wallets*",
       "*\\Coinomi\\wallets*",
       "*\\Appdata\\Roaming\\Raven\\*wallet*",
       "*\\DaedalusMainnet\\wallets*",
       "*\\Blockstream\\Green\\wallets*",
       "*\\MultiDoge\\multidoge.wallet*",
       "*\\WalletWasabi\\Client\\Wallets*",
       "*\\com.liberty.jaxx\\IndexedDB\\file__0.indexeddb.leveldb",
       "*\\Appdata\\Roaming\\atomic\\LocalStorage\\leveldb*",
       "*AppData\\Roaming\\Guarda\\LocalStorage\\leveldb*",
       "*fhbohimaelbohpjbbldcngcnapndodjp*",
       "*aeachknmefphepccionboohckonoeemg*",
       "*hnfanknocfeofbddgcijnmhnfnkdnaad*",
       "*hifafgmccdpekplomjjkcfgodnhcellj*",
       "*nkbihfbeogaeaoehlefnkodbefgpgknn*",
       "*ejbalbakoplchlghecdalmeeeajnimhm*",
       "*bfnaelmomeimhlpmgjnjophhpkkoljpa*",
       "*fnjhmkhhmkbjkkabndcnnogagogbneec*",
       "ibnejdfjmmkpcnlpebklmnkoeoihofec*",
       "*klfhbdnlcfcaccoakhceodhldjojboga*",
       "*aanjhgiamnacdfnlfnmgehjikagdbafd*",
       "*bblmcdckkhkhfhhpfcchlpalebmonecp*",
       "*hpglfhgfnhbgpjdenjgmdgoeiappafln*",
       "*afbcbjpbpfadlkmhmclhkeeodmamcflc*",
       "*kncchdigobghenbbaddojjnnaogfppfj*") and
    not process.executable : ("?:\\Program Files (x86)\\*.exe", "?:\\Program Files\\*.exe") and
    not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and file.name != event0.file.name]