After this step, the stealer scans the host’s Downloads, Documents, and Desktop folders to locate 2FA recovery lists, password text files, Discord tokens, Paypal account info, and more.