Hi Rob,
After combine some clue i think they can not decrypted cause hacker no need access my computer to send away BBP. I am never unlock the cold wallet, if send or start SANC wallet prompt the passphrase (as my remmber this still not unlock permanent the wallet ) and the character still * when i typing. So the last maybe got keylogger.