GO TO DOXBIN.COM FOR THE FULL PASTE: ══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════ 👑 CENTRAL SIGNAL OF INTELLIGENCE 👑 ══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════ !! Snowy Maintains A False Persona Of Invulnerability From Behind His Screen, Openly Having an Huge Ego While Believing Himself To Be Untouchable !! !! This Illusion Has Now Been Shattered With His Complete Identity, Digital Footprint, And Entire Familial Network Compromised And Documented Below !! !! Snowy Response Then Was To Contact Law Enforcement, A Move That Only Further Demonstrates His Inability To Handle Confrontation !! ─ https://files.catbox.moe/ykwjjt.mov ─ ══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════ 🦅 TELL EM ROOT DID IT TO YOU 🦅 ══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════ ──────────────────────────────────────────────────────────────────────────────── [+] 1.0 // DIGITAL FOOTPRINT & ONLINE HANDLES ──────────────────────────────────────────────────────────────────────────────── [Primary Discord - Target] - Discord: snowyoffivem └── Name: Snowy └── ID: 1323468322632761364 └── Roblox: natedog194407 〰️ [Discord Token] - Token: MTMyMzQ2ODMyMjYzMjc2MTM2NA.GdmpJC.9ar159_Rc3iu_XqUSjVbViGym_z84sc6MkdH7o - Account: snowyoffivem (ID: 1323468322632761364) 〰️ [Old Main Discord - Target] - Discord: snowy.cfx └── Name: Snowy └── ID: 982654623439532102 〰️ [Alt Discord - Target] - Discord: whiskers.cfx └── Name: Vxmp └── ID: 1327436533032030261 〰️ [Gaming Profiles] - Steam: ! ZeroTwo ! └── Steam ID: 11000014cb408e2 └── Visibility: Public - Roblox: IndianMaleFiguref └── @IndianMaleFiguref └── ID: 8709654516 └── Created: June 18, 2025 - Minecraft: xXIISnowyIIXx └── Xbox ID: 2535449956778157 └── Profile ID: 35f39a9e897f4c92981c7fa1d3885eb2 └── Account Type: Xbox 〰️ [Content Platforms] - Medal.tv: meannasa └── ID: 347180038 └── Created: 2025-02-09 └── Discord: snowyoffivem 〰️ [Social Media Platforms] - Snapchat: isnowyl ──────────────────────────────────────────────────────────────────────────────── [+] 2.0 // CORE IDENTITY & PERSONAL PROFILE ──────────────────────────────────────────────────────────────────────────────── [Target Information] - Name: Matthew Witt - Age: 16 └── DOB: (08/03/2009) - Location: 119 Arkansas Ln, Delano, TN 37325 - Main Phone: (423) 951-6196 - Previous Phone: (318) 414-0306 - Device: Google Pixel 7a - Windows Username: mtele 〰️ [Additional Addresses] - Address: 1808 Parkwood lane, Apt 1, Johnson City, TN 37604 ──────────────────────────────────────────────────────────────────────────────── [+] 3.0 // ASSOCIATES & RELATIONSHIPS ──────────────────────────────────────────────────────────────────────────────── [Girlfriend] - Full Name: Kaydence Halford - Age: 16 └── DOB: (10/02/2009) - Social Security No.: 662-20-6579 - Location: 76 Bodies Landing Rd, Pollock, LA 71467 - Contact: └── Phone: (318) 827-4654 └── Email: 2009.kaydence@gmail.com - Education: └── School: Grant High School | 17779 US-167, Dry Prong, LA 71423 └── Status: Did Not Graduate └── Subjects: English, Algebra, Biology, Chemistry - Employment: └── Position Desired: Stock / Pizza └── Currently Employed: No └── Start Date: 11-03-25 └── Referred By: DeAnne Whately - Digital Presence: └── Discord: x.k3y09 └── Display Name: Lumi └── ID: 973058371886415974 └── Roblox: NxMEHERE 〰️ [Family Members] - Name: Steve Witt └── Relation: Property Owner (119 Arkansas Ln, Delano, TN 37325) - Name: Telena Martin └── Birthdate: 10/20/1985 └── Phone: (423) 292-4703 └── Address: 1808 Parkwood lane, Apt 1, Johnson City, TN 37604 └── Email: telenas.newsandviews@yahoo.com └── Email: mtelena1900xxoo@yahoo.com └── Email: witttelenamar2025@yahoo.com └── Email: books4ever2020@yahoo.com └── Email: martintelena@yahoo.com ──────────────────────────────────────────────────────────────────────────────── [+] 4.0 // PROPERTY & ASSET RECORDS ──────────────────────────────────────────────────────────────────────────────── [Target Property - Family] - Address: 119 Arkansas Ln, Delano, TN 37325 - Owner: WITT STEVE E & MYRTLE WITT LE - Parcel ID: 003M A 02900 - Property Type: Residential - Land Size: 0.26 Acres - Property Photo: https://ibb.co/Jjcx6xMx 〰️ [Property Valuation] - Total Market Value: $59,100 - Improvement Value: $46,100 - Land Value: $13,000 - Assessment Percentage: 25% 〰️ [Property Details] - Structures: 1 - Year Built: 1900 - Building Area: 720 Sq Ft (Living Area) - Number of Baths: 1 - Number of Stories: 1 - School District: Polk County School District - Coordinates: 35.263369, -84.556649 - County: Polk County, TN 〰️ [Legal & Administrative Data] - Mailing Address: 1808 PARKWOOD LN, Apt 1, Johnson City, TN 37604 - Last Sale Price: $0.00 - Last Sale Date: 2023-04-20 - Subdivision: ROUND THE CLOCK S/D - Plat Book: 2, Page 80 〰️ [Census & Geographic Data] - Census 2020 Block: 471399502011032 - Census 2020 Blockgroup: 471399502011 - Census 2020 Tract: 47139950201 - Census Zip Code: 37325 〰️ [Additional Identifiers] - Regrid UUID: 5daccb9a-f01e-4058-8d57-6afdc68733c2 - County-Provided Acres: 0.264156 - Federal Qualified Opportunity Zone: No ──────────────────────────────────────────────────────────────────────────────── [+] 5.0 // VISUAL MEDIA & EVIDENCE ──────────────────────────────────────────────────────────────────────────────── [Target Videos] - File: Snowy Showing Peenar.mov └── URL: https://files.catbox.moe/3xo8gy.mov - File: Snowy Showing Peenar2.mov └── URL: https://files.catbox.moe/pti14w.mov - File: Snowy Just Shit.mp4 └── URL: https://files.catbox.moe/g2rf1v.mp4 - File: Snow The Ped.mp4 └── URL: https://files.catbox.moe/8j7bkb.mp4 - File: Snowy Cutting Him Self Over Me.mp4 └── URL: https://files.catbox.moe/9jxmjx.mp4 〰️ [Target Pictures] - File: Snowy.gif └── URL: https://files.catbox.moe/9fmdno.gif - File: Snowy.png └── URL: https://files.catbox.moe/nqv52m.png - File: Snowy2.png └── URL: https://files.catbox.moe/gp53qs.png - File: Snowy3.png └── URL: https://files.catbox.moe/2ahkl5.png - File: Snowy4.webp └── URL: https://files.catbox.moe/5craxa.webp - File: Snowy Likes CP.webp └── URL: https://files.catbox.moe/sw8dv2.webp 〰️ [Girlfriend Pictures] - File: Girlfriend.png └── URL: https://files.catbox.moe/l1wf75.png - File: Girlfriend2.png └── URL: https://files.catbox.moe/h0b2ee.png - File: Girlfriend3.png └── URL: https://files.catbox.moe/4xgzcs.png - File: Girlfriend4.png └── URL: https://files.catbox.moe/63m4wi.png - File: Girlfriend5.png └── URL: https://files.catbox.moe/kvm17h.png 〰️ [Girlfriend Videos] - File: Girlfriend Stroking It Ew.mp4 └── URL: https://files.catbox.moe/vlpyit.mp4 〰️ [Family Photographs] - File: Relative.webp └── URL: https://files.catbox.moe/adec1w.webp - File: Relative2.webp └── URL: https://files.catbox.moe/ttsjch.webp - File: Relative3.webp └── URL: https://files.catbox.moe/qa2ecp.webp - File: Relative4.webp └── URL: https://files.catbox.moe/cc27mg.webp - File: Relative5.webp └── URL: https://files.catbox.moe/lerqbk.webp - File: Relative6.webp └── URL: https://files.catbox.moe/kfov7d.webp - File: Relative7.webp └── URL: https://files.catbox.moe/wfglq6.webp - File: Relative8.webp └── URL: https://files.catbox.moe/z6jp7h.webp - File: Relative9.webp └── URL: https://files.catbox.moe/expfl3.webp - File: Relative10.webp └── URL: https://files.catbox.moe/9nltmw.webp - File: Relative11.webp └── URL: https://files.catbox.moe/f0yjfs.webp - File: Relative12.webp └── URL: https://files.catbox.moe/xzevg8.webp - File: Relative13.webp └── URL: https://files.catbox.moe/dg3owg.webp - File: Relative14.webp └── URL: https://files.catbox.moe/aoppry.webp - File: Relative15.webp └── URL: https://files.catbox.moe/a6ulje.webp - File: Relative16.webp └── URL: https://files.catbox.moe/f1lccu.webp - File: Relative17.webp └── URL: https://files.catbox.moe/7puwag.webp - File: Relative18.webp └── URL: https://files.catbox.moe/n12ooy.webp - File: Relative19.webp └── URL: https://files.catbox.moe/yyqtpm.webp - File: Relative20.webp └── URL: https://files.catbox.moe/b15o8r.webp - File: Relative21.webp └── URL: https://files.catbox.moe/rdk0tj.webp - File: Relative22.webp └── URL: https://files.catbox.moe/970fkk.webp - File: Relative23.webp └── URL: https://files.catbox.moe/vro7ov.webp - File: Relative24.webp └── URL: https://files.catbox.moe/fxzjti.webp - File: Relative25.webp └── URL: https://files.catbox.moe/vt2xqj.webp - File: Relative26.webp └── URL: https://files.catbox.moe/xzevg8.webp - File: Relative27.webp └── URL: https://files.catbox.moe/9nltmw.webp - File: Relative28.webp └── URL: https://files.catbox.moe/7djoe0.webp - File: Relative29.webp └── URL: https://files.catbox.moe/c5igup.webp ──────────────────────────────────────────────────────────────────────────────── [+] 6.0 // NETWORK & INFRASTRUCTURE ──────────────────────────────────────────────────────────────────────────────── [IP Geolocation - T-Mobile Connection] - IP Address: 172.56.71.101 - ISP: T-Mobile USA, Inc. - Location: Atlanta, Georgia 30329, United States - Coordinates: 33.8231, -84.3258 - Mobile Connection: Yes - Proxy/VPN: No 〰️ [WiFi Network Credentials] - Network: TMOBILE-58FE └── Password: fcxtrsnb845 - Network: BrightRidge-1 └── Password: Bimmer320 ──────────────────────────────────────────────────────────────────────────────── [+] 7.0 // COMPROMISED DATA & CREDENTIALS ──────────────────────────────────────────────────────────────────────────────── [Discord Moderation History] - Case 1: └── User: snowyoffivem (ID: 1323468322632761364) └── Category: NON_CONSENSUAL_BEHAVIOUR └── Decision: INCOMPATIBLE_CONTENT └── Automated Detection: No └── Timestamp: June 16, 2025 - Case 2: └── User: snowy.cfx (ID: 982654623439532102) └── Category: NON_CONSENSUAL_BEHAVIOUR └── Decision: INCOMPATIBLE_CONTENT └── Automated Detection: No └── Timestamp: 2025-05-19 - Case 3: └── User: snowy.cfx (ID: 982654623439532102) └── Category: NON_CONSENSUAL_BEHAVIOUR └── Decision: INCOMPATIBLE_CONTENT └── Automated Detection: No └── Timestamp: 2025-05-11 - Case 4: └── User: snowy.cfx (ID: 982654623439532102) └── Category: NON_CONSENSUAL_BEHAVIOUR └── Decision: INCOMPATIBLE_CONTENT └── Automated Detection: No └── Timestamp: 2025-05-19 〰️ [Additional Platform Data] - FiveM Account (fivem.net): └── User ID: 202026272 └── Username: Gae4Ava └── Display Name: Gae4Ava └── Created: 2023-10-10T22:21:26 └── License Key: b1b965e9b57439cdbd73eb6fd0e81d095890585a └── Connected Discord: snowy.cfx (ID: 982654623439532102) - Medal.tv Account: └── Connected Discord: snowy.cfx (ID: 982654623439532102) - Doxbin Username: xSnowBallx - [MAIN ACCOUNT] └── Email Connected: blockt287@gmail.com └── UID: 593360 └── Created: Oct 23, 2025 └── Upgrades: None - Doxbin Username: hawerh └── Email Connected: blockt287@gmail.com └── UID: 469118 └── Created: Jul 6, 2024 └── Upgrades: None - Riot Games Account: └── Username: HeyHeyuimeanu └── Password: Matthew2010$ 〰️ [Financial & Subscription History] - Service: fivem-lsm.com Pro Account (1 month) - Amount: $2.59 USD - Payment Method: PayPal - Date: December 19, 2023 〰️ [Main Email Account] - Email: blockt287@gmail.com - Password: Matthew2010$ - Status: Active - Platforms: Registered on 15 platforms - Services: spotify.com, replit.com, office365.com, discord.com, launcherleaks.com, auth0.openai.com, forum.cfx.re, account.venmo.com, panel.rocketnode.com, mega.nz, sso.crunchyroll.com, login.aliexpress.com, www.fivem-lsm.com, accounts.google.com, www.paypal.com, www.roblox.com 〰️ [Main Password - Reused] - Password: Matthew2010$ - Hashed (MD5): c8659034048ea8e593fcae7e778aefbf - Hashed (SHA1): 9fc9ea369ac8be517d0ec892ee3680ab7684d545 - Hashed (SHA256): ea4368440f93b50afd1e0f975960ffe4a7418a0c0bc218a7a5fdc1b6eaa778a6 - Hashed (SHA512): b7e065706e28bd45c08ebf06d449fc0075e4129e951fda586d308393c7828f22f1756d85b12cdb3630e2c9ad2029da92ec1f62f99b34456b0b6a0f8152868bd4 - Base64: TWF0dGhldzIwMTAk 〰️ [Account Breaches] - Discord: blockt287@gmail.com └── Password: Matthew2010$ └── URL: discord.com/channels/1077656769775546459 - LauncherLeaks: blockt287@gmail.com └── Password: Matthew2010$ └── URL: launcherleaks.com/login/ - OpenAI: blockt287@gmail.com └── Password: Matthew2010$ └── URL: auth0.openai.com - FiveM Forum: blockt287@gmail.com └── Password: Matthew2010$ └── URL: forum.cfx.re/categories - Venmo: blockt287@gmail.com └── Password: Matthew2010$ └── URL: account.venmo.com/signup - RocketNode: blockt287@gmail.com └── Password: Matthew2010$ └── URL: panel.rocketnode.com - MEGA: blockt287@gmail.com └── Password: Matthew2010$ └── URL: mega.nz - Crunchyroll: blockt287@gmail.com └── Password: Matthew2010$ └── URL: sso.crunchyroll.com/register - AliExpress: blockt287@gmail.com └── Password: Matthew2010$ └── URL: login.aliexpress.com/ - FiveM-LSM: blockt287@gmail.com └── Password: Matthew2010$ └── URL: www.fivem-lsm.com/login/ - Google: blockt287@gmail.com └── Password: Matthew2010$ └── URL: accounts.google.com - PayPal: blockt287@gmail.com └── Password: Matthew2010$ └── URL: www.paypal.com/signin - Roblox: natedog194407 └── Password: Matthew2010$ └── URL: https://www.roblox.com/login - Email: martintelena@yahoo.com └── Password: Matthew2010$ └── URL: loomingdales.com/registry/wedding/registrycreateaccount - Username: freece102 └── Password: Matthew2010$ └── URL: ox.com/newlogin - Email: jennifer.witt1@comcast.net └── Password: Matthew2010$ └── URL: generationgood.socialmedialink.com/members/sign_in - Username: telenam6969 └── Password: Matthew2010$ └── URL: userbenchmark.com - Email: matthewwitt2010@gmail.com └── Password: Matthew2010$ └── URL: roshade.com/pro - Email: martintelena@yahoo.com └── Password: Matthew2010$ └── URL: hometesterclub.com/us/en/Register/Register - Username: mkhgamer902 └── Password: Matthew2010$ └── URL: accounts.google.com - Phone: 4930 └── Password: Matthew2010$ └── URL: discord.com/channels/@me - Email: martintelena@yahoo.com └── Password: Matthew2010$ └── URL: club.yourbabyclub.com/entrypage/noobiebox/ - Email: magiehoyuen@gmail.com └── Password: Matthew2010$ └── URL: accounts.google.com/AddSession/identifier - Password: Matthew2010$ └── URL: maybelline.com/signup - Email: giselle110691@gmail.com └── Password: Matthew2010$ └── URL: corredores.rimac.com/login - Password: Matthew2010$ └── URL: discord.com/channels/@me/928452708577468498:Paul - Email: martintelena@yahoo.com └── Password: Matthew2010$ └── URL: watch.frndlytv.com/authenticator 〰️ [Additional Email Accounts] - Email: eyeh32916@gmail.com - Email: ihategewstbf@gmail.com - Email: tsrpnumber1@gmail.com - Email: awefagw38@gmail.com - Email: awsfasdgfwa35421@gmail.com - Email: jennifer.witt1@comcast.net - Email: bimmer320@comcast.net - Email: fleetsailor1981@yahoo.com 〰️ [Minecraft Account] - Username: xXIISnowyIIXx └── Analysis: Username follows target's "snowy" naming convention with Roman numerals (II = 2), suggesting "Snowy 2" or second iteration of identity. The "xX...Xx" format is typical of early 2000s gaming culture, indicating either older account or influence from older gaming community members. - Xbox ID: 2535449956778157 └── Analysis: Xbox Live account integration provides additional attack vector. Xbox ID can be used for account recovery, friend network mapping, and gaming history analysis. - Profile ID: 35f39a9e897f4c92981c7fa1d3885eb2 └── Analysis: Unique Minecraft profile identifier. This ID is persistent and can be used to track the account across servers, platforms, and even if username changes. - Account Type: Xbox └── Analysis: Microsoft account integration means Minecraft account is linked to Microsoft ecosystem. Compromising Microsoft account provides access to Minecraft, Xbox Live, Office 365, OneDrive, and all Microsoft services. - Local ID: 9e596f67a604406784de636206be8d58 └── Analysis: Local device identifier. This ID is stored locally and used for offline play and local world management. - Access Token Expires: 2025-11-16T02:26:49Z └── Analysis: Active authentication token valid until November 16, 2025. This token can be used for account access without password until expiration. Token presence in local files indicates complete account compromise. - License Request ID: 7512add0-734d-4041-bc7e-e7381ed44aec └── Analysis: Unique license request identifier, useful for tracking account transactions and license purchases. - Franchise Inventory ID: 1/Mg== └── Analysis: Base64-encoded inventory identifier. Decodes to inventory management system reference. - Eligible for Free Trials: true └── Analysis: Account eligible for free trials suggests either new account or account that hasn't used all available trial periods. This indicates potential for additional service access without payment. - Has Multiple Profiles: false └── Analysis: Single profile account, simplifying account management and reducing attack surface complexity. - Legacy Account: false └── Analysis: Modern Mojang account (post-2012 migration), indicating account created or migrated after Microsoft acquisition of Mojang. This confirms account is relatively new or recently migrated. - Profile Name Change Required: false └── Analysis: Username meets current Minecraft naming requirements, no forced change needed. - Skin Change Required: false └── Analysis: Current skin is compliant with Minecraft's content policies. - License Product IDs (21 products): 9PBP71DDVCT9, 9N98Z825TNFW, 9P8MK4NC0LJB, 9P5KH0238TPW, 9MV1BF8J0TTX, 9P1XF6ZQGV3R, 9NGG3CWJMC7V, 9P5JQ1XPRGN6, 9P45BPZCP004, 9P4BFQNXLMDR, 9MV69L4JSD31, 9N5KX36SQJ9Q, 9P4HCS6S5C2K, 9NZ12RV7B7R3, 9P427LFN9KCD, 9P0WDBKKS7MK, 9N6184JJ7NSG, 9PKCNQ57B2JG, 9PB1LJZFN9XK, 9P2VR3K66TJX, 9NBLGGH2JHXJ └── Analysis: 21 licensed products indicate extensive Minecraft content purchases (DLC, marketplace content, realms, etc.). This represents significant financial investment in the game, suggesting long-term engagement and financial capability (or family financial support). Product IDs can be cross-referenced with Microsoft Store purchase history for additional financial intelligence. 〰️ [CRITICAL FINDING: MINECRAFT ACCOUNT COMPROMISE] The presence of an active access token (valid until November 2025) in local files represents complete account compromise. This token allows full account access without password, including: world access, server connections, marketplace purchases, friend network access, and account settings modification. Combined with Xbox Live integration, this provides a pathway to Microsoft account compromise through account recovery mechanisms. The 21 licensed products indicate financial investment, making account recovery/reset attempts more likely to succeed (Microsoft prioritizes accounts with purchase history). 〰️ [Additional Compromised Passwords - Edge Browser] - Total Password Entries: 1,269 - Unique Passwords Found: 129 - Unique Usernames Found: 285 - Unique Email Accounts: 65 〰️ [CRITICAL INTELLIGENCE FINDING] Password reuse analysis reveals catastrophic security failure: The password "matthew2010" has been used across 331 different platforms, while "Matthew2010$" appears on 272 sites. This represents one of the most severe credential reuse patterns observed in digital forensics. A single password breach on any of these platforms compromises the target's entire digital identity. Email domain analysis shows yahoo.com accounts (653 instances) dominate, followed by comcast.net (113) and gmail.com (113). The primary email "martintelena@yahoo.com" appears to be the most frequently used identifier, appearing in 653+ account registrations. This email alone provides a complete digital trail of the target's online activities, purchases, subscriptions, and social media presence. 〰️ - Key Passwords & Accounts: └── IMDB: Telena / 8_pA!ruu54_CTJt └── 4imprint.com: jennifer.witt1@comcast.net / matthew2010 └── valuemags.com: jennifer.witt1@comcast.net / matthew2010 └── jumpsend.com: martintelena@yahoo.com / matthew2010 └── similac.com: books4ever2020@yahoo.com / Bimmer320$ └── Discord (Alt): 9403 / Matthew2010$ └── Discord (Alt): Mochi_you_CUNT / SHnAKAaL-z9z9!a └── poise.com: bimmer320@comcast.net / Matthew2010$ └── samplesource.com: martintelena@yahoo.com / BobGoblin2023$ └── Xfinity: stevewitt119 / 119Arkln └── Library (OWL): 22488002103803 / mondo2010 └── MeWe: martintelena@yahoo.com / Homeschool18 └── Stash: martintelena@yahoo.com / BooYaaBing1900$ └── HP Login: books4ever2020@yahoo.com / BooYaaBing1900$ └── eBay (Android): martintelena@yahoo.com / BooYaaBing1900$ └── Northeast State: gmundkow / 122462 └── Kashkick: martintelena@yahoo.com / Matthew2010 └── Faire: martintelena@yahoo.com / Matthew2010$ └── Discord (Alt): 5179 / Matthew2010$ └── Adobe: jennifer.witt1@comcast.net / Matthew2010$ └── Crocs Launch: martintelena@yahoo.com / BobGoblin2022$ └── eBay Registration: jennifer.witt1@comcast.net / matthew2010 └── Google Account: matthewwitt20109@gmail.com / BooYaaBing1900$ └── Chewy: telenas.newsandviews@yahoo.com / BobGoblin2023$ └── Discord (Alt): ≡ƒÄâFestive galaxy≡ƒÄâ / Yardape2010 └── Discord (Alt): 0003 / Matthew2010$ └── Cricket Wireless: telenaw69 / Matthew2010$ └── Hulu: bimmer320@comcast.net / matthew2010 └── Wix: martintelena@yahoo.com / Matthew2010 └── Kroger: fleetsailor1981@gmail.com / bimmer320 └── WFMLive: Gmundkowsky / bimmer320 └── Hulu (Alt): matthewwitt20109@gmail.com / BooYaaBing1900$ └── Yahoo: Books4ever2020 / BobGoblin2023$ └── Product Testing USA: martintelena@yahoo.com / matthew2010 └── Books-A-Million: martintelena@yahoo.com / matthew2010 └── Hulu (Alt): martintelena@yahoo.com / Noyoudont2020 └── MetroPCS: 37604 / 348 └── DoorDash: martintelena@yahoo.com / Matthew2010 └── Spotify: 9 / Matthew2010 └── Credit Karma: martintelena@yahoo.com / matthew2010 └── Shutterfly: jennifer.witt1@comcast.net / matthew2010 └── VIPON: jennifer.witt1@comcast.net / matthew2010 └── Walgreens: martintelena@yahoo.com / Matthew2010$ └── Luminess: mtelena1900xxoo@yahoo.com / BobGoblin2023$ └── Later: martintelena@yahoo.com / Matthew2010$ └── Fraufowler: martintelena@yahoo.com / Matthew2010$2010 └── Discord (Alt): SIMP227 / Matthew2010$ └── OP Rewards: dsdddsdsdsddd / matthew2010 └── Ruru Caty: HeyHeyuimeanu / matthew2010$$12345asded └── Parler: martintelena@yahoo.com / Matthew2010$ └── Plutonium Forum: HeyHeyuimeanu / Matthew2010$ └── Lilly Lashes: martintelena@yahoo.com / Matthew2010 └── PoliceMP Forum: sadashfoqwrasf@gmail.com / i4S!jixDFpkTDr_ └── Metro by T-Mobile: (423) 292-4703 / 40224022 └── Yahoo (Alt): witttenajo1969 / BobGoblin2023$ └── Synchrony: TM / 49005191 └── PoliceMP Forum (Alt): ! ZeroITwo ! / Matthew2010$ └── Microsoft Live: fleetsailor1981@gmail.com / BadKarma1 └── Walmart: martintelena@yahoo.com / BooYaaBing1900$ └── Dillards: martintelena@yahoo.com / Matthew2010 └── State Farm: Matthew2010 / Mondo2010$ └── Pillsbury: martintelena@yahoo.com / matthew2010 └── Chewy (Alt): mtelena1900xxoo@yahoo.com / BobGoblin2023$ └── Simply Charlotte Mason: martintelena@yahoo.com / matthew2010 └── Bloggy Moms: telena6969 / matthew2010 └── Decision Logic: Badkarma1 / Bimmer320 └── HomeLife Academy: martintelena@yahoo.com / Matthew2010 └── Urban Decay: telenas.newsandviews@yahoo.com / matthew2010 └── Google Account (Alt): da.reyess51@gmail.com / Matthew2010$ └── Trains.com: fleetsailor1981@yahoo.com / bimmer320 └── Zoom: martintelena@yahoo.com / Matthew2010 └── Prepaid Digital: J.....1@COMCAST.NET / Matthew2010$ └── Family Dollar: martintelena@yahoo.com / BobGoblin2024$ └── Google Account (Alt): fleetsailor1981@yahoo.com / BadKarma1 └── Harlequin: mtelena1900xxoo@yahoo.com / Matthew2010 └── Amazon: rougeolyvia2017@gmail.com / matthew2010$ └── Spotify (Alt): martintelena@gmail.com / NotTodaySatan1900 └── My Priceless Foods: martintelena@yahoo.com / BobGoblin2023$ └── Twitch: aadamOnTvSUCKS3 / JourneyAndMondoAndMe2010 └── Victoria's Secret: jennifer.witt1@comcast.net / Matthew2010$ └── Twitter: martintelena@yahoo.com / BobGoblin2022 └── Energizer Go: martintelena@yahoo.com / BobGoblin2022 └── Microsoft Live (Alt): martintelena@yahoo.com / matthew2010 └── PinchMe: martintelena@yahoo.com / matthew2010 └── Cap'n Crunch: mtelena1900xxoo@yahoo.com / BobGoblin2023$ └── State Farm (Alt): Matthew2010 / Aa1Bb2Cc3mondo$ └── Urban Skin: martintelena@yahoo.com / Matthew2010 └── Snapchat: martintelena@gmail.com / matthew2010 └── The Insiders: martintelena@yahoo.com / Matthew2010$ └── Xfinity (Alt): Homewitt / Bimmer320 └── FiveM Forum: matthewwitt2010@gmail.com / mondo2010 └── XMPOW: martintelena@yahoo.com / matthew2010 └── FrndlyTV: martintelena@yahoo.com / Matthew2010$ └── He Gets Us: martintelena@yahoo.com / Matthew2010$ └── Amazon (Alt): bimmer320@comcast.net / BobGoblin2022$ └── UPS: telena6969 / Matthew2010$ └── Spotify (Alt): ayay2020@gmail.com / Matthew2010 └── Canon Fed: martintelena@yahoo.com / matthew2010 └── TeamSpeak: Anylah / Matthew2010$ └── Google Account (Alt): martintelena@gmail.com / BobGoblin2023$ └── McCormick: mtelena1900xxoo@yahoo.com / BobGoblin2023$ └── SideQuest VR: gamergod123321 / matthew2010 └── Walmart (Alt): Matthew2010 / Matthew2010 └── Sunrise Village: mtelena1900xxoo@yahoo.com / BobGoblin2023$ └── True Identity: telenam69 / BooYaaBing1900$ └── Panera: martintelena@yahoo.com / BobGoblin2023$ └── Octoly: martintelena@yahoo.com / Matthew2010$ └── Mesh01: telenaw6969 / Matthew2010 └── Amazon Canada: bimmer320@comcast.net / Matthew2010 └── NY Times: martintelena@yahoo.com / Matthew2010 └── Dunkin: martintelena@yahoo.com / Matthew2010$ └── Indigo: telenam6969 / Matthew2010$ └── Discord (Alt): Skyline / Matthew2010$ └── RoomSketcher: martintelena@yahoo.com / BobGoblin2023$ └── Chic Shelf Paper: martintelena@yahoo.com / matthew2010 └── FabFitFun: martintelena@gmail.com / BooYaaBing1900$ └── Discord (Alt): roug$eolyvia2017@gmail.com / Matthew2010 └── Earthfare: martintelena@yahoo.com / matthew2010 └── Battle.net: jennifer.witt1@comcast.net / Bimmer320 └── Discord (Alt): 1590 / Matthew2010$ └── Temu: telenas.newsandviews@yahoo.com / BobGoblin2023$ └── Ebates: martintelena@gmail.com / Matthew2010$ └── ThriftBooks: martintelena@yahoo.com / matthew2010 └── Discord (Alt): ! FourNiner! / Matthew2010$ └── LEGO: Mondo 2010 / matthew2010 └── Roblox: HeyHeyuimeanu / Matthew2010 └── MetroPCS (Alt): (423) 292-4703 / 40224022 └── My Priceless Foods (Alt): fleetsailor1981@gmail.com / Bimmer320 └── Xfinity (Alt): bimmer320@comcast.net / Homeschool18 └── Hippocketaeronautics: fleetsailor1981 / bimmer320 └── Library (OWL Alt): 22488002103811 / matthew2010 └── Discord (Alt): Swat_Personal / V2Ls4aRipLdGX!Q └── CrowdTap: martintelena@yahoo.com / matthew2010 └── Discord (Alt): Agent / Matthew2010$ └── Republic Finance: fleetsailor1981@yahoo.com / Bimmer320$ └── Credit Karma (Alt): fleetsailor1981@yahoo.com / bimmer320 └── W3ll People: jennifer.witt1@comcast.net / Matthew2010$ └── Amazon (Alt): martintelena@yahoo.com / Homeschool18 └── Eddie Bauer: martintelena@yahoo.com / Matthew2010$ └── TCT TV: martintelena@yahoo.com / matthew2010 └── Adventure Academy: martintelena@yahoo.com / matthew2010 └── H&R Block: Fleetsailor1981 / Matthew2010$ └── Submittable: martintelena@yahoo.com / matthew2010 └── Hulu (Alt): martintelena@yahoo.com / AaBbCcDd1969$$ └── Redbox: martintelena@yahoo.com / Abc1Def2$ └── Locast: martintelena@yahoo.com / BooYaaBing1900$ └── Northeast State (Alt): gmundkow / 122462 └── Google Account (Alt): tenawitt6969 / jennandmattie └── Amazon (Alt): mtelena1900xxoo@yahoo.com / BobGoblin2023$ └── Target: martintelena@yahoo.com / matthew2010 └── Cirkul: martintelena@yahoo.com / matthew2010 └── Promotions Now: jennifer.witt1@comcast.net / matthew2010 └── Roblox (Alt): HeyHeyuimeanu / Matthew2010 └── Artifact Uprising: martintelena@yahoo.com / matthew2010 └── JumpSend (Alt): martintelena@yahoo.com / matthew2010 └── Intellifluence: martintelena@yahoo.com / matthew2010 └── Influenster: telenas.newsandviews@yahoo.com / matthew2010 └── Yahoo (Alt): telenas.newsandviews / Homeschool18 └── Plunder Design: telenam / Matthew2010$ └── RocketNode: uhhit6ps / Matthew2010 └── Earthfare (Alt): martintelena@yahoo.com / BobGoblin2023$ └── Discord (Alt): ≡ƒªâThanksGiving Galaxy≡ƒªâ / Yardape2010 └── CVS: martintelena@yahoo.com / (empty) └── Daily Goodie Box: martintelena@yahoo.com / g16VCDATXY └── Kellogg's: martintelena@yahoo.com / Journey2010$ └── Staples: books4ever2020@yahoo.com / BooYaaBing1900$ └── Vashon Books: martintelena@yahoo.com / Matthew2010 └── TN DataMart: MARTINTELENA@YAHOO.COM / BobGoblin2023$ └── Betty Crocker: martintelena@yahoo.com / matthew2010 └── Ancestry: mtelena1900xxoo@yahoo.com / Matthew2010$ └── Patreon: fleetsailor1981@yahoo.com / Aa1Bb2Cc3Dd! └── Roshade: matthewwitt2010@gmail.com / Matthew2010$ └── TurboTax: telenam6969 / Matthew2010$ └── Swagbucks: 37604 / matthew2010 └── MEGA: blockt287@gmail.com / Matthew2010$ └── Temu (Alt): mtelena1900xxoo@yahoo.com / BobGoblin2023$ └── Discord (Alt): velocitypleaseaddme / Matthew2010$ └── VIP Voice: martintelena@yahoo.com / MATTHEW2010 └── Blogging for Books: telenas.newsandviews@yahoo.com / matthew2010 └── Halo Top: martintelena@yahoo.com / BobGoblin2023$ └── JCPenney: telenas.newsandviews@yahoo.com / BobGoblin2023$ └── Coinbase: martintelena@yahoo.com / BooYaaBing1900$ └── Victoria's Secret Pink: (423) 292-4703 / Matthew2010$ └── Shoppers Voice: 26MUX50WZmQPace / Matthew2010$ └── eBay (Alt): fleetsailor1981@yahoo.com / BadKarma1 └── Zulily: martintelena@yahoo.com / matthew2010 └── PureFlix: mtelena1900xxoo@yahoo.com / Matthew2010 └── Discord (Alt): bubby / Matthew2010$ └── Smiley: martintelena@yahoo.com / Matthew2010 └── Purina Pro Club: jennifer.witt1@comcast.net / Matthew2010$ └── Chess.com: Ur_About_To_Have_No_Time / Matthew2010$ └── Disney+: mtelena1900xxoo@yahoo.com / BobGoblin2023$ └── Bojangles: martintelena@yahoo.com / Matthew2010 └── Amazon (Alt): bimmer320@comcast.net / BobGoblin2022$ └── Product Testing USA (Alt): martintelena@yahoo.com / matthew2010 └── Fuck A Neighbor: awsfasdgfwa35421@gmail.com / AA20 └── Discord (Alt): Saya / Matthew2010$ └── Dental Care: martintelena@yahoo.com / Matthew2010 └── UserBenchmark: telenam6969 / Matthew2010$ └── Gap: martintelena@yahoo.com / BooYaaBing1900$ └── PTPA: jennifer.witt1@comcast.net / Matthew2010$ └── My Soapbox: martintelena@yahoo.com / matthew2010 └── Food City: Martin / Matthew2010$ └── Snapfish: martintelena@yahoo.com / (empty) └── Mail.com: 1969 / Matthew2010 └── Zixmail: books4ever2020@yahoo.com / BooYaaBing1900$ └── Hero Skins Squad: martintelena@yahoo.com / Matthew2010 └── Discord (Alt): eggsackgr / matthew2010$ └── Survey Savvy: martintelena@yahoo.com / BobGoblin2023$ └── Spotify (Alt): bimmer320@comcast.net / Matthew2010$ └── Loot.tv: matthewwitt2010@gmail.com / Matthew2010 └── MobileXpression: martintelena@yahoo.com / BobGoblin2023$ └── BrandBacker: Password / matthew2010 └── PicMonkey: mtelena1900xxoo@yahoo.com / Matthew2010$ └── eBay Sign In: martintelena@yahoo.com / (empty) └── ThriftBooks (Alt): jennifer.witt1@comcast.net / matthew2010 └── Try Products: martintelena@yahoo.com / BooYaaBing1900$ └── Walgreens Photo: martintelena@yahoo.com / matthew2010 └── Amazon (Alt): fleetsailor1981@yahoo.com / BadKarma1 └── Modification Universe: blockt287@gmail.com / Matthew2010$ └── Discord (Alt): HeyHeyuimeanu / matthew2010$ └── Pinecone Research: 2492383 / Aa1Bb2Cc3mondo └── Facebook: matthewwitt2010@gmail.com / mondo2010 └── Prepaid Code Center: telenas.newsandviews@yahoo.com / Aa1Bb2Cc3mondo └── HSN: martintelena@yahoo.com / Matthew2010 └── I Love to Review: martintelena@yahoo.com / matthew2010 └── Chewy (Alt): martintelena@yahoo.com / matthew2010 └── Discord (Alt): 2060 / Matthew2010$ └── WordPress: telenasnewsandviews / matthew2010 └── Green Moms Meet: telena6969 / matthew2010 └── Microsoft Live (Alt): mtelena1900xxoo@yahoo.com / Matthew2024$ └── Etsy: martintelena@yahoo.com / Matthew2010 └── Google Account (Alt): fleetsailor1981@gmail.com / bimmer320! └── Twitter API: matthewwitt2010@gmail.com / Matthww2010 └── Build-A-Bear: martintelena@yahoo.com / Matthew2010$ └── ACFCU: telenaw69 / BooYaaBing1900$ └── State Farm (Alt): Matthew2010 / Mondo2010$ └── NetSpend: telenam6969 / Matthew2010 └── Archive.org: martintelena@yahoo.com / BobGoblin2022$ └── Credit Card Activation: telenam69 / BooYaaBing1900$ └── USA Today: martintelena@yahoo.com / Jeffery2022$ └── Khan Academy: galaxywolf1969 / Booksrule2010 └── CloudConvert: matthewwitt2010@gmail.com / Matthew2010$ └── UnknownCheats: eatshitdogg / Matthew2010$ └── Steam Help: ghostrecon2391 / matthew2010$ └── Grubhub: martintelena@yahoo.com / matthew2010 └── MorphMarket: martintelena@yahoo.com / BobGoblin2023$ └── JCPenney (Alt): mtelena1900xxoo@yahoo.com / Matthew2023$ └── Discord (Alt): 0053 / Matthew2010$ └── He Gets Us (Alt): Witt / BobGoblin2023$ └── Your Baby Club: martintelena@yahoo.com / Matthew2010$ └── Pillsbury (Alt): martintelena@yahoo.com / Matthew2010 └── Jason's Family Fun: martintelena@yahoo.com / matthew2010 └── Sam's Club: martintelena@yahoo.com / Matthew2010 └── Tryable: martintelena@yahoo.com / matthew2010 └── Thingiverse: 1asdadasdf / uBwvatzz!wws4!B └── Blogger Hub: martintelena@yahoo.com / matthew2010 └── HP Login (Alt): 515630 / BobGoblin2022$ └── Christian Book: martintelena@yahoo.com / matthew2010 └── MindMate: martintelena@yahoo.com / BooYaaBing1900$ └── Fabletics: martintelena@yahoo.com / Matthew2010 └── Simply Charlotte Mason (Alt): telenaw69 / matthew2010 └── Target (Alt): martintelena@yahoo.com / matthew2010 └── Discord (Alt): msadfoasojidfr@gmail.com / Matthew2010$ └── LifePoints: martintelena@yahoo.com / Matthew2010$ └── Cricket Wireless (Alt): martintelena@yahoo.com / 14634754 └── Microsoft Live (Alt): mtelena1900xxoo@yahoo.com / BobGoblin2023$ └── Love Amika: martintelena@yahoo.com / MATTHEW2010 └── Discord (Alt): (channel 915425122255519766) / (password not shown) 〰️ [Browser Autofill Data - Edge] - Pet Names: Journey, Mondo (2 pets total) └── Analysis: Pet names appear in passwords (Journey2010$, Mondo2010$, JourneyAndMondoAndMe2010), confirming emotional attachment and password pattern predictability. Pet information used for account security questions. - Pet Weights: 40 lbs, 23 lbs └── Analysis: Weight data suggests two dogs of different sizes. This information commonly used for veterinary accounts, pet food subscriptions, and security questions. - Pet Food Brand: Pedigree └── Analysis: Brand loyalty data useful for targeted marketing and account identification on pet-related platforms. - Pet Birthdays: 5 years, 15 years └── Analysis: Age data confirms two pets, one middle-aged (5) and one senior (15). This information used for subscription services, veterinary records, and account verification. - Credit Card Expiration Dates: 01/29, 10/25, 02/28 └── Analysis: Multiple expiration dates suggest either multiple cards or card replacements over time. Dates span 2025-2029, indicating active financial accounts. Combined with cardholder name, this provides sufficient information for targeted phishing or social engineering attempts. - Credit Card Holder: Telena Martin └── Analysis: Confirms family member Telena Martin as primary account holder for financial transactions. Target likely uses family member's payment methods, indicating shared finances or parental oversight. - Phone Numbers: (423) 292-4703, (423) 292-4703 └── Analysis: Matches Telena Martin's phone number from family information. Format variation (with/without dashes) indicates different form submissions, showing extensive online account creation. - Addresses: 1808 Parkwood lane, Apt 1, Johnson City, TN 37604 └── Timeline: First entered 2021-12-05, last used 2024-10-06 └── Analysis: Address consistently used over 3-year period, confirming stable residence. Apartment number suggests rental property, matching family financial profile. - Property Address: 119 Arkansas Lane Delano, TN └── Timeline: First entered 2024-08-04, used 2 times └── Analysis: Property address entered in August 2024, possibly for estate sale listing (see "YARD/ESTATE SALE" entry). This is the target's primary residence address, confirming dual address usage pattern. - Property Owner: Steve Witt └── Timeline: First entered 2024-08-04 └── Analysis: Property owner information entered same date as property address, confirming family connection and property ownership structure. - Additional Items: ZOO MED T5 Hood with New 10 UVB Bulb, Nike Size 7.5 Vapor Max, YARD/ESTATE SALE └── Analysis: Reptile/amphibian equipment (UVB bulb) suggests exotic pet ownership beyond dogs. Nike shoe size (7.5) provides physical profile data. "YARD/ESTATE SALE" confirms property sale activity in August 2024, potentially indicating financial situation or relocation planning. - Search Terms: brightridge, internet, farming simulator └── Analysis: "brightridge" matches WiFi network name (BrightRidge-1), indicating internet service provider search. "farming simulator" matches game download, showing search-to-download behavior pattern. 〰️ [AUTOFILL TIMELINE ANALYSIS] Edge autofill data spans from 2015 (phone number first entered) to 2024 (recent pet and financial information). This 9-year timeline provides complete picture of address changes, account creation patterns, and family information evolution. The concentration of entries in 2024 (property sale, pet information, credit card data) suggests recent financial activity or account creation spree. The persistence of older data (2015 phone number still in use) indicates long-term account relationships and minimal data cleanup practices. 〰️ [Browser Cookies & Session Data - Browser] - Total Cookies: 5 - Unique Domains: 4 - Domains: bing.com, dotomi.com, emjcd.com, walmart.com - Cookie Names: SRCHHPGUSR, DotomiUser, cjae, S, brwsr 〰️ [Browser Autofill Data - Chrome] - Phone Number: (423) 951-6196 └── Analysis: Matches primary phone number, confirming device ownership and identity linkage - Usernames: Sn0wyRunsYou, 3e4tgae4g └── Analysis: "Sn0wyRunsYou" follows target's naming convention (snowy variant). "3e4tgae4g" appears random/generated, possibly for account creation automation or evasion purposes. Username creation date: 2025-09-20. - Email Timeline: └── blockt287@gmail.com: Created 2025-01-10, Last Used 2025-03-06, Used 3 times └── Analysis: Primary email for gaming/social accounts, actively used over 2-month period └── eyeh32916@gmail.com: Created 2025-01-29, Never used after creation └── Analysis: Burner email, created but abandoned, possibly for single-use registration └── tsrpnumber1@gmail.com: Created 2025-09-20, Last Used 2025-11-10, Used 2 times └── Analysis: "tsrp" likely refers to "Texas State Roleplay" (FiveM server), indicating gaming community engagement └── awefagw38@gmail.com: Created 2025-11-10, Never used └── Analysis: Another burner email, created same day as last use of tsrpnumber1, suggesting account creation spree - Search Terms: hitman, porn, hentai, house party, sasrp, bankrollrp, daylynn0519, jackson_2743, Nym, Nasawolf124, BlueBerryPopcicle34, luhmxrazy05, king von, centurionrp, civilizedrp, sandydojrp, bscrp, cale, flor, R.E.P.O, farming simulator └── Analysis: Search history reveals: 1) Adult content consumption (porn, hentai), 2) Gaming community engagement (multiple FiveM server names, usernames), 3) Interest in violent media (hitman, king von - rapper known for violent lyrics), 4) Specific individual searches (daylynn0519, jackson_2743, etc. - likely Discord usernames or gaming handles). The presence of "house party" combined with adult content suggests potential engagement with adult gaming content or platforms. - Discord Server Links: discord.gg/kXgU98C4, discord.gg/su6dH5Yf, discord.gg/RW7Kv6vC, discord.gg/mZ6b3beK, discord.gg/v5W8zBf9, discord.gg/Rt27FMFn, discord.gg/uEsgZn73, discord.gg/Z5uGUDx6mR, discord.gg/5r8hVApSkw, discord.gg/AhBXKUEtZc, discord.gg/lootlife, discord.gg/tEaDyzNk, discord.gg/fEmgpUNjyG, discord.gg/BqRvZfxB, discord.gg/65UA22sk, discord.com/invite/gsrpc └── Analysis: 16 unique Discord server invites saved, indicating extensive community engagement. Server names suggest gaming communities (lootlife, gsrpc likely "Grand Theft Auto San Andreas Roleplay Community"). These invites provide access points to target's social networks and gaming communities. - FiveM Server Names: coastalbreeze, sunshinestate, sasrp, bankrollrp, daylynn0519, jackson_2743, Nym, Nasawolf124, BlueBerryPopcicle34, csrp, coloradostateroleplay, luhmxrazy05, centurionrp, civilizedrp, paradisenetwork, asrp5m, arizonastateroleplay, jrp, ebkzfubu, txfrp, krp5m, sandydojrp, bscrp, getback, cale, flor, Sn0wyRunsYou, Greg └── Analysis: 28+ FiveM server identifiers reveal deep engagement with Grand Theft Auto V roleplay community. Server names follow geographic patterns (coloradostateroleplay, arizonastateroleplay, txfrp - Texas), suggesting regional roleplay preferences. The presence of "sasrp" (San Andreas State Roleplay) multiple times indicates primary server engagement. Usernames mixed with server names suggest these are player handles the target interacts with or searches for. 〰️ [Browser Cookies & Session Data - Chrome] - Total Cookies: 554 - Unique Domains: 196 - Key Domains with Cookies: └── discord.com: __dcfduid, __sdcfduid, cf_clearance └── google.com: APISID, HSID, SAPISID, SID, SSID, __Secure-1PAPISID, __Secure-1PSID, __Secure-3PAPISID, __Secure-3PSID, __Secure-1PSIDCC, __Secure-3PSIDCC, __Secure-1PSIDTS, __Secure-3PSIDTS, NID, SIDCC └── youtube.com: APISID, HSID, SAPISID, SID, SSID, __Secure-1PAPISID, __Secure-1PSID, __Secure-3PAPISID, __Secure-3PSID, __Secure-1PSIDTS, __Secure-3PSIDTS, VISITOR_INFO1_LIVE, VISITOR_PRIVACY_METADATA, __Secure-ROLLOUT_TOKEN └── accounts.google.com: __Host-GAPS, ACCOUNT_CHOOSER, LSID, __Host-1PLSID, __Host-3PLSID └── mail.google.com: OSID, __Secure-OSID └── myaccount.google.com: OSID, __Secure-OSID └── roblox.com: GuestData, RBXEventTrackerV2, RBXPaymentsFlowContext, RBXcb, rbx-ip2, .ROBLOSECURITY, UnifiedLoggerSession └── snapchat.com: EssentialSession, _ga, _ga_DPDHJB4310, _gat, _gid, _sc-sid, blizzard_client_id, blizzard_web_session_id, sc-language, sc-wcid, sc_at └── tiktok.com: passport_csrf_token, passport_csrf_token_default, tt_chain_token, ttwid, msToken, odin_tt, tiktok_webapp_theme, tiktok_webapp_theme_source, perf_feed_cache └── reddit.com: csv, edgebucket, loid, seeker_session, token_v2, g_state └── doxbin.com: cf_clearance, session, cf_chl_rc_ni └── cash.app: __atid, __nsid, __st, __cf_bm, _dd_s └── t-mobile.com: AMCV_1358406C534BC94D0A490D4D%40AdobeOrg, a_token, KPI_EV, LPVID, OptanonConsent, QuantumMetricUserID, TFPID, TFPIDS, _ScCbts, _abck, _fbp, _gcl_au, _scid, _scid_r, _sctr, _uetsid, _uetvid, admVisitorConvTrack, ak_bmsc, invc, kndctr_1358406C534BC94D0A490D4D_AdobeOrg_identity, kndctr_1358406C534BC94D0A490D4D_AdobeOrg_cluster, mbox, mboxEdgeCluster, portInTransferExp, TKPIM, _ga, _ga_SK38WR4SG9, QuantumMetricSessionID └── github.com: _octo, logged_in └── steamcommunity.com: timezoneOffset └── steamrip.com: _ga, cf_clearance, _ga_LRE1Q9V4DY └── steamunlocked.org: _ga, _ga_4WGMGP0QM8 └── uploadhaven.com: XSRF-TOKEN, uploadhaven_session, _ga, _ga_40Y7JFT57E └── t.me: stel_ssid └── guns.lol: gunslol_clearance, cf_clearance └── launcherleaks.net: cf_ob_info, cf_use_ob, cf_clearance └── spotify.com: sp_t, _ga, _ga_ZWG1NSHWD8, _scid, _scid_r, OptanonConsent, _hp5_event_props.4043975597, _hp5_meta.4043975597, sp_m, _ga_S35RN5WNT2 └── alwix.com: HstCfa4914880, HstCla4914880, HstCmu4914880, HstCns4914880, HstCnv4914880, HstPn4914880, HstPt4914880, __dtsu, _cc_id, link_sensitive_content_34, s_statistics_34, panoramaId, panoramaIdType, panoramaId_expiry, cf_clearance └── Additional domains (196 total): 1rx.io, 33across.com, adform.net, adkernel.com, adnxs.com, adroll.com, ads.stickyadstv.com, adsrvr.org, adx.opera.com, agkn.com, amazon-adsystem.com, analytics.yahoo.com, auth.platoboost.app, authorize.roblox.com, avgbrowser.com, bidberry.net, bidr.io, bidswitch.net, billing.elementalnodes.net, bing.com, buzzheavier.com, c6vb.com, c.bing.com, c.clarity.ms, c.cintnetworks.com, c.msn.com, c.r.msn.com, casalemedia.com, cash.app, cdn.discordapp.com, changepowder.xyz, chromewebstore.google.com, clarity.ms, clickagy.com, contextweb.com, copilot.microsoft.com, creativecdn.com, crsspxl.com, crwdcntrl.net, criteo.com, csync.loopme.me, ctscout.com, ctscdn.com, datanodes.to, degreedistance.cfd, demdex.net, dpm.demdex.net, dtscout.com, dtscdn.com, doubleclick.net, doxbin.com, drive.google.com, dtscout.com, elixirnode.com, elementalnodes.net, emojipedia.org, everesttech.net, exelator.com, eyeota.net, facebook.com, filecrypt.co, files.catbox.moe, flashbang.sh, flirtyj0y.com, freedownloadmanager.org, github.com, gofile.io, google.com, googleadservices.com, go.affec.tv, go.sonobi.com, guns.lol, gstatic.com, gumgum.com, heylink.me, hcaptcha.com, id5-sync.com, inkjail.info, install-north.com, instagram.com, intentiq.com, ipredictive.com, ispot.tv, jdm-expo.com, karmanow.com, kseseemyresum.org, launcherleaks.net, liadm.com, linkedin.com, linkvertise.com, lijit.com, live.rezync.com, lootdest.org, luarmor.net, maravill.shiksha, mathtag.com, mcookie1.com, media.net, media6degrees.com, mediarithmics.com, megekko.nl, microsoft.com, microsoftstart.com, microsoftedge.microsoft.com, ml314.com, mookie1.com, msn.com, my.toruftuiov.com, my.rtmark.net, nerventualken.com, ninthdecimal.com, ntp.msn.com, obseu.bizseasky.com, onaudience.com, onedrive.live.com, openx.net, petsoadepsoa.net, pippio.com, pixeldrain.com, pinterest.com, point-of-entry.com, popin.cc, primis.tech, pro-market.net, pub.network, pubmatic.com, quantserve.com, rakuten.com, reddit.com, restorecord.com, rezync.com, rlcdn.com, roblox.com, rover.link, rubiconproject.com, rqtrk.eu, s.team, scorecardresearch.com, sc-static.net, semasio.net, sharethis.com, shb-sync.com, signamentswithd.com, sitescout.com, srv.stackadapt.com, srtb-ax.msn.com, srtb.msn.com, sso.crunchyroll.com, stackadapt.com, steamcommunity.com, steamrip.com, steamunlocked.com.br, steamunlocked.net, steamunlocked.org, subsonic.com, sync.srv.stackadapt.com, t.co, t.me, taboola.com, tapad.com, teads.tv, testfamilysafety.bing.com, thrtle.com, tinyurl.com, tiktok.com, tiktokw.us, t-mobile.com, tolstoycomments.com, truoptik.com, turn.com, twitter.com, tynt.com, upload.wikimedia.org, uploadhaven.com, vag.gg, webvisor.org, work.ink, www.clarity.ms, www.google.com, www.microsoft.com, www.msn.com, www.reddit.com, www.roblox.com, www.t-mobile.com, www.tiktok.com, www.youtube.com, x.com, yandex.com, yandex.ru, yellowblue.io, ymmobi.com, you.elixirnode.com, youtube.com, zeotap.com 〰️ [Browser Cookies & Session Data - Edge] - Total Cookies: 208 - Unique Domains: 62 - Key Domains with Cookies: └── accounts.google.com: ACCOUNT_CHOOSER, LSID, __Host-1PLSID, __Host-3PLSID, __Host-GAPS └── google.com: APISID, HSID, SAPISID, SID, SSID, __Secure-1PAPISID, __Secure-1PSID, __Secure-3PAPISID, __Secure-3PSID, __Secure-1PSIDCC, __Secure-3PSIDCC, __Secure-1PSIDTS, __Secure-3PSIDTS, NID, SIDCC └── youtube.com: APISID, HSID, SAPISID, SID, SSID, __Secure-1PAPISID, __Secure-1PSID, __Secure-3PAPISID, __Secure-3PSID, __Secure-1PSIDTS, __Secure-3PSIDTS └── mail.google.com: OSID, __Secure-OSID └── myaccount.google.com: OSID, __Secure-OSID └── workspace.google.com: __utma, _ga, _ga_FWCBRW1RY8 └── discord.com: __dcfduid, __sdcfduid, cf_clearance └── bing.com: SRCHD, SRCHUID, _EDGE_V, MSPTC, KievRPSSecAuth, PPLState, SnrOvr, SRM_B, SRM_M, MUID, MUIDB, imganim, MMCASM, USRLOC, _RwBf, SRCHUSR └── microsoft.com: MC1, MSFPC, MicrosoftApplicationsTelemetryDeviceId, _clck, _uetvid └── microsoftstart.com: MUID, MUIDB, _EDGE_V └── msn.com: MUID, MUIDB, _EDGE_V, RC, SRM_M, USRLOC, _clck, pglt-edgeChromium-dhp, pglt-edgeChromium-ntp └── copilot.microsoft.com: MUID, MUIDB, SRCHD, SRCHUID, SRCHUSR └── ntp.msn.com: MUIDB, sptmarket, sptmarket_restored, MSFPC, MicrosoftApplicationsTelemetryDeviceId └── login.live.com: MSCC, SDIDC └── live.com: mkt └── onedrive.live.com: MSFPC, MicrosoftApplicationsTelemetryDeviceId └── account.live.com: MicrosoftApplicationsTelemetryDeviceId └── microsoftedge.microsoft.com: MSFPC, MicrosoftApplicationsTelemetryDeviceId └── spotify.com: _ga, _ga_ZWG1NSHWD8, _scid, _scid_r, OptanonConsent, _hp5_event_props.4043975597, _hp5_meta.4043975597, sp_m, sp_t, _ga_S35RN5WNT2 └── amazon.com: i18n-prefs, session-id, session-id-time └── rakuten.com: _mall_uuid, ajs_anonymous_id, cookie_id └── karmanow.com: _ga, _ga_RF47Y767KP, ab.storage.deviceId.090e35c3-62a4-40b3-b68d-a89e116e72bc, ab.storage.sessionId.090e35c3-62a4-40b3-b68d-a89e116e72bc, ab.storage.userId.090e35c3-62a4-40b3-b68d-a89e116e72bc, mp_sBGUbZm3hp_alooma └── karmanow.com (www): extension_token, logged └── opera.com: _ga, _uetvid, _ga_T18E1GTPQG └── linkedin.com: bcookie, lidc └── linkedin.com (www): bscookie └── tiktok.com: ttwid └── launcherleaks.net: cf_clearance └── affirm.com: 3060738.3440491, t_v2_s, tracker_device └── api-cf.affirm.com: session └── ibuypower.com: _ga, _ga_C0E795G0JF, tracker_device, tracker_device_is_opt_in └── signifyd.com: thx_guid, tmx_guid └── capitaloneshopping.com: wb_session, wb_session_status, __cf_bm, wb_extension_version, wb_profile_id └── pinterest.com: _pinterest_ct_ua, ar_debug └── yahoo.com: A1, A3, DSS, GUC, PROMO, _ga, _ga_40HG6NTJFD, sBS └── search.yahoo.com: lkl, PROMO └── Additional domains (62 total): 3lift.com, adnxs.com, api.engager.ecbsn.com, api.msn.com, api.rakuten.com, assets.msn.com, clarity.ms, doubleclick.net, events.engager.ecbsn.com, googleadservices.com, ivaws.com, login.microsoftonline.com, popin.cc, scorecardresearch.com, srtb-ax.msn.com, srtb.msn.com, testfamilysafety.bing.com, www.bing.com, www.clarity.ms, www.karmanow.com, www.microsoft.com, www.microsoftstart.com, www.msn.com, www.rakuten.com, www.youtube.com 〰️ [Browser History Data - Chrome] - Total History Entries: 1,487 URLs - Total Unique Domains: 62 - Top Visited Domains: └── discord.com: 3,797 visits └── Analysis: Discord represents 72% of all browser activity (3,797 of 5,284 total visits). This extreme concentration indicates Discord is the primary communication platform, making it the highest-value target for social engineering or account takeover. The target's entire social network exists within Discord servers and DMs. └── doxbin.com: 224 visits └── Analysis: 224 visits to doxbin.com (a doxxing/sharing platform) reveals the target's engagement with doxxing culture. This is particularly ironic given the target's current situation. Visit frequency suggests either active participation in doxxing communities or research into doxxing methods. └── google.com: 130 visits └── Analysis: Standard search engine usage, but combined with other data reveals search patterns for gaming, adult content, and doxxing-related queries. └── steamrip.com: 75 visits └── Analysis: SteamRIP is a game piracy site. 75 visits indicates active engagement with software piracy, consistent with large game downloads (76.8 GB HITMAN, 26.3 GB Farming Simulator) found in download history. └── youtube.com: 22 visits └── Analysis: Surprisingly low YouTube usage compared to Discord, suggesting video content consumption happens elsewhere (TikTok, Discord) or the target prefers text-based communication. └── restorecord.com: 17 visits └── Analysis: RestoreCord is a Discord message recovery/deletion tool. Visits suggest the target has attempted to recover deleted messages or hide communication history, indicating awareness of potential surveillance or desire to cover tracks. └── tiktok.com: 17 visits └── Analysis: Minimal TikTok engagement, possibly using mobile app instead of browser. └── guns.lol: 13 visits └── Analysis: Guns.lol is a file sharing/piracy site. Visits align with piracy behavior pattern. └── c6vb.com: 7 visits └── Analysis: Unknown domain, requires further investigation. Pattern suggests file hosting or redirect service. └── buzzheavier.com: 5 visits └── Analysis: Another file sharing/piracy domain, consistent with target's software piracy activities. └── filecrypt.co: 5 visits └── Analysis: FileCrypt is an encrypted file sharing service. Usage suggests sharing or receiving files that require obfuscation, possibly illegal content or sensitive communications. └── uploadhaven.com: 4 visits └── Analysis: UploadHaven is a file hosting service frequently used for pirated software distribution. Visits directly correlate with large game downloads (76.8 GB, 26.3 GB) found in download history. └── elementalnodes.net: 4 visits └── Analysis: Elemental Nodes appears to be a hosting/service provider. Billing page access suggests paid service subscription, indicating technical infrastructure usage (possibly for gaming servers or hosting projects). 〰️ [BEHAVIORAL PATTERN: DISCORD DEPENDENCY] The extreme Discord usage (3,797 visits vs. 1,487 total URLs means average of 2.5 visits per URL, but Discord URLs were visited thousands of times) reveals complete platform dependency. The target's social life, gaming communities, and likely illegal activities (doxxing, piracy coordination) all occur within Discord. This makes Discord account takeover the single most valuable attack vector—compromising the Discord account provides access to the target's entire social network, private messages, server memberships, and communication history. 〰️ - All Domains Visited: accounts.google.com, alwix.com, alwix.site, apis.roblox.com, auth.platoboost.app, authorize.roblox.com, billing.elementalnodes.net, buzzheavier.com, c6vb.com, cash.app, cdn.discordapp.com, changepowder.xyz, chrome.google.com, chromewebstore.google.com, crimemagic.info, datanodes.to, degreedistance.cfd, discord.com, discord.gg, discord.id, discounthero.org, docs.google.com, doxbin.com, drive.google.com, elementalnodes.net, elixirnode.com, emojipedia.org, filecrypt.co, files.catbox.moe, flashbang.sh, github.com, gofile.io, google.com, guns.lol, inkjail.info, install-north.com, jdm-expo.com, kseseemyresum.org, launcherleaks.net, lootdest.org, north-verification.com, petsoadepsoa.net, pixeldrain.com, reddit.com, restorecord.com, roblox.com, rover.link, s.team, signamentswithd.com, snapchat.com, softcratefile.com, steamcommunity.com, steamrip.com, steamunlocked.com.br, steamunlocked.net, steamunlocked.org, t.me, tiktok.com, uploadhaven.com, vag.gg, you.elixirnode.com, youtube.com - Important URLs Accessed: └── Google Drive folder: drive.google.com/drive/folders/1JziT6Ng5OTi7E5tNVM-B5zMS5vdXtRMe └── Premium bio sites: alwix.com/xiexiekitty, alwix.site/alexagreyz └── Roblox OAuth: apis.roblox.com/oauth (Client ID: 9076246857723081780) └── Platoboost authentication: auth.platoboost.app └── Elemental Nodes billing: billing.elementalnodes.net/store └── Discord Channels: 1,082+ unique Discord channel URLs accessed └── Most visited: discord.com/channels/@me (339 visits) └── Channel IDs: 1392680858854363280, 1350492639933370412, 1230230503320453130, 1404635975279317085, 1399955446109962332, 1390139372220846191, 1404680269021319350, 1403149053952397385, 1404740646048235583, 1404840192182845502, 1393008457338064926, 1383272776017772756, 783236112566321193, 299949507989340160, 1340708495825305690, 586599199370510338, 1345351841365491806, 652246210706669581, 1397007048771633172, 1405153742684164180, 1367535189399437362, 1380635619604303962, 1382455190380347517, 869422354340659200, 1353450276962701432, 1405365856875315306, 1398842150380113952, 1390557505402437753, 1401455584972115971, 1376018788041887795, 1408197443178463284, 885665235506167898, 1329385400829214762, 1408201984439353446, 1383612639397285991, 1409398975466836111, 1407915270181490688 └── Full URL list available in: history_chrome_urls.txt (1,487 URLs organized by domain) 〰️ [Browser History Data - Edge] - Total History Entries: 585 URLs - Total Unique Domains: 452 - Top Visited Domains: └── bing.com: 32 visits └── Analysis: Microsoft Edge default search engine usage. Lower visit count compared to Chrome suggests Edge used for different purposes (family/school activities) vs. Chrome (personal/gaming). └── go.microsoft.com: 9 visits └── Analysis: Microsoft service access, likely Office 365, OneDrive, or Microsoft account management. 〰️ [BEHAVIORAL ANALYSIS: DUAL BROWSER USAGE PATTERN] Chrome and Edge show completely different usage patterns, suggesting shared device or dual-persona usage: - Chrome: Gaming, piracy, doxxing, adult content, Discord (personal activities) - Edge: Recipes, homeschooling, freebie sites, local services, education (family activities) This pattern indicates either: 1) Shared family computer with Chrome for target, Edge for family member (Telena Martin), or 2) Target uses Edge for "clean" activities (homeschooling, family blogs) while Chrome used for personal activities. The presence of personal blogs (2015christmasrichestelena.blogspot.com, telenasnewsandviews.blogspot.com) in Edge history confirms family member (Telena Martin) usages. 〰️ - Key Domains & Categories: └── Recipe Sites: allrecipes.com, cdkitchen.com, hauteandhealthyliving.com, omgchocolatedesserts.com, thestayathomechef.com, kraftrecipes.com, thespruce.com, food.com, foodnetwork.com, eatingwell.com, delishrecipes.net └── Analysis: Extensive recipe site usage suggests family cooking activities, meal planning, or homeschool curriculum integration. The variety indicates active recipe research and meal preparation. └── Freebie/Sample Sites: 4allpromos.com, freebieshark.com, myfreeproductsamples.com, ilovefreethings.com, freakyfreddies.com, freesampleboxes.blogspot.com, bigcompanyfreebies.blogspot.com, tryazon.com, dailygoodiebox.com, dailybreak.com └── Analysis: 10+ freebie/sample sites reveal active engagement with product sampling programs. This explains the 1,269 password entries—many are for freebie site registrations. The target/family appears to actively seek free products, samples, and promotional items, indicating either frugal lifestyle or financial constraints. This behavior pattern explains the extensive account creation across hundreds of platforms. └── Homeschool Resources: allinonehomeschool.com, homeschool-life.com, homeschoolcompass.com, homeschoolden.com, homeschoolfoundation.org, homeschoolingwithdyslexia.com, homeschoollessons.net, homeschoolshare.com, homespellingwords.com, freedomhomeschooling.com, freehomeschooldeals.com, homelifeacademy.com, amblesideonline.org, eclectic-homeschool.com └── Analysis: 14+ homeschool resource sites confirm the target is homeschooled. The presence of dyslexia-specific resources (homeschoolingwithdyslexia.com) suggests learning differences. This explains the target's extensive online activity (homeschooled children often have more screen time) and provides context for age (15) and location (rural Tennessee). Homeschool status also explains why target can engage in extensive gaming and online activities during school hours. └── Social Media: facebook.com, discord.com, youtube.com, plus.google.com └── Analysis: Standard social media usage, but note Facebook and Google+ (defunct) suggest older family member (Telena Martin) usage rather than target's primary platforms. └── Shopping: amazon.com, ebay.com, walmart.com, target.com, macys.com, kohls.com, wayfair.com, staples.com, lowes.com └── Analysis: Extensive shopping site visits align with freebie site usage—many freebie programs require purchases or account creation on shopping platforms. The variety suggests price comparison and deal hunting behavior. └── Adult Content: pornhub.com └── Analysis: Adult content consumption in Edge history, combined with Chrome history (porn, hentai searches), confirms target's engagement with adult content. The presence in Edge suggests either shared device usage or target uses both browsers for different content types. └── Local/Personal: 192.168.1.1 (router), 2015christmasrichestelena.blogspot.com, telenasnewsandviews.blogspot.com, cca.johnsoncitytnchamber.com, catalog.northeaststate.edu, elearn.northeaststate.edu, clevelandschools.org └── Analysis: Router access (192.168.1.1) indicates network administration knowledge. Personal blogs confirm Telena Martin's online presence and provide additional intelligence gathering opportunities. Northeast State community college access suggests either enrollment, interest in enrollment, or family member (Telena Martin, age 39) pursuing education. Cleveland Schools access suggests either previous enrollment or research into school districts. └── Health/Medical: balladhealth.org, app.healthyparkstn.com, childmind.org, healthline.com, healyourlife.com, draxe.com └── Analysis: Health site visits suggest family health concerns, possibly related to homeschooling (childmind.org for child mental health), or general health information seeking. Ballad Health is regional healthcare provider, confirming location in Tennessee healthcare system. └── Education: abcmouse.com, adventureacademy.com, code.org, courses.edx.org, classroommagazines.scholastic.com, ducksters.com, dictionary.com, en.wikipedia.org, history.com └── Analysis: Educational platform usage confirms homeschool curriculum. ABCmouse and Adventure Academy are subscription-based learning platforms (explaining account creation and password entries). Code.org suggests programming education interest. EdX and Scholastic indicate academic resource usage. └── Full domain list (452 domains): 08liter.com, 192.168.1.1, 1plus1plus1equals1.com, 2015christmasrichestelena.blogspot.com, 4allpromos.com, abcfamily.go.com, abcmouse.com, accounts.google.com, activate.social, adoramapix.com, adventureacademy.com, aerofred.com, agclassroom.org, alldayidreamaboutfood.com, allieddispatch.bomgarcloud.com, allinonehomeschool.com, allrecipes.com, alltrails.com, allure.com, allyou.com, almanac.com, amazon.com, amblesideonline.org, americanfoodtime.com, americanheritage.org, amzreviewtrader.com, app.curology.com, app.healthyparkstn.com, apps.facebook.com, archive.org, aspire.com, audible.com, balladhealth.org, bearfoottheory.com, beautybox.walmart.com, befunky.com, benandme.com, bernheim.org, beta.fitbit.com, beta.topboxcircle.com, bhg.com, bigcompanyfreebies.blogspot.com, bigfarm.goodgamestudios.com, billnye.com, bing.com, bioprepper.com, blindpigandtheacorn.com, blizzardguides.com, blog.blueapron.com, blog.crowdtap.com, blog.fatfreevegan.com, bloglovin.com, bookitprogram.com, booklibris.com, books.google.com, boostinsider.com, brandbacker.com, brandbuddee.com, brickseek.com, byzips.com, bzzagent.com, canninggranny.blogspot.com, cashinwithzero.com, castlebrands.promo.eprize.com, catalog.northeaststate.edu, cca.johnsoncitytnchamber.com, cdkitchen.com, chickadvisor.com, childmind.org, civilwartalk.com, clarencesexton.com, clarendonlearning.org, classroommagazines.scholastic.com, clevelandschools.org, cocacola.promo.eprize.com, code.org, consumercenter.mysynchrony.com, coronausa.com, countryliving.com, courses.edx.org, courttv.com, craftymorning.com, crateandbarrel.com, crayola.com, crazytechtricks.com, creatureartteacher.com, creditonebank.com, creditwise.capitalone.com, crossflix.com, crowdtap.com, d.comenity.net, dailybreak.com, dailygoodiebox.com, dancingonmountaintops.com, dangersofvaccines.com, dashboard.ptpa.com, dealiciousmom.com, delishrecipes.net, diabetesmealplans.com, diaryofamadfoodie.com, dictionary.com, digitalbeerpromo.com, discord.com, disneymovierewards.go.com, disneyplus.com, doerivergorge.com, draxe.com, dropbox.com, ducksters.com, dyslexiagames.com, eatingonadime.com, eatingwell.com, ebay.com, eclectic-homeschool.com, ecowatch.com, edenbrothers.com, educationplanner.org, elcompanies.com, elearn.northeaststate.edu, elitedealclub.com, en.gravatar.com, en.wikipedia.org, epromos.com, etekcitizen.com, everykidinapark.gov, facebook.com, facingus.org, faithandgoodworks.com, feralforaging.com, fervora.com, figuresinmotion.com, finalfeecalc.com, findalocksmith.com, fivestar-oms.net, focusgroup.com, food.com, foodnetwork.com, forestbathingcentral.com, formswift.com, forums.welltrainedmind.com, fox.com, foxcarolina.com, freakyfreddies.com, freebieeeasy.blogspot.com, freebiesfrenzy.com, freebieshark.com, freedomhomeschooling.com, freeflightscale.co.uk, freehomeschooldeals.com, freemaptools.com, freeonlinephotoeditor.com, freeprintable.com, freeprintable.net, freesampleboxes.blogspot.com, fsnb.com, fun-stuff-to-do.com, funmusicco.com, funschoolingbooks.com, fws.gov, gardeningknowhow.com, garnierusa.com, gavirtuallearning.org, geezgwen.com, geico.com, generationgood.socialmedialink.com, geni.com, georgiapacific.promo.eprize.com, giveawayservice.com, go.microsoft.com, goodhousekeeping.com, google.com, gpultimatepartysweeps.com, growforagecookferment.com, guce.yahoo.com, gutenberg.org, hartzpetpartners.com, hauteandhealthyliving.com, headtalker.com, healingharvesthomestead.com, healthline.com, healyourlife.com, heavenlysteals.com, hellofriends.socialmedialink.com, herbalista.teachable.com, hiddenvalley.com, hintsters.com, hismodel.com, historicaerials.com, history.com, homelifeacademy.com, homeschool-life.com, homeschoolcompass.com, homeschoolden.com, homeschoolfoundation.org, homeschoolingwithdyslexia.com, homeschoollessons.net, homeschoolshare.com, homespellingwords.com, houseparty.com, pornhub.com. - Important URLs: YouTube videos, Discord channels (@me/921239923753906206, @me/830095935656427591), recipe sites, freebie sites, homeschool resources, router admin (192.168.1.1), personal blogs (2015christmasrichestelena.blogspot.com, telenasnewsandviews.blogspot.com) 〰️ [Browser History Data - Browser] - Total History Entries: 20 URLs - Total Unique Domains: 20 - Domains: facebook.com, youtube.com, amazon.com, ebay.com, walmart.com, booking.com, grammarly.com, aliexpress.com, expedia.com, hotels.com, lowes.com, temu.com, transunion.com, aarp.com, staples.com, wayfair.com, macys.com, target.com, kohls.com, cvs.com 〰️ [Download History & Timeline Analysis] - OperaSetup.exe / OperaInstaller.exe (Opera Browser) └── Source: opera.com, work.ink └── Danger Level: 4 (High Risk - flagged by browser) └── Size: 2.2 MB └── Analysis: Downloaded from suspicious redirect domain (work.ink), indicating potential malware vector - RobloxPlayerInstaller.exe (Multiple installations) └── Game 1: Dead-Rails-Alpha (Game ID: 116495829188952) └── Game 2: Grow-a-Garden (Game ID: 126884695634066) └── Timeline: Downloads occurred within minutes of each other, showing rapid game installation pattern - fdm_x64_setup.exe (Free Download Manager - 48.2 MB) └── Source: freedownloadmanager.org └── Analysis: Downloaded immediately after visiting uploadhaven.com, indicating preparation for large file downloads - 7z2401.msi (7-Zip Archive Manager - 1.5 MB) └── Source: 7-zip.org, loadfilerun.com └── Analysis: Downloaded twice (original + duplicate), suggesting user error or system issue - HITMAN.WoA.v3.220.2.ALL.DLC.zip (Game - 76.8 GB) └── Source: uploadhaven.com └── Torrent file also downloaded └── Analysis: Massive pirated game download (76.8 GB) indicates engagement with software piracy. Torrent file presence confirms use of peer-to-peer file sharing, exposing IP address and download activity to monitoring. - EZBlocker.exe (Spotify Ad Blocker - 1.4 MB) └── Source: github.com/Xeroday/Spotify-Ad-Blocker └── Analysis: Downloaded from GitHub, indicating technical knowledge to modify application behavior - Farming.Sim.25.v1.9.0.1.ALL.DLC.zip (Game - 26.3 GB) └── Source: uploadhaven.com └── Analysis: Another large pirated game download, confirming pattern of software piracy - Iris-1.7.3-1.21.zip (Minecraft Shader - 46.1 MB) └── Location: D:\newdownload\ └── Analysis: Downloaded to secondary drive, indicating organized file management or attempt to avoid detection - Video files: └── v15044gf0000cr0kt3vog65gnm4umvn0.mov (25.0 MB) └── Analysis: Filename pattern suggests TikTok video download (v15044gf format typical of TikTok media) └── 2025-10-13 20-29-10.mkv (3.4 MB) └── Analysis: Timestamped filename indicates screen recording or video capture on October 13, 2025 at 8:29 PM └── rn_image_picker_lib_temp_97657073-447e-4471-9b95-bb667f60b2b9.webp (32 KB) └── Analysis: React Native image picker temporary file, indicating mobile app development or image processing - Download locations: C:\Users\mtele\Downloads\, D:\newdownload\ └── Analysis: Dual storage locations suggest either multi-drive system or attempt to organize/separate content - Additional: Large file download attempted (38.3 GB - incomplete) └── Analysis: Failed download of massive file, possibly interrupted or blocked. Size suggests another game or media collection. 〰️ [BEHAVIORAL PATTERN ANALYSIS] Download timeline reveals: Initial browser installation (Opera) → Game platform setup (Roblox) → Download manager installation → Archive tool acquisition → Large game piracy downloads. This sequence demonstrates a methodical approach to acquiring pirated software, suggesting familiarity with piracy workflows. The presence of both legitimate (GitHub tools) and questionable (pirated games, suspicious redirects) downloads indicates mixed technical sophistication with poor security judgment. ══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════ FINAL INTELLIGENCE ASSESSMENT ══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════ This operation has successfully extracted and cataloged every accessible piece of digital information from the target. The depth and breadth of recovered data is extraordinary: from browser cookies revealing session tokens for 196 domains, to 1,269 password entries exposing credential reuse across 331+ platforms, to complete autofill data spanning 9 years of online activity. The target's digital footprint is not merely exposed— it is completely mapped, cross-referenced, and analyzed. Every password pattern, every email address, every search query, every download, and every online interaction has been captured and correlated to build this comprehensive intelligence profile. The recovered data provides multiple attack vectors: credential stuffing (331 sites vulnerable to "matthew2010" password), session hijacking (active Discord token, Google session cookies), social engineering (family information, pet names, addresses), financial fraud (credit card information, payment methods), and identity theft (complete personal information, addresses, phone numbers, emails). The target's complete lack of operational security, combined with catastrophic password reuse and the absence of two-factor authentication, makes this individual one of the most vulnerable targets in digital forensics. This document represents not just a data dump, but a complete digital identity reconstruction. Every piece of information connects to another, creating a web of intelligence that reveals the target's habits, relationships, financial situation, interests, and vulnerabilities. ══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════ ❗ DISCLAIMER ❗ ══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════ This document contains publicly available information sourced from open records and public platforms. It complies with laws such as the Freedom of Information Act (FOIA) and does not involve unauthorized access or illegal methods. By accessing this document, you agree that the information is for lawful purposes only. The creator of this document is not responsible for how the information is used by others. ══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════