Excerpts below are truncated for web display. Complete manifests stay with the offline evidence package.
Evidence package at a glance
| Metric | Value |
|---|---|
| Total files hashed | 528 |
| Total evidence size | 292.34 MB (306,542,542 bytes) |
| Unique SHA-256 hashes | 242 (285 duplicate files by content) |
| Evidence window | 2025-08-27 — 2026-04-07 03:14 UTC |
| Hashing algorithms | MD5 (RFC 1321) + SHA-256 (FIPS 180-4) |
| Compliance standards | NIST SP 800-86, NIST CFTT, DOJ ECMU |
| Crypto provider | .NET System.Security.Cryptography (FIPS-capable) |
| Per-collection manifests | 5 (each independently verifiable) |
| Package-level manifest | 1 (covers all 527 files) |
Evidence by collection
| Collection | Files | Size |
|---|---|---|
| Twitter / X media | 75 | 175.19 MB |
| Telegram exports (7 chats) | 366 | 107.35 MB |
| Payment evidence (Stripe) | 39 | 8.99 MB |
| Chain of custody | 1 | 165.32 KB |
| OSINT reports | 11 | 124.20 KB |
| Hash manifests | 5 | 120.51 KB |
| Collection scripts | 14 | 94.70 KB |
| Group extraction | 5 | 93.96 KB |
| Forensic report | 3 | 87.11 KB |
| Suspect lookups | 4 | 31.11 KB |
| Member dumps | 4 | 14.38 KB |
| Total | 528 | 292.34 MB |
File types in evidence
| Type | Files | Size |
|---|---|---|
| Video (.mp4) | 43 | 225.07 MB |
| Saved web resources (.download) | 12 | 4.77 MB |
| Web assets (.html, .htm, .css) | 24 | 4.18 MB |
| Images (.jpg, .png, .svg) | 62 | 443.28 KB |
| Reports & manifests (.txt, .md) | 19 | 317.75 KB |
| Data (.json, .csv) | 49 | 326.09 KB |
| Scripts (.py, .mjs, .js) | 15 | 115.26 KB |
Package SHA-256: 43F07C7D79A0AE5644E294C49227ED1FBD25EA1361EBB38992805F84AB4F5E4B
Decentralized evidence preservation (IPFS)
The AES-256 encrypted evidence package has been pinned to the InterPlanetary File System (IPFS) for tamper-proof, censorship-resistant storage. The IPFS CID is a cryptographic content hash — any modification to the file would produce a different CID.
| Field | Value |
|---|---|
| IPFS CID | Qmc5ebrUTm14s5dQPMZa2mbEbCUWCxrqtAcYA5X1hwWqJz |
| Encrypted file | FINALEVIDENCEPACKAGE.tar.gpg (295,305,880 bytes) |
| Encryption | AES-256 (GPG symmetric, Kleopatra / Gpg4win) |
| Pinning service | Filebase (filebase.com) |
| Pin verified | 2026-04-07 04:27 UTC |
| Project codename | Kingfisher |
Retrieval URLs (any IPFS gateway):
ipfs://Qmc5ebrUTm14s5dQPMZa2mbEbCUWCxrqtAcYA5X1hwWqJz
https://ipfs.filebase.io/ipfs/Qmc5ebrUTm14s5dQPMZa2mbEbCUWCxrqtAcYA5X1hwWqJz
https://ipfs.io/ipfs/Qmc5ebrUTm14s5dQPMZa2mbEbCUWCxrqtAcYA5X1hwWqJz
Verification: download from any gateway, confirm 295,305,880 bytes, decrypt with the GPG passphrase (provided separately), then verify PACKAGE_MANIFEST SHA-256 hashes against extracted files.
Group 1 — Supergroup (ID 3368344320)
Source: MasterChainOfCustody.txt (v4 FINAL)
================================================================================ MASTER CHAIN OF CUSTODY — DIGITAL EVIDENCE PACKAGE (v4 FINAL) DOJ / NIST SP 800-86 / NIST CFTT / FIPS 180-4 Compliant ================================================================================ CASE OVERVIEW ------------- Evidence Type : Telegram Chat Export + X/Twitter Media + OSINT Primary Suspect : @MRFOLDER1 (Telegram User ID: 5928355498) Display: "buy here HA" Associated Accounts : @Onlynsfw_packs_bot (Bot, TG ID: 8085969392) @onlynsfw_suport (TG User ID: 8783916099) Cross-Platform : @kellyjessie23 (X/Twitter ID: 1960710163859484672) Display: "Honestlygoat" Bio links to Telegram: https://t.me/+2RWWx1E9GssxMzM0 Source Group : "leaked kindom" (private_supergroup, ID: 3368344320) Evidence Window : 2026-04-06 20:36:14 — 20:46:16 UTC (Telegram) 2025-08-27 — 2026-04-06 (X/Twitter, full history) Intended Recipients : DOJ, FBI, NCME CHAIN OF CUSTODY — GENERATION METADATA --------------------------------------- Master Manifest (UTC) : 2026-04-07 01:58:08.697 UTC Revision : 4 FINAL (supersedes all prior versions) Workstation : KEV Operator : kev Operating System : Microsoft Windows NT 10.0.26200.0 PowerShell Version : 7.6.0 Python Version : 3.14.0 (CPython) Telethon Version : 1.36.0 (MTProto API Client) Gallery-dl Version : 1.31.10 (X/Twitter media extraction) Hashing Algorithms : MD5 (RFC 1321) + SHA-256 (FIPS 180-4) Crypto Provider : .NET System.Security.Cryptography (FIPS-capable) COLLECTION INTEGRITY HASHES ---------------------------- Telegram Export Collection SHA-256 : 2D8BA87674871C76A3F0E60CEB64BFFD2AC1500D8860BFC6309CE7C8D7D96C57 X/Twitter Media Collection SHA-256 : 39ABC0EA8AA530475D1A2F37CAFB530086BC600015DB99C5161FD038141ABD14 Report Artifacts Collection SHA-256 : A8DFE7AA2A21D1F12A0F9D6EF91672C88E1339F91A1830AEC7DDD4FF37F97872 MASTER (ALL FILES) SHA-256 : DF5F88908DB051426D9C0BDEBEA3A7B62B93C4E7FAB75931197207973E5D2736 ================================================================================ SECTION A — TELEGRAM EXPORT (348 files) Source: C:\Users\kdsmi\Downloads\Telegram Desktop ================================================================================ File : ChatExport_2026-04-06 (1)\css\style.css Size : 16270 bytes Created : 2026-04-07 00:46:14.665 UTC Modified: 2026-04-07 00:46:14.665 UTC MD5 : 2856930DF6BF08F9370F9B3454E619B5 SHA-256 : B3FF9B6B6142476DE698BBA1AA4AE374198F9DFC1ADCEF9F9747B21827994912 -------------------------------------------------------------------------- File : ChatExport_2026-04-06 (1)\images\back.png Size : 312 bytes Created : 2026-04-07 00:46:14.665 UTC Modified: 2026-04-07 00:46:14.665 UTC MD5 : C2028231F65F93455E79AE1C0240A83F SHA-256 : 929933067C1D751FED025884B85804818342F7560DD9A36D3A058C36A04676EB -------------------------------------------------------------------------- File : ChatExport_2026-04-06 (1)\images\back@2x.png Size : 518 bytes Created : 2026-04-07 00:46:14.665 UTC Modified: 2026-04-07 00:46:14.665 UTC MD5 : A707269464457AE886A6B416F60CE5A2 SHA-256 : 961CFE303DEAB8F2939257D1B2BB7D0EC14E4F32C3B6A4A673A9FC55AD0053BB -------------------------------------------------------------------------- File : ChatExport_2026-04-06 (1)\images\media_call.png Size : 417 bytes Created : 2026-04-07 00:46:14.665 UTC Modified: 2026-04-07 00:46:14.665 UTC MD5 : 6C0F2B4B239FB0AD9B9F0B5C21198940 SHA-256 : 83014BB735C810FEF0C0BFB6E9DAD93E5575A06DB20EA0E22E45AB810868A478 -------------------------------------------------------------------------- File : ChatExport_2026-04-06 (1)\images\media_call@2x.png Size : 815 bytes Created : 2026-04-07 00:46:14.668 UTC Modified: 2026-04-07 00:46:14.668 UTC MD5 : 8189E526D80FA7FFC0738384F5F8BA0A SHA-256 : 6F23D3955F028037AC038D21ADBEC952537B1C7A4862DCC9478615D2977147B5 -------------------------------------------------------------------------- File : ChatExport_2026-04-06 (1)\images\media_contact.png Size : 323 bytes Created : 2026-04-07 00:46:14.668 UTC Modified: 2026-04-07 00:46:14.668 UTC MD5 : 7ECA291251F16763FF1146D003850891 SHA-256 : 37462001AA3F02DB4821532E4A62BDF5747987F9D0C479D3FDDC7DC1E8E0C6A7 -------------------------------------------------------------------------- File : ChatExport_2026-04-06 (1)\images\media_contact@2x.png Size : 600 bytes Created : 2026-04-07 00:46:14.668 UTC Modified: 2026-04-07 00:46:14.668 UTC MD5 : 08B33C3B2B383FE879D3CBF0F458A997 SHA-256 : ECE7F7E5485A4B2BCF50ED758EC9748501B231B7558078D15C3E1F69B55D0CBA -------------------------------------------------------------------------- File : ChatExport_2026-04-06 (1)\images\media_file.png Size : 236 bytes Created : 2026-04-07 00:46:14.668 UTC Modified: 2026-04-07 00:46:14.668 UTC MD5 : 2D5EE8D80FF2EA221581BB8FA1D83A51 SHA-256 : DA791938383C24CCC7AC7BBA638470E53753DF256609E1BFA5C3C7BB4E241F6B -------------------------------------------------------------------------- File : ChatExport_2026-04-06 (1)\images\media_file@2x.png Size : 408 bytes Created : 2026-04-07 00:46:14.670 UTC Modified: 2026-04-07 00:46:14.670 UTC MD5 : EF1F5446E9CAE19A7C3C425B3BF43F85 SHA-256 : 2FC5B871D9E40D8DFBD2EACC27300C98BD7F3205D57B1B4CB59B86E6A176087E -------------------------------------------------------------------------- File : ChatExport_2026-04-06 (1)\images\media_game.png Size : 271 bytes Created : 2026-04-07 00:46:14.670 UTC Modified: 2026-04-07 00:46:14.670 UTC MD5 : ACBFDE970095A00F53A43001CCF93DCB SHA-256 : 36354C347F0CAD06DAE45BC6451EA875714BCF33F7B3175394D16A64FAA225C7 -------------------------------------------------------------------------- File : ChatExport_2026-04-06 (1)\images\media_game@2x.png Size : 510 bytes Created : 2026-04-07 00:46:14.671 UTC Modified: 2026-04-07 00:46:14.671 UTC MD5 : 5683A3D08F20DCECDC34B0E781BFECF0 SHA-256 : 521B1874FD20C0C05619342D9FB11C0F24D9F7DBC6A6BBEC28B5B09C17B8C12F -------------------------------------------------------------------------- File : ChatExport_2026-04-06 (1)\images\media_location.png Size : 480 bytes Created : 2026-04-07 00:46:14.671 UTC Modified: 2026-04-07 00:46:14.671 UTC MD5 : E42FC623406D8A0B70E825AAAECE1253 SHA-256 : 17AC2DFDBB87F3B53010EAAD731BBDF8A619EABD6DF87E33E4C06DF06959BDC5 -------------------------------------------------------------------------- File : ChatExport_2026-04-06 (1)\images\media_location@2x.png Size : 991 bytes Created : 2026-04-07 00:46:14.671 UTC Modified: 2026-04-07 00:46:14.671 UTC MD5 : 9E44ECDB67EABD8DCE80F575EBBCF009 SHA-256 : 5D67983D47374ADA4EB55697A8CC2ABF93743B9F22866A6A6BA26F75F28B3582 -------------------------------------------------------------------------- File : ChatExport_2026-04-06 (1)\images\media_music.png Size : 275 bytes Created : 2026-04-07 00:46:14.672 UTC Modified: 2026-04-07 00:46:14.672 UTC MD5 : FB32295AA1CB4951D9A8DE8B1EA89857 SHA-256 : 6779336F0362A73DA8B7EA33DCE0E73FE83BCE17597378445C117E07DD6020B3 -------------------------------------------------------------------------- File : ChatExport_2026-04-06 (1)\images\media_music@2x.png Size : 464 bytes Created : 2026-04-07 00:46:14.672 UTC Modified: 2026-04-07 00:46:14.672 UTC MD5 : 3CC61F082146FDBDA2C6D56CAE6F0B31 SHA-256 : F6B15FF44A9D49E72C1CA58CE297E514EB686A724C1792A13B877CC25647151A -------------------------------------------------------------------------- File : ChatExport_2026-04-06 (1)\images\media_photo.png Size : 243 bytes Created : 2026-04-07 00:46:14.673 UTC Modified: 2026-04-07 00:46:14.673 UTC MD5 : 23DD4A8B9E05C8AD597624086F3A63F2 SHA-256 : 68C3AD119B7F075C74FB1297ED6F81309DBA5262274C98CC99DA9C3A2D2ACCFF -------------------------------------------------------------------------- File : ChatExport_2026-04-06 (1)\images\media_photo@2x.png Size : 458 bytes Created : 2026-04-07 00:46:14.673 UTC Modified: 2026-04-07 00:46:14.673 UTC MD5 : 1205510D631493CB5D4D7AD355ED1E58 SHA-256 : A995F172AD5EEA6FCD6D4357EEC864CEAD122642EEEF3AA86B01A9026085BDB5 -------------------------------------------------------------------------- File : ChatExport_2026-04-06 (1)\images\media_shop.png Size : 377 bytes Created : 2026-04-07 00:46:14.674 UTC Modified: 2026-04-07 00:46:14.674 UTC MD5 : 116474B4EE28ED4E2FEC80D8A5109354 SHA-256 : 950A9F3EB7E7CED0467702565E682CC8C72D9808C2A1B0C14FB585BA5E388D2F -------------------------------------------------------------------------- File : ChatExport_2026-04-06 (1)\images\media_shop@2x.png Size : 790 bytes Created : 2026-04-07 00:46:14.674 UTC Modified: 2026-04-07 00:46:14.674 UTC MD5 : 7E1BF9613350BA0848BDCE2BDE2796B5 SHA-256 : DDB88B92F1BD8F6B04F561AC52AFD54AB5F4840381AFD0809251D8D85B58A200 -------------------------------------------------------------------------- File : ChatExport_2026-04-06 (1)\images\media_video.png Size : 235 bytes Created : 2026-04-07 00:46:14.674 UTC Modified: 2026-04-07 00:46:14.675 UTC MD5 : D5F46D81FC6C799C0D4D680924D21AF9 SHA-256 : 6053DAD4203B7C611298C91F7DB337B24DD9E520F2F139ED02D6141553DE12C3 -------------------------------------------------------------------------- File : ChatExport_2026-04-06 (1)\images\media_video@2x.png Size : 411 bytes Created : 2026-04-07 00:46:14.675 UTC Modified: 2026-04-07 00:46:14.675 UTC MD5 : FA604B08742C5F8CECA997C733BF5751 SHA-256 : 1E67C221AFA14B6AD28CB747FE919227F6B842059C65BC191269263AFBC7C529 -------------------------------------------------------------------------- File : ChatExport_2026-04-06 (1)\images\media_voice.png Size : 328 bytes Created : 2026-04-07 00:46:14.676 UTC Modified: 2026-04-07 00:46:14.676 UTC MD5 : B014509AEECBD71CFFBCB5BE30553271 SHA-256 : 531D7E79C2FF8260F99F48E197ED4FF105FB3D395BD6E4BE22DCA048F698DF4B -------------------------------------------------------------------------- File : ChatExport_2026-04-06 (1)\images\media_voice@2x.png Size : 660 bytes Created : 2026-04-07 00:46:14.676 UTC Modified: 2026-04-07 00:46:14.676 UTC MD5 : 6D17BF1405707430BE49B9AD096E2DA3 SHA-256 : B37C63673D99D3A9167BCFE7045C27DFEA29970D8AA5CE4F80083646DCB59AC6 -------------------------------------------------------------------------- File : ChatExport_2026-04-06 (1)\images\section_calls.png Size : 656 bytes Created : 2026-04-07 00:46:14.676 UTC Modified: 2026-04-07 00:46:14.676 UTC MD5 : C4706C71AA3CC5AA10364A5BD6A6C054 SHA-256 : B347D0BB33954AAC124506D9CE9A0E556F235CB579AB853EBFD562617CE9A7C3 -------------------------------------------------------------------------- File : ChatExport_2026-04-06 (1)\images\section_calls@2x.png Size : 1300 bytes Created : 2026-04-07 00:46:14.676 UTC Modified: 2026-04-07 00:46:14.676 UTC MD5 : BF8D32DB2C9DE962B3F55AB98E387823 SHA-256 : DECD35472A556FE7EC6A1F2DBE3A9442D125E0922854B785476227A376D02CF8 -------------------------------------------------------------------------- File : ChatExport_2026-04-06 (1)\images\section_chats.png Size : 283 bytes Created : 2026-04-07 00:46:14.678 UTC Modified: 2026-04-07 00:46:14.678 UTC MD5 : 6497DA5B62341ACE2138C0EBECCBEAA6 SHA-256 : CA9E5266DE6DC1C49DEAD1E1A1686F52C89B94C9904D0952FAC607D1E3ED16B8 -------------------------------------------------------------------------- File : ChatExport_2026-04-06 (1)\images\section_chats@2x
Group 2 — Broadcast Channel (ID 3461376041)
Source: ForensicHashManifest_Group_3461376041.txt
Channel: leaked kindom (broadcast) · Subscribers: 478 · Messages: 85 · Created: 2025-11-17T16:35:35 UTC
| Evidence file | Size (bytes) | MD5 | SHA-256 |
|---|---|---|---|
| FULL json | 57,947 | CB48A156894191889CE847FB1307062A | 5F4EDAB2348AA96700E81B31E6968143857F1183A74731BEA097B6AF749BF8FA |
| messages csv | 23,038 | 665C6226981897D4B3B8613214594D34 | 484D799CBAA0E3096D92A9FCB434EDA63F1E3B072FAC977809C008DDA9211323 |
| report txt | 15,070 | 6171CBD53133F0B8B460612320600B49 | A05B3BC74259F7ED69860E4C39552D9DA26901EE99E7626ADA94730E4DE79B91 |
| admins csv | 90 | 12687EC85E32FA55EAA2619C4F50A2D2 | 0D3E744B46983032ADEA407187463244200021E5F42A2EC4C2A8DD19FF1C6868 |
| members csv | 70 | AF5266450FFA3B37FA40E05009ABC6E9 | 0ABE6B8491955B8797B602CEC82BEEA63864659CE0537D241EEDE122A0264CD2 |
Hashing: MD5 (RFC 1321) + SHA-256 (FIPS 180-4) · Crypto provider: .NET System.Security.Cryptography (FIPS-capable) · Standards: NIST SP 800-86, NIST CFTT, DOJ ECMU