# Phase 0.9E-R2 local download provenance

Date: 2026-07-19

Result: `MEDIAFIRE_URL_EXACT`

This evidence is host-only. No PS5 address, request, connection, transfer,
restore, target build, or execution was used.

## Local object

| Field | Value |
|---|---|
| name | `Y2JB-Autoloader-403-1240.zip` |
| size | `504159435` |
| SHA-256 | `805e3f87f0c371223619ffc7d3a7b3c0d41a1fae8a8b1171d9e2f162659e8291` |
| creation UTC | `2026-06-23T14:10:39.0466596Z` |
| modification UTC | `2026-06-23T14:11:10.6992328Z` |

The file was read without changing it. Its `Zone.Identifier` alternate data
stream is 327 bytes and has SHA-256
`70928a3d66cbb9f584596414c4fe535b498dd5ed7c5f55bbeae4efeb146ea841`.
It contains exactly the `ZoneTransfer` section and these fields:

| Field | Safe evidence |
|---|---|
| `ZoneId` | `3` |
| `ReferrerUrl` | host `www.mediafire.com`, path `/`, no query; full-value SHA-256 `9a0ff5a3e34286b2e53192003fca8b6c7b00ad6df3c681765da04ccaa54c0919` |
| `HostUrl` | host `download2434.mediafire.com`, file key `jq3fcutuwbb1mrb`, filename `Y2JB-Autoloader-403-1240.zip`; full-value SHA-256 `a39f05923d0a5368ea5138c1974ac109bb09f8ab795c6edb8e470d8dfe4d784c` |
| `LastWriterPackageFamilyName` | absent |
| `AppZoneId` | absent |
| other fields | none |

The transient signed path component is deliberately redacted. It was neither
committed nor reproduced here. The complete value remains only in the
unchanged local ADS.

## Browser metadata

The bounded search covered existing Chrome Default, Chrome System Profile,
and Edge Default Chromium History databases. The query was limited to the
exact filename, size, filesystem-date window, MediaFire host, and file key.
Brave, standalone Chromium, Opera, and Opera GX profiles were absent.

Three read-only database copies were made because browser databases can be
live-locked. Chrome Default, Chrome System Profile, and Edge Default each
returned `NO_MATCH`; no download rows were exported and the originals were
not changed. The temporary copies were removed with the rest of the research
directory.

Browser classification: `NO_BROWSER_HISTORY_MATCH`.

## Exact MediaFire page

Only
`https://www.mediafire.com/file/jq3fcutuwbb1mrb/Y2JB-Autoloader-403-1240.zip/file`
was requested. Static HTML was 333321 bytes with SHA-256
`655e4c3c2e5c423019b0195ca863ee8906f7ca02601b773b39688a590bf7fcb7`.
It displayed:

- filename `Y2JB-Autoloader-403-1240.zip`;
- size `480.8MB`;
- uploaded value `2026-06-11 15:32:16`;
- upload country `United Kingdom`;
- the same MediaFire file key.

No public account/uploader, user description, tutorial, maker, server digest,
or exact server byte count was exposed. The download object was not
downloaded again. The local ADS plus page provide
`MEDIAFIRE_OBJECT_METADATA_BOUND`, not `MEDIAFIRE_OBJECT_BYTE_BOUND` and not
maker/source provenance.

## Boundary

The download-origin classification is `MEDIAFIRE_URL_EXACT`. That describes
where the local bytes were downloaded from. It does not prove who created
them, which public source generated them, whether they were restored, or what
is currently on the PS5.