3.0 KiB
Phase 0.9E-R2 local download provenance
Date: 2026-07-19
Result: MEDIAFIRE_URL_EXACT
This evidence is host-only. No PS5 address, request, connection, transfer, restore, target build, or execution was used.
Local object
| Field | Value |
|---|---|
| name | Y2JB-Autoloader-403-1240.zip |
| size | 504159435 |
| SHA-256 | 805e3f87f0c371223619ffc7d3a7b3c0d41a1fae8a8b1171d9e2f162659e8291 |
| creation UTC | 2026-06-23T14:10:39.0466596Z |
| modification UTC | 2026-06-23T14:11:10.6992328Z |
The file was read without changing it. Its Zone.Identifier alternate data
stream is 327 bytes and has SHA-256
70928a3d66cbb9f584596414c4fe535b498dd5ed7c5f55bbeae4efeb146ea841.
It contains exactly the ZoneTransfer section and these fields:
| Field | Safe evidence |
|---|---|
ZoneId |
3 |
ReferrerUrl |
host www.mediafire.com, path /, no query; full-value SHA-256 9a0ff5a3e34286b2e53192003fca8b6c7b00ad6df3c681765da04ccaa54c0919 |
HostUrl |
host download2434.mediafire.com, file key jq3fcutuwbb1mrb, filename Y2JB-Autoloader-403-1240.zip; full-value SHA-256 a39f05923d0a5368ea5138c1974ac109bb09f8ab795c6edb8e470d8dfe4d784c |
LastWriterPackageFamilyName |
absent |
AppZoneId |
absent |
| other fields | none |
The transient signed path component is deliberately redacted. It was neither committed nor reproduced here. The complete value remains only in the unchanged local ADS.
Browser metadata
The bounded search covered existing Chrome Default, Chrome System Profile, and Edge Default Chromium History databases. The query was limited to the exact filename, size, filesystem-date window, MediaFire host, and file key. Brave, standalone Chromium, Opera, and Opera GX profiles were absent.
Three read-only database copies were made because browser databases can be
live-locked. Chrome Default, Chrome System Profile, and Edge Default each
returned NO_MATCH; no download rows were exported and the originals were
not changed. The temporary copies were removed with the rest of the research
directory.
Browser classification: NO_BROWSER_HISTORY_MATCH.
Exact MediaFire page
Only
https://www.mediafire.com/file/jq3fcutuwbb1mrb/Y2JB-Autoloader-403-1240.zip/file
was requested. Static HTML was 333321 bytes with SHA-256
655e4c3c2e5c423019b0195ca863ee8906f7ca02601b773b39688a590bf7fcb7.
It displayed:
- filename
Y2JB-Autoloader-403-1240.zip; - size
480.8MB; - uploaded value
2026-06-11 15:32:16; - upload country
United Kingdom; - the same MediaFire file key.
No public account/uploader, user description, tutorial, maker, server digest,
or exact server byte count was exposed. The download object was not
downloaded again. The local ADS plus page provide
MEDIAFIRE_OBJECT_METADATA_BOUND, not MEDIAFIRE_OBJECT_BYTE_BOUND and not
maker/source provenance.
Boundary
The download-origin classification is MEDIAFIRE_URL_EXACT. That describes
where the local bytes were downloaded from. It does not prove who created
them, which public source generated them, whether they were restored, or what
is currently on the PS5.