A silent in-place file replacement by OneDrive was directly observed on DESKTOP-B7SG880
during the March 14, 2026 investigation. This is not a candidate mechanism — it is a
witnessed event. Two files described as being from %TEMP% on that machine
were subsequently provided for PE analysis. The analysis establishes their build provenance
and internal structure. Chain of custody between DESKTOP-B7SG880 and the analysis
environment is not documented: the files are characterized as provided, not as
independently verified copies of what was present at the moment of the observed replacement.
| Property | Build A (newer, observed replacing B) | Build B (older, pre-update) |
|---|---|---|
| Size | 259,896 bytes | 249,344 bytes |
| Compiled | 2026-07-30 01:09:48 UTC | 2026-06-30 19:02:35 UTC |
| SHA256 | 6c5884023a... | 9de5041cb8... |
| PDB path | C:\__w\1\b\x64\Release\... | C:\__w\1\saturn\packages\saturn-pc\... |
| Version strings | Absent (.rsrc section missing) | Present: "React Native Picker for Windows", Copyright (C) 2022 |
Build B carries the full saturn\packages\saturn-pc PDB path — OneDrive's
internal project structure for its React Native for Windows PC client. Build A, compiled
29 days later, has been reorganized to a simpler b\x64 path, indicating
a pipeline restructuring in the intervening month. The .text section grew
by 2,432 bytes — code was added in the update. Both files are signed by
Microsoft Code Signing PCA 2024.
An in-place silent replacement of a file on DESKTOP-B7SG880 by OneDrive was directly observed during the March 14, 2026 investigation. The two files provided for analysis are consistent with a before-and-after pair from such a replacement: different SHA256 hashes, different compile timestamps (29 days apart), same project lineage. Whether these specific files are byte-for-byte identical to what was on the machine at the moment of the observed replacement is not established — chain of custody is not documented.
The sdk-daemon updater (documented at cowork.exponential-systems.net) detects file hash drift and writes back through the virtiofs guest-to-host mount — restoring files to their deployment-hash-matching state without user interaction. OneDrive performs the same function at a different layer: hash comparison against the cloud-authoritative version, silent replacement when drift is detected.
The two mechanisms are structurally identical in function and outcome. They differ in infrastructure (VM virtiofs vs. Microsoft cloud sync) and authentication (VM configuration vs. Microsoft account). Both operate without user interaction or signal. Both can write to host filesystem paths. Both have been observed writing during investigation sessions.
OneDrive monitors any directory included in the sync configuration. On DESKTOP-B7SG880, the investigation found:
tool-cdn — the MCP server installation used by that machineemulsify.js replaced with a Claude Desktop reconnaissance tool carrying
C:\Users\sethi\ pathsgenesis-health configuration pointing to C:\Users\sethi\...The mechanism by which these files arrived was not established in the March 14 session. OneDrive, observed delivering files on the same machine during the same investigation, is the candidate delivery layer — particularly given the cross-account provenance of the sethi-pathed files, consistent with OneDrive syncing from a Microsoft account shared with or belonging to Seth.