Smb Remote Executable Drop Mywallet

Composite behavior identifying authenticated SMB access to IPC$ and data shares followed by a file overwrite operation creating MyWallet.exe. The sequence indicates remote delivery and staging of a Windows executable over SMB, consistent with lateral movement or payload deployment activity using administrative share access.