An analyst is examining network alerts for lateral movement. Which TWO of the following are typical indicators of lateral movement using SMB?