Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
IP164.160.187.69HighIP196.188.116.63HighIP196.189.236.67MediumIP196.190.10.252MediumIP213.55.79.194MediumIP196.188.57.14MediumIP196.188.76.254MediumIP196.189.155.89MediumIP196.189.124.195MediumSHA1e682ede655fb6ed3b6285f10dfd7c68105a1fce0HighIP196.191.50.58MediumIP196.189.191.8MediumDomainfastpool.xyzMediumDomainportal-microsoftonline.comMediumIP196.189.19.206MediumIP196.188.104.221Medium