Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Domaindriverservices.storeMediumDomaindafom.devMediumSHA2561de949c71efcfb0ffc41f33d38833dbc4b082075b1a540fc68c18c535d7ad86cHighSHA1b68c0cf7d1e563dad02fb2fad3590e43399c140bHighSHA1d49cbc10f8d484108c2aeec652c1f77fa933a657HighSHA256ed8ec7a8dd089019cfd29143f008fa0951c56a35d73b2e1b274315152d0c0ee6MediumSHA25623e37cf4e2a7d55ed107b3bc3eb7812a0e3d8f90b23b0c8f549d5c10d089a2c8MediumSHA2560160375e19e606d06f672be6e43f70fa70093d2a30031affd2929a5c446d07c1MediumDomaincoralsunmarine.comMediumDomainwriteup.liveMediumDomainfundcandidates.comMediumMD50fad9f97489c8a175e7c66c3dba59a97HighSHA256c2500a6e12f22b16e221ba01952b69c92278cd05632283d8b84c55c916efe27cMediumDomainsupport.us05web-zoom.proMediumSHA25616f413862efda3aba631d8a7ae2bfff6d84acd9f454a7adaa518c7a8a6f375a5MediumSHA2567c5adef4b5aee7a4aa6e795a86f8b7d601618c3bc003f1326ca57d03ec7d6524HighSHA256f1b33341b0dc25c84b92e6b3bc62125a216d62e746d06560a28f68deead406b9HighSHA1e1ff89f8b2830778ee9bdae64ab94fc64d16af5aMediumSHA12d746dda85805c79b5f6ea376f97d9b2f547da5dMedium