Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
MD5ff3f660c9dc3e3ea3b463f3bcccc55c8LowIP41.208.71.226MediumIP154.127.69.24MediumDomainedgeupdate-security-windows.comHighDomainexcsrvcdn.comMediumDomaincybersecnet.orgMediumDomainhpesystem.comMediumDomaindnscatalog.netHighIP102.38.8.32Medium