Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
SHA256e93244080a749b521f63476343ce3c81cc8c1b672fa0d9e67359aee37544c784MediumDomainupl.natcloudservice.comMediumIP103.231.91.59MediumMD54fdabe571b66ceec3448939bfb3ffcd1MediumIP103.75.11.78MediumIP103.93.145.33Medium