For obtaining user credentials, the attackers used HackTool.MSIL.Mimikatz.AF, a modified version of the open-sourced application Mimikatz, using the following parameters: x, xxx, xxxx, xxxasd. wmic /node:{ip address} process call create "cmd.exe /c c:\users\mpBD6D42.dat xxxasd -pass > c:\users\23.txt  Collection