IOC Report
http://source.tandemdiabetes.com

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 05:20:04 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 05:20:04 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:56:51 2023, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 05:20:04 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 05:20:04 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 05:20:04 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 70
JSON data
downloaded
Chrome Cache Entry: 71
GIF image data, version 89a, 1 x 1
dropped
Chrome Cache Entry: 72
GIF image data, version 89a, 1 x 1
dropped
Chrome Cache Entry: 73
GIF image data, version 89a, 1 x 1
dropped
Chrome Cache Entry: 74
ASCII text, with very long lines (65410)
dropped
Chrome Cache Entry: 75
ASCII text, with very long lines (65410)
downloaded
Chrome Cache Entry: 76
GIF image data, version 89a, 1 x 1
dropped
Chrome Cache Entry: 77
GIF image data, version 89a, 1 x 1
dropped
Chrome Cache Entry: 78
GIF image data, version 89a, 1 x 1
dropped
Chrome Cache Entry: 79
JSON data
dropped
Chrome Cache Entry: 80
JSON data
dropped
Chrome Cache Entry: 81
ASCII text, with very long lines (19963)
dropped
Chrome Cache Entry: 82
ASCII text, with very long lines (58905)
downloaded
Chrome Cache Entry: 83
GIF image data, version 89a, 1 x 1
dropped
Chrome Cache Entry: 84
ASCII text, with very long lines (65460)
dropped
Chrome Cache Entry: 85
ASCII text, with very long lines (19963)
downloaded
Chrome Cache Entry: 86
GIF image data, version 89a, 1 x 1
dropped
Chrome Cache Entry: 87
GIF image data, version 89a, 1 x 1
dropped
Chrome Cache Entry: 88
ASCII text, with very long lines (57301)
dropped
Chrome Cache Entry: 89
ASCII text, with very long lines (57301)
downloaded
Chrome Cache Entry: 90
ASCII text, with very long lines (65460)
downloaded
There are 18 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2324,i,8968211654569054261,1032098824811210386,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://source.tandemdiabetes.com"

URLs

Name
IP
Malicious
http://source.tandemdiabetes.com
https://js-agent.newrelic.com/nr-loader-spa-current.min.js
162.247.243.39
https://source.tandemdiabetes.com/
https://js.monitor.azure.com/scripts/b/ai.3.gbl.min.js
13.107.246.45
https://bam.nr-data.net/events/1/7f6a29edb9?a=1120146662&sa=1&v=1.270.1&t=Unnamed%20Transaction&rst=12762&ck=0&s=0&ref=https://source.tandemdiabetes.com/&ptid=b8de779d55641228
162.247.243.29
https://bam.nr-data.net/jserrors/1/7f6a29edb9?a=1120146662&sa=1&v=1.270.1&t=Unnamed%20Transaction&rst=62822&ck=0&s=0&ref=https://source.tandemdiabetes.com/&ptid=b8de779d55641228
162.247.243.29
https://js-agent.newrelic.com/nr-spa-1.270.1.min.js
162.247.243.39
https://bam.nr-data.net/jserrors/1/7f6a29edb9?a=1120146662&sa=1&v=1.270.1&t=Unnamed%20Transaction&rst=72833&ck=0&s=0&ref=https://source.tandemdiabetes.com/&ptid=b8de779d55641228
162.247.243.29
https://js.monitor.azure.com/scripts/b/ai.config.1.cfg.json
13.107.246.45
https://bam.nr-data.net/jserrors/1/7f6a29edb9?a=1120146662&sa=1&v=1.270.1&t=Unnamed%20Transaction&rst=22757&ck=0&s=0&ref=https://source.tandemdiabetes.com/&ptid=b8de779d55641228
162.247.243.29
https://bam.nr-data.net/1/7f6a29edb9?a=1120146662&sa=1&v=1.270.1&t=Unnamed%20Transaction&rst=11093&ck=0&s=0&ref=https://source.tandemdiabetes.com/&ptid=b8de779d55641228&af=err,spa,xhr,stn,ins&be=2083&fe=4229&dc=4222&perf=%7B%22timing%22:%7B%22of%22:1730096403737,%22n%22:0,%22f%22:801,%22dn%22:803,%22dne%22:878,%22c%22:878,%22s%22:878,%22ce%22:1920,%22rq%22:1920,%22rp%22:2084,%22rpe%22:2085,%22di%22:3940,%22ds%22:6305,%22de%22:6305,%22dc%22:6311,%22l%22:6311,%22le%22:6312%7D,%22navigation%22:%7B%7D%7D
162.247.243.29
https://bam.nr-data.net/jserrors/1/7f6a29edb9?a=1120146662&sa=1&v=1.270.1&t=Unnamed%20Transaction&rst=52802&ck=0&s=0&ref=https://source.tandemdiabetes.com/&ptid=b8de779d55641228
162.247.243.29
https://bam.nr-data.net/jserrors/1/7f6a29edb9?a=1120146662&sa=1&v=1.270.1&t=Unnamed%20Transaction&rst=42787&ck=0&s=0&ref=https://source.tandemdiabetes.com/&ptid=b8de779d55641228
162.247.243.29
https://bam.nr-data.net/events/1/7f6a29edb9?a=1120146662&sa=1&v=1.270.1&t=Unnamed%20Transaction&rst=32776&ck=0&s=0&ref=https://source.tandemdiabetes.com/&ptid=b8de779d55641228
162.247.243.29
https://bam.nr-data.net/events/1/7f6a29edb9?a=1120146662&sa=1&v=1.270.1&t=Unnamed%20Transaction&rst=22758&ck=0&s=0&ref=https://source.tandemdiabetes.com/&ptid=b8de779d55641228
162.247.243.29
https://bam.nr-data.net/events/1/7f6a29edb9?a=1120146662&sa=1&v=1.270.1&t=Unnamed%20Transaction&rst=42756&ck=0&s=0&ref=https://source.tandemdiabetes.com/&ptid=b8de779d55641228
162.247.243.29
https://bam.nr-data.net/jserrors/1/7f6a29edb9?a=1120146662&sa=1&v=1.270.1&t=Unnamed%20Transaction&rst=32772&ck=0&s=0&ref=https://source.tandemdiabetes.com/&ptid=b8de779d55641228
162.247.243.29
There are 6 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
fastly-tls12-bam.nr-data.net
162.247.243.29
s-part-0044.t-0009.fb-t-msedge.net
13.107.253.72
app.harness.io
35.201.91.229
js-agent.newrelic.com
162.247.243.39
s-part-0017.t-0009.t-msedge.net
13.107.246.45
s-part-0017.t-0009.fb-t-msedge.net
13.107.253.45
www.google.com
172.217.16.196
fp2e7a.wpc.phicdn.net
192.229.221.95
js.monitor.azure.com
unknown
source.tandemdiabetes.com
unknown
bam.nr-data.net
unknown
westus2-2.in.applicationinsights.azure.com
unknown
modules.us.tandemdiabetes.com
unknown
There are 3 hidden domains, click here to show them.

IPs

IP
Domain
Country
Malicious
35.201.91.229
app.harness.io
United States
13.107.246.45
s-part-0017.t-0009.t-msedge.net
United States
13.107.253.45
s-part-0017.t-0009.fb-t-msedge.net
United States
192.168.2.9
unknown
unknown
13.107.253.72
s-part-0044.t-0009.fb-t-msedge.net
United States
239.255.255.250
unknown
Reserved
162.247.243.29
fastly-tls12-bam.nr-data.net
United States
162.247.243.39
js-agent.newrelic.com
United States
172.217.16.196
www.google.com
United States

DOM / HTML

URL
Malicious
https://source.tandemdiabetes.com/
https://source.tandemdiabetes.com/