I'm looking at one of our compromised web server logs and we found that an attacker has uploaded a file with multiple extension. Below is the IIS log. The log format are as below. I have removed the cookies and user agent values as they are a bit long and irrelevant.

#Fields: date time cs-uri-stem cs-uri-query c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) sc-status sc-substatus sc-bytes time-taken 

One of line, we found this log

2012-03-09 02:49:16 /preview.asp path=./submit/file_20120222_ext_20120309_1049.asp;_20120309_1049.jpg&width=300|17|80040035|Not_a_JPEG_file:_starts_with_0x3c_0x25 xxx.xxx.xxx.xxx HTTP/1.1 - - http://xxx.xxx.xxx.xxx/mail.asp?err=2 500 0 471 203

then on the following line, we found the following log

2012-03-09 02:51:03 /submit/fle_20120222_ext_20120309_1049.asp;_20120309_1049.jpg - xxx.xxx.xxx.xxx - - - 403 1 1918 0

Does anyone have any idea if the malicious file is triggered in line 1 of the log or line 2 of the log?