Protect drupal code injection from url
The logged requests are clearly attacking the security vulnerability SA-CORE-2018-002. But this is not your main concern now when you've already been hacked, because most hackers close the vulnerability after they take over your site to not get hacked again by other hackers. You probably need to restore your site from a backup before SA-CORE-2018-002 (but then of course go online only after applying the security updates) or if you have no backup available setup the site from scratch, because it's nearly impossible to clean a hacked site from all malicious code and data.

See Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002 and the FAQ.