 hxxp://207[.]148[.]94[.]157/update/rcv50/update.zip hxxp://207[.]148[.]94[.]157/update/rcv50/file000.zip hxxp://207[.]148[.]94[.]157/update/rcv50/file001.zip  URLs related to additionally downloaded malicious files: