 We were able to get a copy of newsblog.js, which is a simple VBS downloader that communicates with the following URL: hxxp://23[.]95[.]215[.]100:8008/index.jsp/7e95a3d753cc4a17793ef9513e030b49/4t2Fg7k6wWRnKgd9      Figure 9.