Dissection of the “frm_frame” injection script