HollowMare browser kill + profile config overwrite for search engine hijack

Ethan Andrews@eandrews

•updated Jul 28, 2026•3•0•10

Detects HollowMare variants (OneZip/CrystalPDF/PowerDoc) that terminate a running Chrome or Firefox process immediately before overwriting a browser profile configuration file (Preferences, Secure Preferences, prefs.js) with a C2-supplied version to hijack the default search engine.