drop chrome or firefox extension directories or crx files · map all installed extensions · detect persistence via extensions · suspicious permissions · obfuscated background scripts · data exfiltration capabilities · runs locally
drop crx · xpi · zip · manifest.json