File scan report
Verdict Safe
Is Magic
No antivirus engine detected the Chrome extension, and one sandbox found no offensive behavior, though its direct-IP contacts lack a completed reputation check.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website it came from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 62 flagged
- Flagged 0
- No detection 62
- No result 14
- Code signing Not applicable
- Test run Completed
- First seen 12mo ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
All 62 antivirus engines that checked it were free of detections, including 17 major antivirus engines, and the completed sandbox run produced no malware verdict or offensive techniques. Direct-IP traffic was observed, but its reputation was not fully checked; this limits certainty without outweighing the otherwise consistent evidence.
The Chrome extension received no malicious or suspicious detections from 76 engines, with all 17 reporting major antivirus engines remaining silent. One completed sandbox run observed browser-extension techniques and but no offensive techniques, persistence indicators, or malware verdict. Ten extracted files were inspected without a malicious-child finding, although their individual verdicts remain unknown. A medium-severity direct-IP behaviour rule matched after seven external unicast contacts, and no complete host-reputation cross-check is available. No YARAify, CIRCL, or MalwareBazaar intelligence corroborated malware activity.
What We Detected
No malicious or suspicious detection appeared among 76 antivirus engines. Seventeen major antivirus engines, including Avast, BitDefender, ESET-NOD32, Kaspersky, and Microsoft, reported no detection. Research intelligence also returned no YARAify rules, CIRCL match, or MalwareBazaar record.
Threat Behavior
One sandbox run loaded and unpacked the Chrome extension. It recorded T1176 and T1185, which are compatible with extension and browser activity, but found no offensive techniques, persistence indicators, or malicious sandbox verdict. A direct-IP behaviour rule matched because seven external unicast IP addresses were contacted without recorded application domains. Because contactedHosts is unavailable, those contacts do not have a complete reputation result. Ten extracted files were inspected without a malicious-child finding, but their individual classifications remain unknown.
What To Do Now
Install the extension only from its official browser-store listing or verified publisher channel, and review the permissions Chrome requests. Keep browser and security software enabled, especially if the package came from an unofficial download site.
Where this verdict could be wrong2 caveats
- One of our behaviour rules fired because the sandbox recorded seven external unicast IP addresses without application domains; no complete host-reputation result is available because no contacted-host reputation result was saved.
- The 10 extracted files it created have unknown individual verdicts despite the absence of a known-malicious dropped file, limiting assurance about their contents.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/62 engines reported malicious or suspicious detections.
- No major antivirus engines flagged it and 17 major antivirus engines reported it clean.
- No offensive techniques were mapped and no sandbox returned a malicious verdict.
- No dropped file is known to be malicious after 10 inspected children.
- No community YARA rule matched, the hash is not in the known-software reference database, and the hash is not listed in the MalwareBazaar malware database.
- One of our behaviour rules fired for seven external unicast IP contacts.
- No contacted-host reputation result was saved, so no complete reputation cross-check exists for observed IP contacts.
- All 10 extracted files it created retain unknown individual verdicts.
- A community reputation score of 0 and a count of 12 submissions provide limited reputation history.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 2sandbox rule tags
- 5spawned processes
- 7network contacts
- 18filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
2MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1176
- T1185
Observed activity
Processes started
5Programs the file ran, with their command lines.
chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=C:\Users\<USER>\AppData\Local\Temp\sample "http://about:blank"chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\<USER>\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\<USER>\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=141.0.7390.108 --initial-client-data=0x200,0x204,0x208,0x1bc,0x20c,0x7ffa3f8d0868,0x7ffa3f8d0874,0x7ffa3f8d08807za.exeC:\Windows\System32\7za.exe 7za.exe x -oC:\chrome "C:\Users\user\Desktop\addon.crx"chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension=C:\chromechrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1816,i,5447673486672534708,5800920501404887614,262144 --variations-seed-version=20250309-183315.488000 --mojo-platform-channel-handle=2148 /prefetch:11
Network contacts
77 hosts, listed as 7 addresses. Links show the host and path only.
- IP address
173.194.202.84 - IP address
192.178.163.94 - IP address
173.194.203.141 - IP address
192.178.163.190 - IP address
74.125.135.113 - IP address
173.194.203.188
Show all 7 entries for network contacts
- IP address
142.250.99.100
Files
18Files the file created, changed or deleted.
- Written
C:\chrome\_locales - Written
C:\chrome\_locales\en - Written
C:\chrome\_locales\en\messages.json - Written
C:\chrome\_metadata - Written
C:\chrome\_metadata\verified_contents.json - Written
C:\chrome\ectrb30.html
Show all 18 entries for files
- Written
C:\chrome\edialog30.html - Written
C:\chrome\emenu30.html - Written
C:\chrome\eopt30.html - Written
C:\chrome\eoptions30.html - Written
C:\chrome\erenewed30.html - Written
C:\chrome\esw30.js - Written
C:\chrome\ever30.html - Written
C:\chrome\gcss30 - Written
C:\chrome\gcss30\ectrb30.css - Deleted
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\e483cfd1-5fe0-4d18-99df-c44b5abdf0fa.tmp - Deleted
C:\chrome\_metadata - Deleted
C:\chrome\_metadata\verified_contents.json
Registry and auto-start
1Settings the file changed, including ways to start again after a restart.
- Deleted
HKEY_CURRENT_USER\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings
Sandbox background — not the file
2The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM host
224.0.0.251
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 28e391060106b4036d6c…e356c6Not checkedno saved verdict
- 2e27ac7706dc08d93c11…57ff93Not checkedno saved verdict
- eea40256b526e353abb2…0777c5Not checkedno saved verdict
- 4d9ccef0b8161497cade…57dbb6Not checkedno saved verdict
- 58970dd60fbc73c8a9c4…ce9e9dNot checkedno saved verdict
- 28c3140facb17ed97644…aa99c7Not checkedno saved verdict
- b14f358cfdada01e1dcd…1bd3a4Not checkedno saved verdict
- 897eff05c412fe8cb9c7…7264d4Not checkedno saved verdict
- c8d3bf1db39f734c3da4…19bd67Not checkedno saved verdict
- ed8fd76fe892d5aa4ee7…07a4edNot checkedno saved verdict
Chapter 04
Technical details
None of the 62 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Sep 9, 2026, 6:27 PM UTC
- SHA-256
df9a8a4ea4f83d656fd94898011ebb3e75f8be400a439fcbb75c013a02034f22- SHA-1
c9f08109c54389b47b67af92bbf506667d2a3033- MD5
7c6fe69b0571a2a7982ccdd442a2df21
About this file
MagicActions_Latest.crx is a Google Chrome Extension file of 173.7 kB.
- Type and size
- Google Chrome Extension · 173.7 kB
- Signer
- Not applicable
- First seen
- Oct 30, 2025On VirusTotal.
- Submitted by
- 10 distinct sources
First scanned
Antivirus consensus
0 of 62 engines flagged this file
14 of the 76 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-232 engines0flagged
- Low-trust12 engines0flagged
View all 76 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneNo result
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootNo result
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is MagicActions_Latest.crx safe?
What is MagicActions_Latest.crx?
How many antivirus engines detected MagicActions_Latest.crx?
What is the SHA-256 hash of MagicActions_Latest.crx?
Is it safe to open MagicActions_Latest.crx?
How up to date is this analysis of MagicActions_Latest.crx?
Community
Member reviews and reports for this exact file hash.