chrmstp.exe
Sources: 300M+ executions observed in the wild and observed in the EchoTrail lab on Windows 11.
Summary
Chrome Master Preferences Tool - applies enterprise Chrome configuration during installation.
chrmstp.exe is the 1141st most commonly executed Windows program in EchoTrail's dataset, observed 1,488 times across enterprise environments. It typically runs from C:\Program Files (x86)\Google\Chrome\Application\64.0.3282.186\Installer and it is most often launched by chrmstp.exe.
Get this in your tools
The same record for chrmstp.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/chrmstp.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Program Files (x86)\Google\Chrome\Application\64.0.3282.186\Installer9.01%
- C:\Program Files (x86)\Google\Chrome\Application\66.0.3359.181\Installer8.87%
- C:\Program Files (x86)\Google\Chrome\Application\65.0.3325.181\Installer6.18%
- C:\Program Files (x86)\Google\Chrome\Application\66.0.3359.139\Installer4.44%
- C:\Program Files (x86)\Google\Chrome\Application\71.0.3578.98\Installer4.3%
- C:\Program Files (x86)\Google\Chrome\Application\63.0.3239.132\Installer3.49%
- C:\Program Files (x86)\Google\Chrome\Application\64.0.3282.140\Installer2.69%
- C:\Program Files (x86)\Google\Chrome\Application\64.0.3282.119\Installer2.42%
- C:\Program Files (x86)\Google\Chrome\Application\64.0.3282.167\Installer2.28%
- C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\Installer2.15%
- C:\Program Files\Google\Chrome\Application\153.0.8010.37\Installer
Top Hashes (SHA256)
- 102a9ddda37de78bd4732c49d796e30959b468cfbfa469e753bd394f40c5547b9.36%
- cd868b9ef21df50a5b9547c77ae64faec819f6d7184dc802ee097245c92bd88e9.22%
- 159ef7c593f56adcd04436c95f068b2f8fbbf0f5b7133f6b61768ec2fbe319ab6.43%
- 324c211392c9508d9d8e5ffd1665ef6cb572c014c537b078c3bef2f5894ac2664.61%
- 7f76dc430da92dbf91e6ff55c09193738e732baf3ec6d579c4dde1a8b137b1c93.77%
- 2747c35dbfbfd60df3eeda7027f1d1cf8fded80e0798ac87c26bbd8ef22fba7f3.63%
- 4b3fdc67790a96248c86d95f066db5f82884abb8ac952c34cafebe882caca7d72.8%
- 15d5c75e34364eb964574c855ec802fa663007efe64358a1f505679c031957272.52%
- 9622313cf4884cd11143ce82e26521910833972d438ecc94e9fbafe6e3077cb12.38%
- 99c5e5f42dd132b3832947131b194d1668b9963d073fe4a0de5c0734081f1f542.1%
- c23ec8d10b964a7c5c449dbced1cc6feab7d3ff9d33ae5b56e6eec97c41115e2
Process Ancestry
Top Grandparents
- explorer.exe45.89%
- userinit.exe36.37%
- chrome.exe11.3%
- rdpshell.exe1.78%
- runonce.exe1.78%
- GoogleUpdate.exe1.49%
- OpenWith.exe0.59%
- rdpinit.exe0.4%
- AvastBrowser.exe0.1%
- OneDrive.exe0.1%
Top Parents
- chrmstp.exe51.24%
- explorer.exe37.93%
- chrome.exe9.21%
- runonce.exe1.21%
- AvastBrowser.exe0.07%
- brave.exe0.07%
Top Children
- chrmstp.exe99.74%
Lab record
- Installed from
- winget Google.Chrome 153.0.8010.37
- Publisher
- Google LLC
- Persistence
- none
- Network
- none
- Command lines
- 5 patterns (24 launches)
- DLL loads
- 54 patterns (1,057 loads)
- Registry writes
- 14 patterns (90 writes)
- File writes
- 4 patterns (27 writes)
- HTTP requests
- 0 patterns (0 requests)
- TLS connections
- 0 patterns (0 handshakes)
- Named pipes
- 17 patterns (36 events)
- Process access
- 1 pattern (12 events)
- Driver loads
- 0 patterns (0 loads)
- PowerShell blocks
- 0 patterns (0 blocks)
- Remote threads
- 0 patterns (0 events)
- Audit events
- 0 patterns (0 events)
Full record on Team.
Ask Rocky about chrmstp.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for chrmstp.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.