chrmstp.exe file report

MD5 6ec935208b9d92e845df94501de319ee
Latest seen 2026-01-29 23:01:00 (4 months ago)
First seen 2023-10-21 23:51:15 (2 years ago)
Size 2 MB

Why it matters

Evidence available for this file

Detection

No final classification is available yet.

Timeline

First seen 2023-10-21 23:51:15 (2 years ago); latest analysis 2026-01-29 23:01:00 (4 months ago).

Publisher context

Company metadata: Dragon Boss Solutions LLC. Product metadata: Chromstera Installer.

Observed locations

ThreatInfo has seen this file in user or system paths listed below. Unexpected locations increase the need for local verification.

Recommended action

What to do next

  1. Use the hash and metadata below to verify the exact file identity.
  2. Review publisher, signature, paths, and PE details for inconsistencies.
  3. Run a local scan if the file appears unexpectedly or starts with Windows.

chrmstp.exe is a Windows file recorded in the ThreatInfo database. It is associated with Chromstera Installer. The reported company name is Dragon Boss Solutions LLC. The current detection status is Undefined, based on the latest analysis from 2026-01-29 23:01:00 (4 months ago).

ThreatInfo does not have a final classification for this file yet. Use the technical details below to compare the hash, size, signature, and observed locations with the copy found on your device.

Product Name: Chromstera Installer
Company Name: Dragon Boss Solutions LLC
MD5: 6ec935208b9d92e845df94501de319ee
Size: 2 MB
First Published: 2023-10-21 23:51:15 (2 years ago)
Latest Published: 2026-01-29 23:01:00 (4 months ago)
Status: Undefined (on last analysis)
Analysis Date: 2026-01-29 23:01:00 (4 months ago)
%programfiles%\chromstera\application\117.0.5903.0
%programfiles%\chromstera\application\117.0.5903.0
%programfiles%\chromstera\application\117.0.5903.0
%programfiles%\chromstera\application\117.0.5903.0
%programfiles%\chromstera\application\117.0.5903.0
%programfiles%\chromstera\application\117.0.5903.0
%programfiles%\chromstera\application\117.0.5903.0
%programfiles%\chromstera\application\117.0.5903.0
%programfiles%\chromstera\application\117.0.5903.0
%programfiles%\chromstera\application\117.0.5903.0

ThreatInfo has observed chrmstp.exe in the locations listed above. Files found in temporary folders, user profile folders, startup locations, or unusual application directories should be reviewed more carefully than files installed under a known program directory.

58.3%
25.0%
8.3%
8.3%

The strongest geographic signal for this file is United States with 58.3% of observed hits. Geographic distribution can help identify targeted campaigns, regional software bundles, or where a file is most commonly reported.

Windows 10 100.0%

The most common operating system signal for chrmstp.exe is Windows 10 with 100.0% of observed hits. If your system differs from the common profile, check whether the file was introduced by a specific installer, archive, or removable device.

chrmstp.exe is identified as pe for 64 systems. The subsystem is Windows GUI. PE header values are useful for triage, especially when they do not match the expected publisher, product, or release timeline.

Subsystem: Windows GUI
PE Type: pe
OS Bitness: 64
Image Base: 0x0000000140000000
Entry Address: 0x001a7d30

PE Sections:

Name Size of data MD5
.text 1967616 a314b26b96186c99d08962c2f02e24f2
.rdata 290816 58b2ba678511ed001b49db0e9df9b40a
.data 66560 dbed1d69c32f1bedacf5bd1943b47ca4
.pdata 73728 3e59de401fc2c195379ea890d357fbf4
.00cfg 512 403ab1c1956a838882aee546ebc30ce1
.gxfg 12800 8e4adad5da09059053829b9e9d29e3b9
.retplne 512 ada58c4e0969186bfa459dc73c86e1e9
.tls 1024 699fca3cde86213d6ceb8f89e4a3927e
CPADinfo 512 60d3ea61d541c9be2e845d2787fb9574
LZMADEC 4608 05e9eab8428a551a281ab278073669fa
_RDATA 512 d82aaf97625cd01b783cef4e95629a95
malloc_h 512 bd5d15776f1fc6098a1d0bb41a977580
.rsrc 251904 9b78ec15b839c7d5dc595cc15b541b06
.reloc 9216 c87f810d21f215086413945ca71c519b

PE section names and hashes can reveal packing, injected resources, or unusual build artifacts. Sections with uncommon names, very large raw data, or hashes that differ from a trusted copy deserve additional review.

More information: