GridinSoft Threat Intelligence

15608.tmp file report

Clean record File reputation report
MD5 fd5cabbe52272bd76007b68186ebaf00
Latest seen 2026-01-27 23:00:50 (4 months ago)
First seen 2017-05-21 03:02:07 (8 years ago)
Size 444 KB
Publisher Microsoft Corporation
Product Microsoft® Visual Studio® 2013
Signed by Microsoft Corporation

Why it matters

Evidence available for this file

Detection

Latest status is clean for this hash.

Timeline

First seen 2017-05-21 03:02:07 (8 years ago); latest analysis 2026-01-27 23:00:50 (4 months ago).

Publisher context

Company metadata: Microsoft Corporation. Product metadata: Microsoft® Visual Studio® 2013.

Digital signature

Signed by Microsoft Corporation. The signature is reported as valid, but signed files can still be bundled or abused.

Aliases

This hash has appeared under multiple file names, which can happen with repackaging, bundling, or deliberate renaming.

Observed locations

ThreatInfo has seen this file in user or system paths listed below. Unexpected locations increase the need for local verification.

Recommended action

What to do next

  1. Confirm the hash and publisher match the expected software.
  2. Review the observed locations and signature information below.
  3. Rescan if the file was downloaded from an unknown source or appears in an unusual path.

File context

15608.tmp is a Windows file recorded in the ThreatInfo database. It is associated with Microsoft® Visual Studio® 2013. The reported company name is Microsoft Corporation. The current detection status is Clean, based on the latest analysis from 2026-01-27 23:00:50 (4 months ago).

This record is currently marked as clean, but file reputation can depend on the exact path, hash, and source. Compare the MD5 and publisher data below with the file on your system.

File Details

Product Name: Microsoft® Visual Studio® 2013
Company Name: Microsoft Corporation
MD5: fd5cabbe52272bd76007b68186ebaf00
Size: 444 KB
First Published: 2017-05-21 03:02:07 (8 years ago)
Latest Published: 2026-01-27 23:00:50 (4 months ago)
Status: Clean (on last analysis)
Analysis Date: 2026-01-27 23:00:50 (4 months ago)

Overview

Signed By: Microsoft Corporation
Status: Valid

The signature on 15608.tmp is reported as valid. A valid signature helps confirm publisher identity, but it does not automatically make the file safe if the installer was bundled, abused, or downloaded from an untrusted source.

Common Places:

%localappdata%\ucbrowser\user data\default\extensions\pbnmnlipmkfkadfcdocgblonoccmolpe\3.1.0_0\bin\pphelper
%temp%\baidu\autoupdate
%localappdata%\ucbrowser\user data\default\extensions\pbnmnlipmkfkadfcdocgblonoccmolpe\3.0.3_0\bin\pphelper
%appdata%\baidu\baiduyunguanjia
%appdata%\другвокруг
%programfiles%\2345soft\2345pic
%localappdata%\vghd\bin
%temp%\qqgamedownloader\120_1490683244_35114
%appdata%\tsv
%localappdata%\ucbrowser\user data\default\extensions\pbnmnlipmkfkadfcdocgblonoccmolpe\3.1.0_1\bin\pphelper

ThreatInfo has observed 15608.tmp in the locations listed above. Files found in temporary folders, user profile folders, startup locations, or unusual application directories should be reviewed more carefully than files installed under a known program directory.

File Names:

55 observed names
msvcp120.dll msvcp120.dll.quarantined msvcp120.dll.old 12474.tmp fd5cabbe52272bd76007b68186ebaf00 msvcp120_IObitDel.dll 10147.tmp msvcp120.dll.20170206101302 msvcp120.dll.(old).(old 8597.tmp 48622.tmp msvcp120.dll.(old 28115.tmp 46298.tmp 34204.tmp msvcp120.dll.old.0 20916.tmp 41418.tmp 11d23.rbf dac3969.rbf e9d0.rbf 2819e.rbf 636fc.rbf 70ea.rbf 4378a604.rbf bab6.rbf effc7bd.rbf 3653d9a.rbf 1e99c.rbf 29d9b54.rbf 1a8e7.rbf 1ab28.rbf 53984.tmp 22109.tmp 48451.tmp 18283.tmp 24604.tmp 32268.tmp msvcp120.dll.20151210205745 29015.tmp MSVCP120.dll.dat 38848.tmp 49138.tmp msvcp120_1.dll 30007.tmp msvcp120.dll.2017033102415 20221.tmp 27711.tmp msvcp120.dlltmp 39742.tmp 32339.tmp 42366.tmp 25645.tmp 43583.tmp 15608.tmp

This hash has been seen with multiple file names. Alternate names can appear when software is updated, copied between folders, packed by an installer, or deliberately renamed to avoid recognition. Compare the exact MD5 above before assuming two names refer to the same file.

Geography:

87 observed countries
12.4%
10.2%
8.7%
4.0%
3.6%
3.3%
3.2%
3.1%
3.1%
2.6%
2.4%
2.4%
2.4%
2.4%
2.4%
2.4%
2.2%
1.8%
1.6%
1.5%
1.4%
1.4%
1.2%
1.1%
1.0%
0.9%
0.9%
0.7%
0.7%
0.7%
0.7%
0.6%
0.6%
0.5%
0.5%
0.4%
0.4%
0.4%
0.4%
0.4%
0.4%
0.3%
0.3%
0.3%
0.3%
0.3%
0.3%
0.3%
0.3%
0.3%
0.3%
0.3%
0.3%
0.2%
0.2%
0.2%
0.2%
0.2%
0.2%
0.2%
0.2%
0.2%
0.2%
0.1%
0.1%
0.1%
0.1%
0.1%
0.1%
0.1%
0.1%
0.1%
0.1%
0.1%
0.1%
0.1%
0.1%
0.1%
0.1%
0.1%
0.1%
0.1%
0.1%
0.1%
0.1%
0.1%
0.1%

The strongest geographic signal for this file is United States with 12.4% of observed hits. Geographic distribution can help identify targeted campaigns, regional software bundles, or where a file is most commonly reported.

OS Version:

Windows 10 61.5%
Windows 7 29.7%
Windows 8.1 6.4%
Windows 8 1.1%
Windows XP 0.7%
Windows Vista 0.2%
Windows Server 2008 R2 0.1%

The most common operating system signal for 15608.tmp is Windows 10 with 61.5% of observed hits. If your system differs from the common profile, check whether the file was introduced by a specific installer, archive, or removable device.

Analysis

15608.tmp is identified as pe for 32-bit systems. The subsystem is Windows GUI. PE header values are useful for triage, especially when they do not match the expected publisher, product, or release timeline.

Format pe
Architecture 32-bit
Subsystem Windows GUI
Entry point 0x0003b707
Image base 0x10000000

PE Sections:

Sections 5
Raw data 438272

Section layout highlights raw-size concentration, repeated names, packer markers, and hashes that can be compared across related samples.

.text 400384 bytes · 91.4% of section data
MD5 0ad784f7e5e4f13aa2f7d4921b12da1d
.data 12288 bytes · 2.8% of section data
MD5 3a1d7225718e16f8087a6afe4213d6c3
.idata 6656 bytes · 1.5% of section data
MD5 895d2ec4016fde3890a3632412f47e5e
.rsrc 1024 bytes · 0.2% of section data
MD5 a54bfad104fe4f6f52d0a0244966bffa
.reloc 17920 bytes · 4.1% of section data
MD5 3ed1e92cd4c0855ef5e52a4fb49c92ca

PE section names and hashes can reveal packing, injected resources, or unusual build artifacts. Sections with uncommon names, very large raw data, or hashes that differ from a trusted copy deserve additional review.

Report conclusion

This hash is currently recorded as clean

Use the MD5, publisher, signature, and observed paths in this report to verify that the file on your device is the same copy described here.

Scan with GridinSoft Anti-Malware Use a local scan if the file origin or behavior is unclear. Check this hash on VirusTotal

Recommended next steps

  • Compare the local file MD5 with fd5cabbe52272bd76007b68186ebaf00.
  • Check the file path, publisher, and signature against the details in this report.
  • Run a GridinSoft scan if the source, path, or behavior looks unusual.