The world of partially downloaded files…

Update

Don’t read the old post. It’s a result of an experiment and the experiment failed 🙂

Thanks to _BradleyVX who pointed out the hallucinations that sneaked in to the below list.

Don’t do AI at home, kids!

If you need a list of temporary file names and extensions have a look at this great list, or other file extension lists.

Old Post

Anytime you download a file via a browser, instant messenger, or other apps… it is first saved to a temporary file…

These temporary files are saved with some particular extensions:

For Browsers:

  • Chrome – .crdownload
  • Firefox – .download (hallucination! should be .part)
  • Opera – .opdownload
  • Safari – .part (hallucination! should be .download)
  • Microsoft Edge – .temp (hallucination! should be .partial)
  • Brave – .brave-download

For email clients (most are hallucinations):

  • Microsoft Outlook – .tmp
  • Mozilla Thunderbird – .part
  • Apple Mail – .download
  • Gmail Web – .tmp
  • Yahoo Mail – .tmp
  • ProtonMail – .tmp
  • Tutanota – .tmp

For Instant Messengers (most are hallucinations):

  • WhatsApp – .temp
  • Telegram – .temp
  • Discord – .dat
  • Signal – .tmp
  • Skype – .part
  • Facebook Messenger – .download
  • Google Chat – .temp

Are there any others?

Now, in the interest of full disclosure… I have not written much of this post. In the past I would manually download these programs, and then would spend hours testing their file-saving capabilities. For this post, I simply asked Google Bard. It’s terrifying and amazing at the same time.

Beyond good ol’ Run key, Part 74

This is a very obscure persistence mechanism that affects VMWare Tools versions that utilize the vm3dum DLL (‘VMware SVGA 3D Usermode’):

  • c:\Program Files\Common Files\VMware\Drivers\video_wddm\vm3dum.dll

When loaded (which happens e.g. when Internet Explorer is launched) the DLL checks the content of the following registry key:

  • HKLM\SOFTWARE\VMware, Inc.\VMware Tools\Usermode\
    AdapterShimPath=<path>

and loads library that the path points to.

There is also one more key:

  • HKLM\SOFTWARE\VMware, Inc.\VMware Tools\Usermode\
    ShimPath=<path>

but the condition for loading this DLL is not entirely clear to me.