I'm seeing a strange key HKEY_CLASSES_ROOT\핵樦Ḁ耀 in my registry.

I've seen a few issues like this (here and here) that relate to a UTF-16 <-> ASCII encoding bug, and I've tried translating encodings to see if this helps, but it doesn't seem to.

I tested this with Python like so, after getting the byte values from an online converter since my terminal doesn't support UTF very well:

# byte values returned from encoding 핵樦Ḁ耀 is this.
encoded_bytes = '75d5266a001e0080'

# Attempt to decode as ASCII fails as byte values are out of range

# Yields the error message "'ascii' codec can't decode byte 0xd5 in position 1: ordinal not in range(128)"
# No way this is ASCII, regardless of le vs. be

# Trying utf-8 as well with little/big end encoding with error message "'utf-8' codec can't decode byte 0xd5 in position 1: invalid continuation byte"
bytes.fromhex('75d5266a001e0080').decode('utf-8') # Error
bytes.fromhex('d5756a261e008000').decode('utf-8') # Same error, but at position 0

It seems to have a nonsensical translation per Google Translate, and it's unlikely that it has any real meaning anyway since there's one Korean glyph, two Chinese glyphs, and one Latin character.

Is this also likely to be an encoding problem? If so, any thoughts on what the actual value is?

Update: I ran a full system scan with McAfee and it didn't turn up anything, which makes sense since this is a fairly fresh PC.

  • What's inside? A (Default) REG_SZ with .gz_auto_file? Commented Jun 27, 2020 at 5:37
  • It's .go_auto_file.
    – drognisep
    Commented Jun 27, 2020 at 6:02
  • The reason is probably the same, although I found a E7 DB 5C 56 00 01 00 80 with .gz_auto_file. I can also confirm you got the bytes right with the online tool, as they are the same that would be in the .reg file exported from the Registry Editor. Commented Jun 27, 2020 at 7:14
  • Okay cool. Thanks for checking! 😁
    – drognisep
    Commented Jun 27, 2020 at 7:16


You must log in to answer this question.

Browse other questions tagged .