Microsoft Security | Microsoft Defender | Other
Additional Microsoft Defender tools and services that provide security across various platforms and environments
Unicode homoglyph characters in the FileDescription and ProductName
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(316.8, 89%, 40%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAB%3C/text%3E%3C/svg%3E)
Alan Bentley
15
Reputation points
I've noticed unusual Unicode homoglyph characters in the FileDescription and ProductName metadata of the recently distributed Microsoft Defender Update Service.
Executable: DefenderUpdateService.exe Version: 10.8839.26080.2008 SHA256: B215B61BA09D4EC576B96B10131C71DB54D32AAC0EF1930F3CB150C6D7BBD8C3
FileDescription: Μîсґοŝõƒţ Ďèƒ℮ňðěя Ūφďαŧ℮ Ŝěřνįćе
ProductName: Ðèƒēñďєя Цρďąтĕ Şëřνιčĕ
The executable has a valid Microsoft Windows Publisher Authenticode signature and IsOSBinary=True.
I initially noticed this through GlassWire network monitoring. I subsequently deployed a PowerShell audit across multiple Windows 11 workstations
Every responding workstation returned the same executable version, SHA256 hash and unusual Unicode metadata.
This strongly suggests the metadata is part of the distributed Microsoft build rather than an isolated system issue.
My questions:
Is this Unicode obfuscation intentional?
If intentional, what is its purpose?
If unintentional, is Microsoft aware of this apparent resource-metadata issue?
There are no apparent Defender functionality problems. I'm primarily interested in understanding why an officially signed Microsoft security component contains mixed-script Unicode homoglyphs in its file metadata.
Microsoft Security | Microsoft Defender | Other
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(198.4, 17%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDE%3C/text%3E%3C/svg%3E)
David Everall 0 Reputation points2026-11-09T15:29:55.92+00:00 We've observed similar behaviour affecting MsSense.exe in the same Defender for Endpoint platform release family.
Environment
- Component:
MsSense.exe - Version:
10.8839.26080.2008-0 - Location:
C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\Versions\10.8839.26080.2008-0\MsSense.exe - Authenticode signature: Valid Microsoft signature
- Service:
Sense - Service display name remains normal:
Windows Defender Advanced Threat Protection Service
VersionInfo comparison
Previous platform version (
10.8838.26060.15013-0):FileDescription : Windows Defender Advanced Threat Protection Service Executable ProductName : Windows Cyber Defence CompanyName : Microsoft CorporationCurrent platform version (
10.8839.26080.2008-0):FileDescription : Мįςřòѕθƒτ Ďēƒęηδэŗ Ðęτєčťίσʼn åηð Ѓęśрǿήşέ Śëŗνĩčє ProductName : Windows Cyber Defence CompanyName : Microsoft CorporationHashes
10.8838.26060.15013-0 SHA256: 2CDD56E8E3C68F7BA4B909F07753790855A0AD7696DB2D1967417001B1F253FB10.8839.26080.2008-0 SHA256: 01E76B91D291141B19238A0061CE7C97AD3AB03224CF473047D9955340E5BEAB - Component:
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(144, 81%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EL%3C/text%3E%3C/svg%3E)
Lucas_CH 40 Reputation points2026-11-10T08:08:28.68+00:00 Having the same issue on our devices but with the ATP service and not the update service.
Binary Path of this process/service:
"C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\Versions\10.8839.26080.2008-0\MsSense.exe"
SHA256 and certificate info of the executable above:
SHA256: 01E76B91D291141B19238A0061CE7C97AD3AB03224CF473047D9955340E5BEAB PS C:\> Get-AuthenticodeSignature 'C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Platform\Versions\10.8839.26080.2008-0\MsSense.exe' | Format-List Status, StatusMessage, SignerCertificate Status : Valid StatusMessage : Signatur überprüft. SignerCertificate : [Subject] CN=Microsoft Windows Publisher, O=Microsoft Corporation, L=Redmond, S=Washington, C=US [Issuer] CN=Windows Production PCA 2023, O=Microsoft Corporation, C=US [Serial Number] 3300000149B9E7CBBBE295626E000000000149 [Not Before] 18.06.2026 20:40:18 [Not After] 17.06.2027 20:40:18 [Thumbprint] CDCC1456D261BC0EB00975F46DFFB2E24592EDADOS and Defender Info:
- OS: Win11 Education 25H2 26200.9711
- AMEngineVersion : 1.1.26100.4
- AMProductVersion : 4.18.26100.4
- AMServiceVersion : 4.18.26100.4
- AntivirusSignatureVersion : 1.463.222.0
Language Info:
- Parent : de
- LCID : 2055
- KeyboardLayoutId : 2055
- Name : de-CH
- IetfLanguageTag : de-CH
- DisplayName : Deutsch (Schweiz)
- NativeName : Deutsch (Schweiz)
- EnglishName : German (Switzerland)
- TwoLetterISOLanguageName : de
- ThreeLetterISOLanguageName : deu
- ThreeLetterWindowsLanguageName : DES
- CompareInfo : CompareInfo - de-CH
- TextInfo : TextInfo - de-CH
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(272, 25%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMJ%3C/text%3E%3C/svg%3E)
Mike Junor 0 Reputation points2026-11-10T10:02:33+00:00 Seeing exactly the same - localisation QA/test data slipping into the production release?
File : MsSense.exe SHA256 : 01E76B91D291141B19238A0061CE7C97AD3AB03224CF473047D9955340E5BEAB Sig : Valid OSBinary : True Signer : CN=Microsoft Windows Publisher, O=Microsoft Corporation, L=Redmond, S=Washington, C=US File : DefenderUpdateService.exe SHA256 : B215B61BA09D4EC576B96B10131C71DB54D32AAC0EF1930F3CB150C6D7BBD8C3 Sig : Valid OSBinary : True Signer : CN=Microsoft Windows Publisher, O=Microsoft Corporation, L=Redmond, S=Washington, C=US -
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(316.8, 96%, 40%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Alex 0 Reputation points2026-11-10T13:50:32.57+00:00 Same here, but in addition I've got the same with the updater:
Both files were signed using a certificate which is expirering soon:
Status : ValidStatusMessage : Signatur wurde überprüft.
TimeStamperCertificate : [Subject]
CN=Microsoft Time-Stamp Service, OU=nShield TSS ESN:3605-05E0-D947, OU=Microsoft Ireland Operations Limited, O=Microsoft Corporation, L=Redmond, S=Washington, C=US [Issuer] CN=Microsoft Time-Stamp PCA 2010, O=Microsoft Corporation, L=Redmond, S=Washington, C=US [Serial Number] 3300000213B0433566CFAF95E8000100000213 [Not Before] 14.08.2025 20:48:17 [Not After] 13.11.2026 19:48:17 [Thumbprint] 98113C4828F182369C9B2F3F544764ECDC6947A6All other files belonging to defender use different certificate, maybe a coincident but remarkable.
-
Mike Junor 0 Reputation points
2026-11-10T14:57:16.8066667+00:00 Some context/background info here:
https://superuser.com/questions/1340277/pseudo-english-looking-characters-used-in-windows-10-insider-previewSome other reports from a couple of months back but in insider/early releases.
(... and if that URL doesn't give you the creeps too 😆)
Hopefully this gets cleared or acknowledged soon - it's still giving me the creeps seeing it in Task Manager.
Sign in to comment
Sign in to answer