It has used hidden or non-printing characters to help masquerade service names, such as appending a Unicode no-break space character to a legitimate service name. It has also impersonated the legitimate Flash installer file name "install_flashplayer.exe".