# File.hash.sha256 encoded as UTF‑16LE
**URL:** https://discuss.elastic.co/t/file-hash-sha256-encoded-as-utf-16le/382196
**Category:** Elasticsearch
**Created:** [September 24, 2025, 10:47am UTC](https://discuss.elastic.co/t/file-hash-sha256-encoded-as-utf-16le/382196 "2025-09-24T10:47:08Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@dynamicint](https://discuss.elastic.co/u/dynamicint)
#### Post date: [September 24, 2025, 10:47am UTC](https://discuss.elastic.co/t/file-hash-sha256-encoded-as-utf-16le/382196/1 "2025-09-24T10:47:08Z")
The following field:
file.hash.sha256
Which is (now) the same as:
winlog.user\_data.FileHash
Has an encoding problem in Elastic 9.1.4. It's encoded with UTF‑16LE, which means that the first bytes with the proper sha256 length is the correct 32 characters, but some metadata is also encoded:
file.hash.sha256:
`E2D3CCE4F637F53F0267D049E3B3246AF53B043B1F9517B2DD53F8B85FF0693F4F003D004D004F005A0049004C004C004100200043004F00520050004F0052004100540049004F004E002C0020004C003D004D004F0055004E005400410049004E00200056004900450057002C00200053003D00430041004C00490046004F0052004E00490041002C00200043003D00550053005C005C005C0030002E0030002E0030002E003000300000005200500043003A005C00570049004E0044004F00570053005C00540065006D0070005C006E007300640042003000340043002E0074006D0070005C00530079007300740065006D002E0064006C006C0000002A00`
Decoded from UTF‑16LE we get:
`E2D3CCE4F637F53F0267D049E3B3246AF53B043B1F9517B2DD53F8B85FF0693F4F = M O Z I L L A CORRPORTATION, L=MOUNT AIN VIEW, S=CALIFORNIA, C=US\0.0.0.00 R:PC:\WINDOWS\Temp\nsdB04C.tmp\System.dll*`
Why is this the case, is it intended, or a bug?
---
### Author:  [@michael-a](https://discuss.elastic.co/u/michael-a)
#### Post date: [October 8, 2025, 10:31am UTC](https://discuss.elastic.co/t/file-hash-sha256-encoded-as-utf-16le/382196/2 "2025-10-08T10:31:00Z")
Any chance someone from Elastic could have a look at this one?