Eudcedit.exe

Private Character Editor Windows Utility

Paths

  • c:\windows\system32\eudcedit.exe
  • c:\windows\syswow64\eudcedit.exe

Commands

UAC Bypass

Once executed, the Private Charecter Editor will be opened - click OK, then click File -> Font Links. In the next window choose the option "Link with Selected Fonts" and click on Save As, then in the opened enter the command you want to execute.

Use case: Execute a binary or script as a high-integrity process without a UAC prompt.

Privileges: Administrator

eudcedit

Detection

Resources