Private Character Editor Windows Utility Located at: c:\windows\system32\eudcedit.exe; c:\windows\syswow64\eudcedit.exe.
eudcediteudceditSandbox: execFile · Timeout: 30s
security.privilege-escalation.uac-bypass Outputs
process.output Command execution output
privilege_escalationprocess_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Once executed, the Private Charecter Editor will be opened - click OK, then click File -> Font Links. In the next window choose the option "Link with Selected Fonts" and click on Save As, then in the opened enter the command you want to execute. (Execute a binary or script as a high-integrity process without a UAC prompt.)
eudcedit| Type | Rule / Indicator |
|---|---|
| ioc | Processes spawned by eudcedit.exe. |
eudcedit is a Windows LOLBin. Private Character Editor Windows Utility Located at: c:\windows\system32\eudcedit.exe; c:\windows\syswow64\eudcedit.exe.