eudcedit.exe

Private Character Editor file version info (xCyclopedia)

LOLBAS UAC Bypass 1 ATT&CK technique 1 documented command 10 known copies with hashes

How eudcedit.exe is abused

documented by LOLBAS

UAC Bypass T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for eudcedit.exe.

1 documented command

from LOLBAS, each read by the identifier

UAC Bypass T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control Administrator privileges

Once executed, the Private Charecter Editor will be opened - click OK, then click File -> Font Links. In the next window choose the option "Link with Selected Fonts" and click on Save As, then in the opened enter the command you want to execute.

eudcedit

Identify

The command the identifier reads trips no Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for eudcedit.exe, by Matan Bahar, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for eudcedit.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

T1548.002Abuse Elevation Control Mechanism: Bypass User Account Control

Is it the real eudcedit.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionPrivate Character Editor

10 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\eudcedit.exe · signed by Microsoft Windows

de1c3c55f1b5d18f5ab792d51a849b32292c4802207c5b0e0dfb02404ec7a1a4

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\eudcedit.exe · signed by Microsoft Windows

e18b517ab996dd5b25dfeb28130d6e1e01af7cd5ffa19f506b4f8a656678e9be

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\eudcedit.exe · signed by Microsoft Windows

83c8d1a7582b24b4bbc0d453c813487185c2b05c483bd1759ef647a7e7e92dfe

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\eudcedit.exe · signed by Microsoft Windows

9df01a528a262f4aab5eb53c9600ac0a2578cfa52b642a7e8a0fea3eae3b7f03

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\eudcedit.exe · signed by Microsoft Windows

4322c064bbfe6b29600fcab38a0945230af6af2f6e199757ab71eb82385b0bee

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\eudcedit.exe · signed by Microsoft Windows

990fb2b52e6ff69c108dd6bf7da17af99d93721da277d40923b6f0a9021c8340

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\eudcedit.exe · signed by Microsoft Windows

4541091e0f28f0fe29a1c3ed9086922f0fca4910ac3bd4178064b3cb8097ad20

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\eudcedit.exe · signed by Microsoft Windows

69a75af2a72d2bb5bdfe7fbed5d155bd0ca0f466c8aff9f762c3c8cb182ce8ed

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\eudcedit.exe · signed by Microsoft Windows

5170266ee04db446334f75589e4660069765d3a0d0ca8649303c9eb9b74f13d3

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\eudcedit.exe · signed by Microsoft Windows

a3d0b2683ff84cfb46650a67d50e1794c6cf3dcd0cd6ce1b974595f61cccbd6b

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.