Image File Execution Options Debugger

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•1

Detects an Image File Execution Options debugger value for vds.exe that redirects execution to an executable stored in Windows Fonts. This specific condition is often associated with the SprySOCKS component, indicating a potential malicious persistence mechanism rather than a common Windows artifact.