SonicCrypt Payload Execution

nomit vyas@xoxo

•updated Jun 23, 2026•0•0•2

Detects the execution of executables with specific names ("WinHealth.exe", "WindowsSecurity.exe") known to be dropped by the SonicCrypt crypter. The execution is often initiated by the Task Scheduler, resulting in a parent process of 'taskhostw.exe'.