Soft.exe

: It modifies registry keys in HKCU\Software\Microsoft\Windows\CurrentVersion\Run and Winlogon to ensure it restarts every time the computer boots. Forensic Indicators (IOCs)

: It may drop secondary executables with randomized names or names like svchost015.exe . Summary Table: Behavioral Analysis Observed Activity Type Ransomware Downloader / InfoStealer Delivery Soft.exe

: It has been documented as a downloader for Locky ransomware and has appeared in campaigns involving the RagnarLocker threat group. Soft.exe