DragonForce Ransomware Restart Manager API Use to Unlock Files
Detects the loading of the Restart Manager DLL (rstrtmgr.dll) by suspicious processes, such as those running from writable user paths (e.g., Temp, AppData) or masquerading as numeric-only named executables. Adversaries may abuse this library for process termination or interaction to facilitate malicious operations, such as clearing file locks during deployment.
Cortex XDR
